JP4821735B2 - VPN topology control device, VPN topology control system, VPN topology control method and program - Google Patents

Description

  The present invention relates to a technique for forming a VPN topology according to a communication situation by controlling a plurality of routers.

  In a corporate network, when a LAN (Local Area Network) scattered in a plurality of bases is connected to the network, it is often connected via a VPN (Virtual Private Network) due to security. Of the various topologies formed by VPN, full-mesh topology that connects all bases to each other is ideal in terms of minimizing delay, but the routers installed at each base have processing power. There is a limit and there is a limit to the number of VPNs that a router can connect to simultaneously.

  For this reason, it is difficult to adopt a full-mesh topology. For example, a star-type topology that connects branch offices around the headquarters is used, or a real-time application such as VoIP (Voice over Internet Protocol) is used. In some cases, branch offices are connected by VPN. In addition, when used for purposes such as in-house education, multicast streaming may be performed, and a tree-type topology may be employed in which each base is connected hierarchically.

As described above, since the optimum topology formed by the VPN is determined by the application to be used, it is desirable to dynamically change the VPN topology according to the application. For this reason, a technique for automatically setting a VPN is disclosed in Non-Patent Document 1, for example.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t13/ftgreips.htm

  In the technique disclosed in Non-Patent Document 1, automatic setting is performed according to a preset topology. Therefore, it is necessary to predict the data flow in advance and design the topology. However, it is difficult to predict the data flow, and it is difficult to design an optimum topology. Further, in a network in which the data flow changes greatly as the application changes, the performance may be suppressed in terms of bandwidth and delay in a fixed topology.

  The present invention has been made in view of the above-described circumstances, and a VPN that can automatically change the topology formed by a VPN connecting between bases in accordance with the state of data flow between the bases. An object is to provide a topology control device, a VPN topology control system, a VPN topology control method, and a program.

  In order to solve the above-mentioned problem, the present invention is a VPN topology control apparatus for controlling a topology formed by VPNs constituting a data flow path between a plurality of routers, wherein the VPN indicates a VPN forming the topology. A storage unit that stores a database; a monitoring unit that monitors a communication state of a data flow in the VPN that forms the topology; a router that indicates a transmission source and a reception destination of a data flow among the plurality of routers; Based on the communication status monitored by the monitoring means, the receiving means for receiving the generation request information indicating the waiting time until transmission is started, and within the waiting time indicated by the generation request information received by the receiving means Determining means for determining a VPN whose data flow is terminated as a disconnection reservation VPN, and the VPN database A path using the VPN between the two routers indicated by the generation request information received by the reception unit and a topology capable of forming the path based on the VPN indicated and the disconnection reservation VPN determined by the determination unit. A VPN topology comprising: calculation means for calculating using a predetermined algorithm; and setting means for setting VPN for the plurality of routers so as to form the topology calculated by the calculation means. A control device is provided.

  Moreover, in another preferable aspect, it may further comprise a disconnecting means for disconnecting the VPN for which the data flow has been completed from the communication status monitored by the monitoring means.

  In another preferable aspect, the setting unit may calculate the topology calculated by the calculation unit after a VPN that is not included in the topology calculated by the calculation unit is disconnected by the disconnection unit. VPN may be set for the plurality of routers so as to form a network.

  In another preferred embodiment, the setting unit may apply a VPN to the plurality of routers so as to form the topology calculated by the calculation unit after all the disconnection reservation VPNs are disconnected by the disconnection unit. May be set.

  In another preferred embodiment, the generation request information received by the receiving unit includes information indicating a total amount of data in a data flow, and the determining unit receives a communication status monitored by the monitoring unit and the receiving unit receives Based on the total amount of data indicated by the generation request information, the VPN at which the data flow ends may be determined as the disconnection reserved VPN within the waiting time indicated by the generation request information received by the receiving means.

  In another preferred embodiment, the determination unit receives the reception unit based on a communication status monitored by the monitoring unit among VPNs connected to each router on the path calculated by the calculation unit. The VPN at which the data flow ends may be determined as the disconnection reservation VPN within the waiting time indicated by the generation request information.

  In another preferable aspect, after the setting by the setting unit is completed, generation response information indicating that a data flow path has been generated between the two routers is sent to the transmission source of the generation request information. You may further provide the transmission means to transmit.

  Further, the present invention comprises a plurality of routers capable of forming a VPN between them, a communication terminal connected to the router, and the VPN topology control device described above, and a generation request received by the receiving means The information is transmitted from the communication terminal, the transmission source router indicated by the generation request information indicates the router to which the communication terminal is connected, and the communication terminal receives the generation response information transmitted from the transmission unit. After the data flow is transmitted, the plurality of routers, among the routes until the data flow transmitted by the communication terminal is received by the communication terminal connected to the destination router indicated by the generation request information And a VPN topology control system for controlling the route between the source router and the destination router to be the path calculated by the calculating means To provide.

  The present invention also relates to a VPN topology control method for controlling a topology formed by VPNs constituting a data flow path between a plurality of routers, and storing a VPN database indicating VPNs forming the topology A monitoring process for monitoring a communication state of a data flow in the VPN forming the topology, a router indicating a transmission source and a reception destination of the data flow among the plurality of routers, and transmission of the data flow are started. Based on the reception process for receiving the generation request information indicating the waiting time and the communication status monitored in the monitoring process, the data flow ends within the waiting time indicated by the generation request information received in the reception process. A determination process for determining a VPN as a disconnection reservation VPN, and a VPN indicated by the VPN database A path using VPN between the two routers indicated by the generation request information received in the reception process and a topology capable of forming the path based on N and the disconnection reservation VPN determined in the determination process. A VPN topology control method comprising: a calculation process calculated using an algorithm of the above; and a setting process for setting a VPN for the plurality of routers so as to form a topology calculated by the calculation process I will provide a.

  The present invention also provides a storage function for storing a VPN database indicating a VPN forming the topology in a computer that controls the topology formed by the VPN constituting a data flow path between a plurality of routers, and the topology. A monitoring function for monitoring a communication state of a data flow in the VPN to be formed, a router indicating a transmission source and a reception destination of the data flow among the plurality of routers, and a waiting time until the transmission of the data flow is started Based on the reception function that receives the generation request information that is indicated, and the communication status that is monitored by the monitoring function, the VPN that terminates the data flow is disconnected and reserved within the waiting time indicated by the generation request information received by the reception function. A decision function to decide as, a VPN indicated by the VPN database, and the decision The path using the VPN between the two routers indicated by the generation request information received in the reception function and the topology capable of forming the path based on the disconnection reservation VPN determined in the function using a predetermined algorithm Provided is a program for realizing a calculation function to calculate and a setting function to set a VPN for the plurality of routers so as to form a topology calculated by the calculation function.

  According to the present invention, a VPN topology control device, a VPN topology control system, and a VPN that can automatically change the topology formed by the VPN connecting the bases according to the data flow status between the bases. A topology control method and program can be provided.

  Hereinafter, an embodiment of the present invention will be described.

<Embodiment>
As shown in FIG. 1, the VPN topology control device 1 according to the embodiment of the present invention includes routers 2-R1, 2-R2,... When the routers at the bases are not distinguished from each other, they are referred to as routers 2). Each router 2-R1, 2-R2,..., 2-R6 is connected to a plurality of communication terminals 3 to constitute a LAN at each site. Each router can be connected to another router by VPN based on the control of the VPN topology control device 1, and in this embodiment, one router is connected to a maximum of three routers and VPN. Connection can be made. Hereinafter, the configuration of the VPN topology control device 1 and the configuration of the router 2 will be described.

  The configuration of the VPN topology control device 1 will be described with reference to FIG. The VPN topology control device 1 transmits / receives information to / from the router 2 at each base via a network 100 and a control unit having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The communication part 11 which performs is comprised. Then, the CPU reads the program stored in the ROM, loads it into the RAM, and executes it, thereby realizing the function of the VPN topology control device 1.

  The function realized by the CPU of the VPN topology control device 1 executing the program will be described in detail below.

  The VPN database 12 has information indicating the topology formed by the VPNs connecting the routers 2, and specifically, the routers 2 are connected as shown in FIG. It is a database which shows the VPN which is currently performing, the data flow which passes the said VPN, and whether the disconnection reservation flag is set about each VPN. For example, the VPN identification number “1” indicates the VPN connecting the router 2-R1 and the router 2-R2, and four data flows (flow numbers: 1, 2, 10, 11) pass through this VPN. ing. The flow number corresponds to a flow number in the flow database 13 described later, and specifies each data flow. In addition, a disconnection reservation flag is set in the VPN identification number “2”, but the disconnection reservation flag prohibits the passage of this VPN even when a new data flow occurs, and data already passing This flag indicates that the VPN is to be disconnected and extinguished after the flow ends.

  The flow database 13 has information indicating data flows passing through all the VPNs. Specifically, as shown in FIG. 3B, the data flow corresponds to the flow number used in the VPN database 12. This is a database showing the flow identifier, the total data amount of the data flow, and the waiting time. The flow identifier indicates a start point IP address, an end point IP address, a protocol, a start point port number, and an end point port number. The waitable time indicates a time that can be waited from when a data flow transmission request is made until data flow transmission is started. For example, in the flow number “1”, the flow identifier is the start point IP address 192.168.0.2, the end point IP address 192.168.1.2, the protocol TCP, the start point port number 5020, the end point port number 21, and the total data amount Indicates that the waiting time is 20 seconds.

  The VPN topology calculation unit 14 is transmitted via the router 2 from the communication terminal 3 that requests generation of a VPN for transmission of a new data flow, and the generation request information received by the communication unit 11 is input. The generation request information indicates the flow identifier of the data flow, the total data amount of the data flow, and the waiting time as in the information that the flow database 13 has. Based on the flow identifier, the transmission source router 2 to which the data flow transmission source communication terminal 3 (hereinafter referred to as transmission terminal 3-A) is connected and the data flow reception destination communication terminal 3 (hereinafter referred to as reception terminal 3-B). ) Is connected to the destination router 2. The VPN topology calculation unit 14 receives flow information transmitted from each router 2 and received by the communication unit 11. The flow information will be described later.

  When the generation request information is input, the VPN topology calculation unit 14 determines the source router based on the generation request information, the contents of the VPN database 12, the contents of the flow database 13, and the input flow information. A path using the VPN with the receiving router and a topology capable of forming the path are calculated using a predetermined algorithm. For a given algorithm, the VPN whose data flow has been terminated is disconnected and disappeared, and the VPN whose data flow is scheduled to be terminated within a predetermined time is stored and stored, and these VPNs do not exist Based on the assumed topology, a topology capable of forming an optimum path is calculated. An example of the details will be described later.

  The router setting unit 15 transmits the setting request information generated based on the result (topology, path) calculated by the VPN topology calculating unit 14 to each router 2 via the communication unit 11. The setting request information transmitted to each router 2 includes information for instructing VPN connection between the router 2 to which the setting request information is transmitted and the other router 2. As will be described later, each router 2 forms a VPN so as to have the topology calculated by the VPN topology calculation unit 14 by connecting the VPN to another router 2 based on the setting request information. Is done.

  The setting request information includes information (flow identifier, total data amount) indicating a data flow passing through the router 2 that receives the setting request information, and the router 2 to which the setting request information is transmitted receives the data flow. If it is not the destination router, it has information indicating the router 2 that is the connection destination of another VPN that transfers the data flow. Thereby, each router 2 can recognize the path of the data flow. When each router 2 transfers the data flow according to the setting request information, the data flow is set so that the path calculated by the VPN topology calculation unit 14 is obtained. Will pass through.

  The database update unit 16 receives the setting response information transmitted from each router 2 and received by the communication unit 11, and updates the contents of the VPN database 12 and the flow database 13 based on the setting response information. Although the setting response information will be described later, in each router 2, when VPN connection is successfully performed based on the setting request information, the VPN database 12 indicates the topology calculated by the VPN topology calculation unit 14. And the flow database 13 is updated so that a new data flow is added.

  The VPN generation response unit 17 receives the setting response information received by the communication unit 11, and generates the generation response information indicating whether or not the setting based on the setting request information has been performed without any problem in each router 2. Via the transmission terminal 3-A. The VPN generation response unit 17 compares the topology and path calculated by the VPN topology calculation unit 14 with the topology and path indicated by the VPN database 12 and the flow database 13, and if they match, the generation response Information may be transmitted.

  Next, the configuration of each router 2 will be described with reference to FIG. The router 2 includes a control unit having a CPU, a ROM, a RAM, and the like, and a router communication unit 21 that transmits / receives information to / from other routers and the VPN topology control device 1 via the network 100. Then, the CPU reads out the program stored in the ROM, loads it into the RAM and executes it, thereby realizing the function of the router 2.

  The functions realized by the CPU of the router 2 executing the program will be described in detail below.

  The timer 22 is a time measuring means for measuring the progress of time, and has a function capable of calculating the elapsed time based on a predetermined time.

  The passage data detection unit 23 detects the data amount of data to be transmitted / received in the router communication unit 21 (hereinafter referred to as passage data amount) for each data flow, and stores information that associates the data flow with the passage data amount in the flow cache 24. Output.

  The flow cache 24 is a cache showing a data flow transmitted and received in the router communication unit 21. As shown in FIG. 3C, the flow identifier, total data amount, passage data as described in the flow database 13 is used. Cache indicating the passing data amount indicated by the information input from the detection unit 23, the elapsed time from the start of data flow transmission, and the time required for the end of data flow transmission (hereinafter referred to as the scheduled end time) It is. The elapsed time is obtained by measuring the elapsed time with the timer 22 based on the time when the passing data amount starts to increase. The scheduled end time is calculated based on the total data amount, the passage data amount, and the elapsed time. As described above, the passing data amount, the elapsed time, and the scheduled end time indicated by the flow cache 24 are information that is updated as needed. Here, the flow identification number is a number provided to distinguish the data flow passing through the router 2, and is uniquely provided in each router 2. This flow identification number may be provided as a number corresponding to the flow number used in the VPN topology control device 1. In this case, regarding the information indicating the data flow included in the setting request information transmitted from the router setting unit of the VPN topology control device 1 to the router 2, the flow number registered in the flow database 13 in addition to the flow identifier and the total data amount As well as show.

  The VPN setting unit 25 receives the setting request information transmitted from the VPN topology control device 1 and received by the router communication unit 21 and connects the router communication unit 21 to another router 2 indicated by the setting request information. As a result, the VPN is formed, and the router 2 or the receiving terminal 3-B that is the transfer destination of the data flow received for each data flow is set. This is performed, for example, by updating a routing table or the like. The VPN setting unit 25 registers information indicating the data flow in the setting request information in the flow cache. When the setting and registration described above are completed, the VPN setting unit 25 transmits setting response information indicating the setting and registration contents to the VPN topology control device 1 via the router communication unit 21.

  The flow information generation unit 26 reads the scheduled end time of the flow cache 24, generates flow information indicating the scheduled end time of each data flow, and sends the flow information to the VPN topology control device 1 via the router communication unit 21. Send to. The flow information may be transmitted periodically or in response to a request from the VPN topology control device 1. The request from the VPN topology control device 1 may be made when the VPN topology calculation unit 14 performs calculation using a predetermined algorithm, for example. The above is the description of the configurations of the VPN topology control device 1 and the router 2.

  Next, the flow of transmission / reception of each information in the VPN topology control device 1, each router 2, the transmission terminal 3-A and the reception terminal 3-B will be described with reference to FIG.

  First, the transmission terminal 3-A transmits generation request information to the VPN topology control device 1 when a request to transmit a data flow is generated to the reception terminal 3-B.

  The VPN topology control device 1 receives the generation request information and transmits the setting request information to each router 2 so as to form a topology calculated using a predetermined algorithm. Each router 2 performs VPN connection setting and data flow registration based on the setting request information, and transmits setting response information indicating the setting and registration status to the VPN topology control device 1.

  After that, the VPN topology control device 1 generates the generation response information indicating whether or not the setting response information received from all the routers indicates that the VPN connection setting and the data flow registration have been successful. Sent to A. If the generation response information indicates success, the transmission terminal 3-A determines that a path to the reception terminal 3-B has been formed, and starts transmission of the data flow. The data flow is transmitted from the transmission terminal 3-A to the reception terminal 3-B via each router 2 on the path by VPN.

  Next, an example of a predetermined algorithm in the VPN topology calculation unit 14 of the VPN topology control device 1 will be described with reference to the flowcharts of FIGS.

  When the generation request information is input, the VPN topology calculation unit 14 sets the router 2 having the transmission terminal 3-A, that is, the transmission source router 2 as the router S, and the router 2 having the reception terminal 3-B, that is, the reception destination router. 2 is defined as router D. Also, the router 2 serving as a reference in the algorithm is defined as the router P, and P = S is set as the first reference (step S100 in FIG. 6). The router S indicated by the router P may be changed to another router 2 by continuing the process described below. In this case, the route following the router 2 indicated by the router P and Finally, a route from the router 2 to the router D indicated by the router P is a data flow path from the router S to the router D. Here, when the router 2 indicated by the router P is changed to another router 2, the router 2 shown in the past is not shown again, that is, it does not pass through the same router 2 twice in the data flow path. . As such premise, the VPN topology calculation unit 14 will be described with reference to the generation request information, the VPN database 12, the flow database 13, and the flow information.

  The VPN topology calculation unit 14 refers to the VPN database 12 and determines whether a path from the router P to the router D exists (step S101 in FIG. 6). When it is determined that the path does not exist (step S101 in FIG. 6; No), processing in steps S111 to S114 in FIG. 6 described later is performed to determine whether or not direct connection from the router P to the router D by the VPN is possible. To do.

  On the other hand, if it is determined that the path exists (step S101 in FIG. 6; Yes), it is determined whether there is a path composed only of VPNs for which the disconnection reservation flag is not set among the paths from the router P to the router D. Judgment is made (step S102 in FIG. 6). When it is determined that the path exists (step S102 in FIG. 6; Yes), the process proceeds to step S201 in FIG. In this case, the path is used as it is as a path from the router P to the router D.

  On the other hand, if it is determined in step S102 in FIG. 6 that there is no path composed only of VPNs for which the disconnection reservation flag is not set (step S102 in FIG. 6; No), the currently used VPN is used. As a premise, the process proceeds to step S301 in FIG.

  When it is determined in step S101 in FIG. 6 that there is no path (step S101 in FIG. 6; No), the VPN topology calculation unit 14 determines that if there is a VPN connected to the router P, It is determined from the scheduled end time of each data flow indicated by the flow information whether there is a VPN in which all the data flows end within the waiting time of the new data flow indicated by the generation request information (step S111 in FIG. 6). When it is determined that there is a VPN for which all data flows are completed (step S111 in FIG. 6; Yes), the VPN is stored and a disconnection reservation flag is set (step S112 in FIG. 6).

  On the other hand, when it is determined that there is no VPN that ends all data flows, or when it is determined that there is no VPN that ends all data flows because there is no VPN connected to the router P (step in FIG. 6). S111; No) determines whether the number of VPNs connected to the router P has reached the upper limit number of connectable VPNs (3 in this embodiment) (step S113 in FIG. 6). If it is determined (step S113 in FIG. 6; Yes), it is determined that the router P and the router D cannot be directly connected by VPN, and the process proceeds to step S301 in FIG.

  When it is determined that the VPN upper limit number has not been reached after the processing in step S112 in FIG. 6 or in step S113 in FIG. 6 (step S113 in FIG. 6; No), the number of VPNs to which the router D is connected is It is determined whether the maximum number of possible VPNs (3 in the present embodiment) has been reached (step S114 in FIG. 6), and if it is determined that it has reached (step S114 in FIG. 6; Yes), the router P and the router It is assumed that D cannot be directly connected to VPN by going to step S301 in FIG.

  When it is determined in step S114 in FIG. 6 that the upper limit number of VPNs has not been reached (step S114 in FIG. 6; No), router P and router D can be directly connected by VPN, or the VPN stored in step S112 in FIG. Is disconnected, it is assumed that the router P and the router D can be directly connected by VPN, and the generation of the VPN for connecting the router P and the router D is reserved (step S115 in FIG. 6), and the process proceeds to step S201 in FIG.

  Proceed to the description of FIG. The VPN topology calculation unit 14 determines whether there is a VPN reserved for generation in step S115 in FIG. 6 or in steps S308 and S309 in FIG. 8 described later (step S201 in FIG. 7). When there is a VPN reserved for generation (step S201 in FIG. 7; Yes), the VPN topology calculation unit 14 disconnects the VPN stored in step S112 in FIG. 6 and step S305 in FIG. In addition, the topology that forms the VPN reserved for generation in step S115 of FIG. 6 or FIG. 8 step S308 and FIG. 8 step S309, which will be described later, is calculated as a new topology. The route from the router P to the router D is calculated as a new data flow path (step S202 in FIG. 7). 6 waits until the data flow in all VPNs stored in step S112 in FIG. 6 and step S304 in FIG. 8 to be described later is completed (step S203 in FIG. 7), and the VPN topology calculation unit 14 controls the router setting unit 15. Then, the setting request information based on the calculation result is transmitted (step S205 in FIG. 7).

  On the other hand, when there is no VPN reserved for generation (step S201 in FIG. 7; No), no new VPN is generated, and the topology is not changed. Therefore, the VPN topology calculation unit 14 calculates the movement route of the router P and the route from the last router P to the router D as a new data flow path without calculating a new topology (step S204 in FIG. 7). ). Then, the VPN topology calculation unit 14 controls the router setting unit 15 to transmit setting request information based on the calculation result (step S205 in FIG. 7). As a result, the router 2 that has received the setting request information registers the data flow based on the setting request information, updates the routing table, and sets the transfer destination of the received data flow. Here, when the setting request information is transmitted in step S205 in FIG. 7 through the processing in step S204 in FIG. 7, the topology is not changed, and only the path calculation is performed. Is not formed.

  Next, the description proceeds to FIG. When it is determined in step S102 in FIG. 6 that there is no path composed only of VPNs for which the disconnection reservation flag is not set (step S102 in FIG. 6; No), the router P is connected in the determination in step S113 in FIG. If it is determined that the number of connected VPNs has reached the upper limit number of connectable VPNs (step S113 in FIG. 6; Yes), the number of VPNs to which the router D is connected is determined in step S114 in FIG. When it is determined that the upper limit number of connectable VPNs has been reached (step S114 in FIG. 6; Yes), the VPN topology calculation unit 14 sets the disconnection reservation flag among the VPNs connected to the router P. It is determined whether there is a non-existing VPN (step S301 in FIG. 8).

  If the VPN topology calculation unit 14 determines that there is a VPN for which no disconnection reservation flag is set (step S301 in FIG. 8; Yes), a VPN with a high evaluation value is selected from the VPNs for which no disconnection reservation flag is set. (Step S302 in FIG. 8). Here, in this embodiment, the evaluation value of the VPN is such that the longer the scheduled end time of the passing data flow is, the faster the passing data amount is increased, and the faster the communication speed is, the more the passing data flow is. The higher the number, the higher. The evaluation value does not have to be such a criterion, and may be calculated according to any criterion as long as one VPN can be selected. The router 2 connected to the router P by the VPN selected in this way is changed as the router P (step S303 in FIG. 8), and the process returns to step S101 in FIG. 6 to continue the processing.

  On the other hand, when the VPN topology calculation unit 14 determines that there is no VPN for which the disconnection reservation flag is not set (step S301 in FIG. 8; No), the generation request information is included in the VPNs connected to the router P. It is determined from the scheduled end time of each data flow indicated by the flow information whether there is a VPN in which all the data flows end within the waiting time of the new data flow shown (step S304 in FIG. 8). When it is determined that there is a VPN for which all data flows are completed (step S304 in FIG. 8; Yes), the VPN is stored (step S305 in FIG. 8).

  On the other hand, if it is determined that there is no VPN that terminates all data flows (step S304 in FIG. 8; No), it is determined whether the number of VPNs connected to the router P has reached the maximum number of VPNs that can be connected. (Step S306 in FIG. 8) and if it is determined that it has been reached (Step S306 in FIG. 8; Yes), recursive search is performed because it indicates that the router P and the router D cannot be connected by VPN. The recursive search is performed by returning the router P to the router 2 shown immediately before and selecting the VPN with the next highest evaluation value when selecting the VPN in step S302 in FIG.

  When it is determined that the VPN upper limit number has not been reached after the processing in step S305 in FIG. 8 or in step S306 in FIG. 8 (step S306 in FIG. 8; No), the number of VPNs to which the router D is connected is It is determined whether the maximum number of possible VPNs has been reached (step S307 in FIG. 8). If it is determined that it has not been reached (step S307 in FIG. 8; No), the router P and the router D can be directly connected by VPN, or if the VPN stored in step S305 in FIG. Can be directly connected by VPN, reservation is made for the creation of a VPN connecting router P and router D (step S308 in FIG. 8), and the process proceeds to step S201 in FIG.

  On the other hand, if it is determined in step S307 in FIG. 8 that the upper limit number of VPNs has been reached (step S307 in FIG. 8; Yes), the router P and the router D cannot be directly connected by VPN, and the evaluation value is high. A different router 2 is selected, and the creation of a VPN connecting the router 2 and the router P is reserved (step S309 in FIG. 8). Here, in this embodiment, the evaluation value of the router 2 becomes high when the router 2 is connected to the router D by the VPN for which the disconnection reservation flag is not set and the VPN upper limit number has not been reached. It is determined that the longer the scheduled end time of the data flow passing through the VPN connected to D is, the higher the communication speed is. Note that the evaluation value does not have to be such a criterion, and may be calculated according to any criterion as long as one router 2 can be selected. The router 2 selected in this way is changed as the router P (step S310 in FIG. 8), and the process returns to step S101 in FIG. 6 to continue the processing. The above is an example of a predetermined algorithm in the VPN topology calculation unit 14.

  Next, a specific example of a predetermined algorithm in the above-described VPN topology calculation unit 14 will be described with reference to FIGS. 1 to 6 in FIGS. 9 and 10 indicate the routers 2-R1, 2-R2,..., 2-R6. Router S is router 2-R1, and router D is router 2-R4. FIGS. 9A and 10A show the state before calculation in the VPN topology calculation unit 14, the straight line in the figure indicates VPN, and the time next to the straight line indicates the scheduled end time. . F indicates that a disconnection reservation flag is set.

  In FIG. 9A, a VPN is formed between the router 2-R1 and the routers 2-R2, 2-R5, and 2-R6, and the router 2-R3 and the router 2-R4. When the VPN topology control device 1 receives the generation request information for causing the router 2-R1 to generate a new data flow (waiting time 20 seconds) from the router 2-R4, the VPN topology calculation unit 14 receives a predetermined algorithm. Start calculating the topology and path at. First, the router P is defined as the router 2-R1. Since there is no path from the router 2-R1 to the router 2-R4, the determination in step S101 in FIG. The processing in step S111 in FIG. 6 is Yes because the data flow between the router 2-R1 and the router 2-R5 is completed within the waiting time.

  Then, as shown in FIG. 9B, the VPN between the router 2-R1 and the router 2-R5 is stored, and a disconnection reservation flag F is set. (FIG. 6, step S112). Since the upper limit number of VPN connections “3” of the router 2-R4 has not been reached, step S114 in FIG. 6 is No, and the router 2-R1 and the router 2-R4 are connected as end points (two-dot chain line in the figure). The VPN generation is reserved (step S115 in FIG. 6). Then, Step S201 of FIG. 7; Yes, and processing is performed with Step S202 of FIG. 7, Step S203 of FIG. 7, and Step S205 of FIG.

  Then, the information and data flow path for controlling the generation of the VPN in the router 2-R1 and the router 2-R4 by disconnecting the VPN of the router 2-R1 and the router 2-R5 are (1) the router 2-R1. (2) The setting request information including information on the router 2-R4 is output from the router setting unit 15.

  Next, the case of FIG. 10A will be described. When the VPN topology control device 1 receives the generation request information for causing the router 2-R1 to generate a new data flow (waiting time 20 seconds) from the router 2-R4, the VPN topology calculation unit 14 uses a predetermined algorithm. Start calculating topology and path.

  First, the router P is defined as the router 2-R1. Since there is a path from the router 2-R1 to the router 2-R4, the determination in step S101 in FIG. 6 is Yes. The determination in step S102 in FIG. 6 is No because the disconnection reservation flag is set in the VPN between the router 2-R2 and the router 2-R3. The determination in step S301 in FIG. 8 is Yes because there are two VPNs for which the disconnection reservation flag is not raised from the router 2-R1, which is the router P.

  Then, the VPN connected to the router 2-R2 having a long estimated end time is selected (step S302 in FIG. 8), and the router 2-R2 is set as the router P (step S303 in FIG. 8). Then, the process proceeds again with step S101 in FIG. 6; Yes, step S102 in FIG. 6; Of the VPNs connected to the router 2-R2, except for the router 2-R1 that has once become the router P, only the VPN between the router 2-R2 and the router 2-R3, and this VPN is disconnected. Since the reservation flag is set, the determination in step S301 in FIG. The VPN end scheduled time is 40 seconds, which is longer than the standby time of 20 seconds. Therefore, the determination in step S304 in FIG. 8 is No, the determination in FIG. 8 step S306; No, FIG. 8 step S307; Reserve the generation of a VPN that connects the router 2-R2 and the router 2-R4, which are P (two-dot chain line in the figure). Then, step S201 in FIG. 7; Yes, step S202 in FIG. 7, step S203 in FIG. 7 (there is no actual waiting because there is no stored VPN), and step S205 in FIG.

  Information for performing VPN control for the routers 2-R2 and 2-R4 and the data flow path are (1) router 2-R1, (2) router 2-R2, and (3) router 2-R4. The setting request information having the following information is output from the router setting unit 15. In this way, the router communication unit 21 of the router 2-R1 is set to transfer a new data flow to the router 2-R2, and the router communication unit 21 of the router 2-R2 transfers the new data flow to the router. 2-R4 is set to be transferred, and a VPN path of a new data flow is formed. The above is the description of the specific processing.

  As described above, even if a new data flow occurs, the VPN topology control device 1 causes the VPN topology calculation unit 14 to actively disconnect and extinguish the VPN for which the data flow has been completed. While the number of VPN connections is small, it is possible to calculate the data flow path and the topology that can form the path. This makes it possible to easily form a new data flow path and a topology capable of forming the path even if the VPN connection upper limit number of the router 2 is small. Accordingly, the topology formed by the VPN connecting the routers 2 can be automatically changed.

  As mentioned above, although embodiment of this invention was described, this invention can be implemented in various aspects as follows.

<Modification 1>
In the above-described embodiment, among the VPNs for which the disconnection reservation flag is set, the VPN whose data flow ends within the data flow waiting time and that is the router of the data flow path calculated by the VPN topology calculation unit 14 The VPN connected to is disconnected, but it is not limited to the disconnection at such timing. For example, for a VPN for which the data flow has been completed, the VPN may be disconnected after the data flow is completed, regardless of whether or not a new data flow has occurred.

  In this case, for example, the flow information is input to the router setting unit 15, and the router setting unit 15 refers to the flow information, the VPN database 12, and the flow database 13 to complete the data flow. After recognizing the existence of the VPN, setting request information indicating an instruction to disconnect the VPN may be transmitted to the router 2 connected by the VPN. In this manner, since the number of VPNs can be reduced in the VPN topology, the VPN topology control device 1 can change the topology more easily even when a new data flow occurs.

<Modification 2>
In the above-described embodiment, the disconnection reservation flag is set for the VPN under a specific condition. However, after the processing of the predetermined algorithm in the VPN topology calculation unit 14 is started, the data is within the waiting time for a new data flow. A disconnection reservation flag may be set for all VPNs whose flow ends, that is, whose scheduled end time is shorter than the waiting time. In such a case, not only the stored VPN but also all the VPNs for which the disconnection reservation flag is set may be disconnected in the process in step S203 of FIG.

  That is, the condition for setting the disconnection reservation flag may include other required conditions such as the algorithm in the embodiment as long as the scheduled end time is shorter than the waiting time. The timing for setting the disconnection reservation flag may be any time. Even if it does in this way, the effect similar to embodiment can be acquired.

<Modification 3>
In the embodiment described above, the generation request information is transmitted from the transmission terminal 3-A. However, the generation request information may be generated and transmitted by the transmission source router 2 to which the transmission terminal 3-A is connected. . In this case, the transmission source router 2 extracts the flow identifier of the data flow, the total data amount of the data flow, and the waiting time based on the data flow transmission request of the communication terminal 3-A, and generates the generation request information. It suffices to have means for generating Even if it does in this way, the effect similar to embodiment can be acquired.

<Modification 4>
In the above-described embodiment, when a path from the router S to the router D has already been formed, this is preferentially used. However, this path passes through a plurality of routers 2 and more than two. If the router S and the router D can be directly connected by VPN, the VPN topology calculation unit 14 may calculate this VPN as a path. Note that even if connection cannot be made immediately due to the limitation on the upper limit number of connections of the router 2, if connection is possible by disconnecting the VPN with the disconnection reservation flag set, the data flow is started. Since VPN can be cut off and extinguished, the path can be calculated. As described above, the predetermined algorithm in the VPN topology calculation unit 14 is not limited to the content described in the embodiment, but is determined based on the waiting time of a new data flow and the scheduled end time of the data flow of each VPN. Any algorithm may be used as long as it is calculated based on the VPN in which the disconnection reservation flag is set and the topology formed by each VPN.

<Modification 5>
In the above-described embodiment, the program executed by the CPU of the VPN topology control device 1 is a program stored in the ROM. However, a data input unit that can read data of various recording media is provided, and the program You may make it acquire from the various recording media memorize | stored, or acquire the said program by communicating with external apparatuses, such as a server, via the communication part 11, and you may make it acquire from the outside.

It is a block diagram which shows the connection of the VPN topology control apparatus and router which concern on embodiment. It is a block diagram which shows the structure of the VPN topology control apparatus which concerns on embodiment. It is explanatory drawing which shows an example of the content of the VPN database which concerns on embodiment, a flow database, and a flow cache. It is a block diagram which shows the structure of the router which concerns on embodiment. It is explanatory drawing which shows the flow of each information which concerns on embodiment. It is a flowchart of the algorithm in the VPN topology calculation part which concerns on embodiment. It is a flowchart of the algorithm in the VPN topology calculation part which concerns on embodiment. It is a flowchart of the algorithm in the VPN topology calculation part which concerns on embodiment. It is explanatory drawing which shows an example of the process in the VPN topology calculation part which concerns on embodiment. It is explanatory drawing which shows an example of the process in the VPN topology calculation part which concerns on embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... VPN topology control apparatus, 2, 2-R1, 2-R2, ..., 2-R6 ... Router, 2-S ... Transmission origin router, 2-D ... Reception destination router, 3 ... Communication terminal, 3-A ... transmitting terminal, 3-B ... receiving terminal, 11 ... communication unit, 12 ... VPN database, 13 ... flow database, 14 ... VPN topology calculation unit, 15 ... router setting unit, 16 ... database update unit, 17 ... VPN generation response unit, 21 ... router communication unit, 22 ... timer, 23 ... passage data detection unit, 24 ... flow cache, 25 ... VPN setting unit, 26 ... flow information generation unit

Claims (10)

A VPN topology control device for controlling a topology formed by VPNs constituting a data flow path between a plurality of routers,
Storage means for storing a VPN database indicating VPNs forming the topology;
Monitoring means for monitoring the data flow communication status in the VPN forming the topology;
Receiving means for receiving generation request information indicating a router indicating a transmission source and a reception destination of a data flow among the plurality of routers, and a waiting time until starting transmission of the data flow;
A determining unit that determines a VPN for which a data flow is terminated as a disconnection reserved VPN within a waiting time indicated by the generation request information received by the receiving unit based on a communication status monitored by the monitoring unit;
Based on the VPN indicated by the VPN database and the disconnection reservation VPN determined by the determination means, a path using the VPN between the two routers indicated by the generation request information received by the reception means and the path can be formed Calculating means for calculating the topology using a predetermined algorithm;
A VPN topology control apparatus, comprising: a setting unit configured to set a VPN for the plurality of routers so as to form a topology calculated by the calculation unit. The VPN topology control apparatus according to claim 1, further comprising a disconnecting unit that disconnects the VPN for which the data flow has been completed from the communication status monitored by the monitoring unit. The setting unit is configured to form the topology calculated by the calculation unit after a VPN that is not included in the topology calculated by the calculation unit is disconnected by the disconnection unit. The VPN topology control apparatus according to claim 2, wherein VPN setting is performed for the router. The setting unit performs VPN setting for the plurality of routers so that the topology calculated by the calculation unit is formed after all of the disconnection reservation VPNs are disconnected by the disconnection unit. The VPN topology control device according to claim 2. The generation request information received by the receiving means includes information indicating the total data amount of the data flow,
The determining means is based on the communication status monitored by the monitoring means and the total amount of data indicated by the generation request information received by the receiving means within the waiting time indicated by the generation request information received by the receiving means. The VPN topology control device according to any one of claims 1 to 4, wherein a VPN whose data flow ends is determined as a disconnection reservation VPN. The determination unit is a waiting time indicated by the generation request information received by the reception unit based on a communication status monitored by the monitoring unit among VPNs connected to each router on the path calculated by the calculation unit. The VPN topology control device according to any one of claims 1 to 5, wherein a VPN at which a data flow ends is determined as a disconnection reservation VPN. After the setting by the setting means is completed, the apparatus further comprises transmission means for transmitting generation response information indicating that a data flow path has been generated between the two routers to the generation request information transmission source. The VPN topology control device according to any one of claims 1 to 6, wherein A plurality of routers capable of forming a VPN between each;
A communication terminal connected to the router;
The VPN topology control device according to claim 7,
The generation request information received by the receiving means is transmitted from the communication terminal, the source router indicated by the generation request information indicates a router to which the communication terminal is connected,
The communication terminal transmits a data flow after receiving the generation response information transmitted from the transmission unit,
The plurality of routers are configured such that the data flow transmitted by the communication terminal is received by the communication router connected to the reception destination router indicated by the generation request information and the reception source router and the reception A VPN topology control system, wherein the path to the previous router is controlled to be the path calculated by the calculation means. A VPN topology control method for controlling a topology formed by a VPN constituting a data flow path between a plurality of routers,
Storing a VPN database indicating VPNs forming the topology; and
A monitoring process for monitoring a communication state of a data flow in the VPN forming the topology;
A reception process of receiving generation request information indicating a router indicating a data flow transmission source and a reception destination among the plurality of routers, and a waiting time until transmission of the data flow starts,
A determination process for determining a VPN whose data flow is terminated as a disconnection reservation VPN within a waiting time indicated by the generation request information received in the reception process based on a communication status monitored in the monitoring process;
Based on the VPN indicated by the VPN database and the disconnection reservation VPN determined in the determination process, a path using the VPN between the two routers indicated by the generation request information received in the reception process and the path can be formed A calculation process for calculating the topology using a predetermined algorithm;
A VPN topology control method comprising: a setting step of setting a VPN for the plurality of routers so as to form a topology calculated by the calculation step. A computer that controls the topology formed by the VPN that configures the path of data flow between multiple routers.
A storage function for storing a VPN database indicating VPNs forming the topology;
A monitoring function for monitoring the data flow communication status in the VPN forming the topology;
A reception function for receiving generation request information indicating a router indicating a transmission source and a reception destination of a data flow among the plurality of routers, and a waiting time until starting transmission of the data flow;
A determination function for determining a VPN whose data flow is terminated as a disconnection reservation VPN within a waiting time indicated by the generation request information received by the reception function based on a communication status monitored by the monitoring function;
Based on the VPN indicated by the VPN database and the disconnection reservation VPN determined by the determination function, a path using the VPN between the two routers indicated by the generation request information received by the reception function and the path can be formed A calculation function for calculating the topology using a predetermined algorithm;
A program for realizing a setting function for setting a VPN for the plurality of routers so as to form a topology calculated by the calculation function.

Images