JP5900943B2 - BAND CONTROL SYSTEM, BAND CONTROL DEVICE, AND BAND CONTROL RULE OPERATING METHOD USED FOR THE SAME - Google Patents

Description

  The present invention relates to a bandwidth control system, a bandwidth control device, and a bandwidth control rule operation method used therefor, and more particularly to a bandwidth control rule operation method in a bandwidth control device.

  Due to recent diversification of network utilization applications, there are users who use data transmission / reception applications using P2P (Peer to Peer) type networks and applications that transmit and receive large amounts of data at high speed, such as video transfer.

  In the above network, packet loss and transfer delay increase. An increase in packet loss and transfer delay also occurs in communication of an application with a relatively small amount of communication such as browsing an electronic mail or a static Web page, and the fairness and convenience of the user are impaired.

  Such a problem has already become apparent in some ISP (Internet Service Provider) networks, and measures such as bandwidth control have been taken.

  The communication of this application is not a conventional one-to-one communication, but increases the efficiency of data transfer by a many-to-one communication or tries to avoid bandwidth control by dynamically using multiple communication ports. Or For this reason, the application identification by the packet header and the bandwidth control by the bandwidth control rule that is set statically have little effect.

  For this problem, measures are taken to acquire and analyze the entire communication packet, identify the application by pattern matching, and perform dynamic bandwidth control for the application (for example, see Patent Documents 1 and 2). The effect is improved. For high-speed pattern matching of the entire packet including application data, a DPI (Deep Packet Inspection) technique can be used.

  In order to perform individual bandwidth control for individual applications executed by a large number of users, it is necessary to have a huge number of bandwidth control rules and apply bandwidth control to a large number of communication packets at high speed. . In this case, a measure can be considered in which CPUs (central processing units) capable of high-speed processing are arranged in parallel to distribute the traffic, but there is a capital investment in expensive devices in proportion to an increase in communication capacity. There is a limit.

  FIG. 9 is a block diagram showing a functional configuration example of a bandwidth control apparatus related to the present invention. In FIG. 9, a bandwidth control device 6 is a table that holds communication control units 61 and 62 that perform data transmission / reception with a communication interface, a rule control unit 64 that registers and deletes bandwidth control rules, and bandwidth control rules. The rule table 641 includes a bandwidth control unit 63 that performs bandwidth control according to bandwidth control rules.

  First, the operation of the bandwidth control device 6 related to the present invention will be described with reference to FIG. Here, two interfaces are installed, an interface that receives a packet is a communication control unit 61, and an interface that transmits a packet is a communication control unit 62.

  When receiving a communication packet through the communication interface, the communication control unit 61 sends the packet to the bandwidth control unit 63. When the bandwidth control unit 63 receives a communication packet from the communication control unit 61, the bandwidth control unit 63 performs bandwidth control with reference to the rule table 641 and sends the packet to the communication control unit 62.

  This bandwidth control will be specifically described. The bandwidth control unit 63 determines whether or not the communication packet satisfies the rule in order from the top in the rule table 641, and when there is a rule that satisfies the rule, Control is performed so that communication packets are output at a certain data rate or less.

  If there is no corresponding rule, the bandwidth control unit 63 sends the communication packet to the communication control unit 62 without performing bandwidth control. The communication control unit 62 transmits the packet received from the bandwidth control unit 63 to the communication interface.

  A rule addition process to the rule table 641 in the bandwidth control device 6 related to the present invention will be described with reference to FIG. FIG. 10 is a flowchart showing an addition process when one rule is added to the rule table 641 in the bandwidth control device 6 related to the present invention. Note that the process of adding a plurality of rules can be realized by repeatedly performing the process shown in FIG. 10 by the number of rules.

  When the rule control unit 64 receives a setting request for one rule (step S21 in FIG. 10), the rule control unit 64 refers to the rule table 641 to check whether there is a space for newly adding a rule (step S22 in FIG. 10).

  When there is no space, the rule control unit 64 ends the process without adding a new rule (step S23 in FIG. 10). When there is a vacancy, the rule control unit 64 adds the received rule to the rule table 641 (step S24 in FIG. 10).

  In addition to the rules added when the communication packet is received as described above, the rule table 641 can also set a fixed rule before receiving the communication packet. Further, the “setting request for one rule” in the above processing is performed based on the judgment of a person such as an operator or a maintenance person.

  When deleting a rule from the rule table 641, the rule control unit 64 refers to a rule existing in the rule table 641, and (1) a rule that does not receive a flow corresponding to the rule for a certain period of time (2 ) Select and delete a rule that satisfies the condition that a certain time has passed since registration. The above condition is an example, and there may be other conditions.

JP 2005-051811 A JP 2007-067586 A

  In the above-described network related to the present invention, setting change operations such as addition and deletion of bandwidth control rules in the bandwidth control device are performed based on the judgment of a person such as an operator or a maintenance person. For this reason, in the network related to the present invention, the first problem that it takes a long time (for example, several hours to several days) to implement the bandwidth control with the new bandwidth control rule setting due to human judgment is involved. is there.

  In the network related to the present invention, the number of bandwidth control rules in the bandwidth control device is finite. Therefore, in the network related to the present invention, in the situation where a lot of communication subject to bandwidth control occurs, if the bandwidth control rules are set as necessary, the upper limit of the number of rules of the bandwidth control device is reached, and more There is a second problem that it is not possible to set a rule, and bandwidth control cannot be performed for a bandwidth control target that newly appears in the situation.

  In the above method, when it is assumed that many bandwidth control rules are set, (1) a plurality of bandwidth control rules are aggregated, or (2) rules that are determined not to require bandwidth control are early. It is necessary to devise to reduce the number of rules by deleting.

  However, with the countermeasure according to (1), as a result of aggregation, bandwidth control may be performed on a flow that is not the target of bandwidth control. With the countermeasure of (2), there is an intention to escape from bandwidth control, and the rule There is a problem that knowing the time until deletion by some method cannot cope with a traffic pattern in which many communications are performed after the rule is deleted.

  Further, in the network related to the present invention, when the bandwidth control is applied to the communication packet by the bandwidth control device, the communication packet is inspected in order to satisfy the rules in the bandwidth control rule table. . Frequently applied bandwidth control rules are positioned higher in the rule table, so that the time until application of the bandwidth control rules is shortened and more efficient operation is expected.

  Therefore, in the state where the rules are arranged so that the rule with higher application frequency is positioned higher in the bandwidth control rule table, the time until the bandwidth control rule is applied is the shortest.

  In the bandwidth control apparatus related to the present invention, the order of the bandwidth control rules is changed by a setting change based on judgment of a person such as a maintenance person. In this case, there is a third problem that the period of operation in a state where the time until the application of the bandwidth control rule is not the shortest becomes long and efficient operation cannot be performed.

  Accordingly, an object of the present invention is to solve the above-described problems and to provide a bandwidth control system, a bandwidth control device, and a bandwidth control system capable of performing bandwidth control by arranging bandwidth control rules that are relatively frequently used in a bandwidth control rule table. Another object of the present invention is to provide a method for operating the bandwidth control rule used in the above.

A bandwidth control system according to the present invention includes a bandwidth control device that performs bandwidth control by arranging bandwidth control rules that are relatively frequently used in a bandwidth control rule table in which a finite number of bandwidth control rules are registered. Because
The bandwidth control apparatus includes a holding unit that holds a policy that is set in advance and serves as a condition for generating the bandwidth control rule, and an inspection unit that changes the setting of the bandwidth control rule based on the policy while adapting to a communication situation. And.

  The bandwidth control apparatus according to the present invention includes the above-described means.

A bandwidth control rule operation method according to the present invention includes a bandwidth control device that performs bandwidth control by placing relatively frequently used bandwidth control rules in a bandwidth control rule table in which a finite number of bandwidth control rules are registered. A bandwidth control system,
The bandwidth control device holds a policy that is set in advance and is a condition for generating a bandwidth control rule,
The bandwidth control device executes an inspection process for changing the setting of the bandwidth control rule based on the policy while adapting to a communication situation.

  With the configuration and operation as described above, the present invention provides an effect that bandwidth control can be performed by placing bandwidth control rules that are relatively frequently used in the bandwidth control rule table.

It is a block diagram which shows the structural example of the band control apparatus by the 1st Embodiment of this invention. It is a block diagram which shows the structural example of the network by the 1st Embodiment of this invention. It is a flowchart which shows the process step of the addition process by the 1st Embodiment of this invention. It is a figure which shows the concept of the rule replacement | exchange process in the operation rule table and standby rule table in the 1st Embodiment of this invention. It is a flowchart which shows the process step of the rule replacement | exchange process of the operation rule table and standby rule table in the 1st Embodiment of this invention. It is a block diagram which shows the structural example of the network by the 2nd Embodiment of this invention. It is a block diagram which shows the function structure of the band control apparatus (SH) by the 2nd Embodiment of this invention. It is a block diagram which shows the function structure of the rule creation apparatus (RC) by the 2nd Embodiment of this invention. It is a block diagram which shows the function structural example of the band control apparatus relevant to this invention. It is a flowchart which shows the addition process at the time of adding one rule to the rule table in the bandwidth control apparatus relevant to this invention.

  Next, embodiments of the present invention will be described with reference to the drawings. First, the outline of the bandwidth control system according to the present invention will be described. The present invention relates to a bandwidth control device that performs bandwidth control by placing bandwidth control rules that are relatively frequently used in a bandwidth control rule table in which a finite number of bandwidth control rules are registered, and a method for operating the bandwidth control rules. It is related to.

  In the bandwidth control system according to the present invention, a “policy” as a condition for generating a bandwidth control rule is set in advance, and the bandwidth control rule is automatically processed in a short time (for example, several times) while adapting to the communication situation. By changing the setting in minutes or tens of minutes, the first problem can be solved.

  In the bandwidth control system according to the present invention, two types of rules, “operation rules” and “standby rules”, are provided in the bandwidth control rules, and the bandwidth is controlled by applying the operation rules to the communication packets. Measure the importance of rules. In the bandwidth control system according to the present invention, when a rule needs to be further added with the maximum number of operation rules, the less important rule among the operation rules is moved to the standby rule, and a new operation rule is added. The above second problem can be solved by adding a rule and periodically replacing a rule having a low importance in the operation rules and a rule having a high importance in the standby rules.

  Furthermore, in the bandwidth control system according to the present invention, when applying the bandwidth control by automatically rearranging the operation rules in the order of importance in the operation rule table based on the importance of the operation rules measured from the communication status. In addition, the above third problem can be solved by inspecting and applying whether or not the rules in the bandwidth control rule table are satisfied for the communication packet in order from the highest importance.

  FIG. 1 is a block diagram showing a configuration example of a bandwidth control apparatus according to the first embodiment of the present invention. In FIG. 1, the bandwidth control device 1 includes communication control units 11 and 12 that perform data transmission and reception with a communication interface, an inspection unit 13 that analyzes the inside of a communication packet, and a rule control unit 14 that registers and deletes bandwidth control rules. And a bandwidth control unit 15 that performs bandwidth control according to bandwidth control rules. The inspection unit 13 includes a policy 131 that determines the bandwidth of each flow, and the rule control unit 14 includes an operation rule table 141 and a standby rule table 142 that are tables holding bandwidth control rules.

  Here, “flow” is information extracted from a communication packet and represents the characteristics of communication. For example, the source IP address obtained as a result of analyzing an IP (Internet Protocol) header is A. The packet group is “flow of source IP address A”, the packet group obtained by analyzing the TCP (Transmission Control Protocol) header and the source TCP port is N is “flow of source TCP port N”, TCP payload A packet group whose application type is P obtained as a result of the analysis is “application P flow”.

  In this embodiment, an operation rule table 141 and a standby rule table 142 are provided instead of the rule table 641 in the bandwidth control device 6 related to the present invention. Regarding other configurations, the configuration according to the present embodiment is the same as that of the band control device 6 related to the present invention.

  FIG. 2 is a block diagram showing a configuration example of a network according to the first embodiment of the present invention. In FIG. 2, the network according to the first embodiment of the present invention includes access networks 101 and 102 and a core network 100.

  The access network 101 includes an access router (AR) 2-1, the access network 102 includes an access router (AR) 2-2, and the core network 100 includes core routers (CR) 3-1 to 3-. 4 is provided.

  The access router (AR) 2-1 is connected to the core router (CR) 3-1, and a bandwidth control device (SH) 1-1 is inserted between them. The access router (AR) 2-2 is connected to the core router (CR) 3-4, and a bandwidth control device (SH) 1-2 is inserted between them.

  Although FIG. 2 shows a diagram in which the functions of the bandwidth control devices (SH) 1-1 and 1-2 are realized by a single device, it may be a function of the core router (CR). It may be a function of the access router (AR).

  The processing operation according to this embodiment will be described with reference to FIGS. In the present embodiment, rule addition processing to the rule table and rule deletion processing from the rule table in the bandwidth control operation related to the present invention described above are different. Further, in this embodiment, a rule replacement process between the operation rule table 141 and the standby rule table 142 is newly added to the bandwidth control operation related to the present invention.

  The operation rule table 141 is a table for registering bandwidth control rules (operation rules) to be referred to when performing bandwidth control on communication packets, and the standby rule table 142 is temporarily stored in the operation rule table 141. This is a table for registering a bandwidth control rule (standby rule) to be automatically saved.

  In the present embodiment, “importance” is set for each band control rule. The “importance” indicates the relative importance of all the rules in the operation rule table 141 and the standby rule table 142, and the number of received communication packets, the packet length, and the packet arrival interval. Etc. are determined comprehensively.

  In the present embodiment, as the “importance”, the “hit rate” obtained by converting the number of communication packets “hit number” conforming to the bandwidth control rule into the amount per unit time is used. The explanation will be made assuming that the “importance” is large.

  The “importance” is not limited to the hit rate. Besides, the packet length of the communication packet, “data amount” obtained by integrating the packet length, “data rate” calculated from the packet length and the packet arrival interval, Ratio of “data rate” to available bandwidth “bandwidth occupancy rate”, “bidirectionality” indicating the relevance of traffic in each direction in the case of bidirectional communication packets, “similarity” to other rules Sex "can also be used.

  When the communication control unit 11 receives a communication packet through the communication interface, the communication control unit 11 sends the packet to the inspection unit 13. The inspection unit 13 analyzes the inside of the packet, classifies it into flows, counts the number of packets in each flow, and collates with the policy 131.

  If the number of packets in each flow exceeds the upper limit value determined by the policy 131, the inspection unit 13 notifies the rule control unit 141 of information specifying the flow. At the same time, the communication packet is sent to the bandwidth control unit 15.

  The rule control unit 14 performs processing for creating a bandwidth control rule from information for specifying a flow and adding it to the operation rule table 141. Since this process is the same as the process of adding to the rule table 641 in the bandwidth control device 6 related to the present invention described above, the description thereof is omitted.

  When the bandwidth control unit 15 receives a communication packet from the inspection unit 13, the bandwidth control unit 15 refers to the operation rule table 141 to perform bandwidth control, and sends the packet to the communication control unit 12. This bandwidth control will be specifically described. The bandwidth control unit 15 determines whether or not the communication packet satisfies the rule in order from the top in the operation rule table 141, and when there is a rule that satisfies the corresponding flow, The communication packet is controlled to be output at a certain data rate or less.

  If there is no corresponding rule, the bandwidth control unit 15 sends the communication packet to the communication control unit 12 without performing bandwidth control. The communication control unit 12 transmits the received packet to the communication interface.

  FIG. 3 is a flowchart showing processing steps of additional processing according to the first embodiment of the present invention, and FIG. 4 is a rule replacement in the operation rule table 141 and standby rule table 142 according to the first embodiment of the present invention. It is a figure which shows the concept of a process. The rule addition processing to the rule table according to this embodiment will be described with reference to FIG. 1, FIG. 3, and FIG.

  When the rule control unit 14 receives the information specifying the flow from the inspection unit 13 and creates a bandwidth control rule (step S1 in FIG. 3), the rule control unit 14 refers to the operation rule table 141 to determine whether or not there is a free space for adding a new rule. Whether or not is checked (step S2 in FIG. 3).

  When there is no space, the rule control unit 14 moves one rule having the lowest hit rate in the operation rule table 141 to the standby rule table 142 (step S3 in FIG. 3), and then adds the rule to the operation rule table 141. It is added (step S4 in FIG. 3) (see FIG. 4). Further, the rule control unit 14 adds a rule to the operation rule table 141 when there is a vacancy (step S4 in FIG. 3).

  FIG. 5 is a flowchart showing the process steps of the rule replacement process of the operation rule table 141 and the standby rule table 142 according to the first embodiment of this invention. With reference to FIG. 1 and FIG. 5, the rule replacement processing of the operation rule table 141 and the standby rule table 142 in the present embodiment will be described.

  When the bandwidth control unit 15 receives a communication packet from the inspection unit 13, the bandwidth control unit 15 refers to the operation rule table 141 to perform bandwidth control, and sends the packet to the communication control unit 12. Further, the bandwidth control unit 15 adds the number of packets conforming to the rule to the number of hits, and divides by the measurement time (for example, 5 minutes) of the number of packets to obtain the hit rate. The bandwidth control unit 15 notifies the rule control unit 14 of the obtained hit rate and the like at regular intervals (for example, every 5 minutes).

  When receiving the hit rate (step S11 in FIG. 5), the rule control unit 14 changes the hit rate of the corresponding rule in the operation rule table 141 (step S12 in FIG. 5).

  Further, the bandwidth control unit 15 refers to the standby rule table 142, obtains the number of hits and the hit rate from the number of packets conforming to the rules in the standby rule table 142, and notifies the rule control unit 14 of the hit number and the hit rate. 14 may change the hit rate of the corresponding rule in the waiting rule table 142 when the hit rate is received.

  Next, the rule control unit 14 rearranges the rules in the operation rule table 141 in order of the hit rate (step S13 in FIG. 5).

  Subsequently, the rule control unit 14 moves R cases (R is a positive integer) having a low hit rate in the operation rule table 141 to the standby rule table 142 (step S14 in FIG. 5). R cases with a high hit rate are moved to the operation rule table 141 (step S15 in FIG. 5). The number R of rules that move at a time can be arbitrarily set within a range of values smaller than the maximum number of rules in the rule table. For example, the maximum number of rules that can be set in the operation rule table 141 is It can be about 1% of the value.

  Here, in the following cases, even if the hit rate is small, it is possible not to move to the waiting rule table.

  (1) The time after registration in the operation rule table 141 in the rule table addition processing of this embodiment is measured, and rules within a certain time are not moved to the standby rule table 142 even if the hit rate is small. May be. One reason for this is that a rule with a short elapsed time since registration does not reach a steady communication amount, and the hit rate may be calculated to be small.

  (2) The “fixed rule” in the processing operation related to the present invention described above may not move to the waiting rule table 142 even if the hit rate is small. One reason for this is that the “rule to be fixedly set” is a rule that is explicitly set by an operator or a maintenance person for the purpose of prohibiting the use of a specific application.

  (3) Those that match the conditions set in consideration of restrictions imposed on the network are determined to be always installed in the operation rule table 141 regardless of the hit rate, and moved to the standby rule table 142 even if the hit rate is small. You may make it not. The “conditions determined in consideration of restrictions imposed on the network” include, for example, a rule for a flow of a P2P application newly appearing in an in-company network of a company prohibited from being used in a P2P application.

  (4) Store not only the recent hit rate but also the weekly or monthly hit rate history, and determine the flow that has a large traffic volume on a specific day or time. However, it may not be moved to the waiting rule table 142. For example, a “data transfer rate fluctuation index” has been proposed as an index representing such a change in the traffic of a flow [for example, JP 2009-004899 A (Patent Document 3)], and this technique is used. be able to.

  In the above description, the hit rate is used as the importance, and the greater the hit rate, the greater the importance. However, other indexes of importance, for example, “data amount”, “data rate”, “bandwidth” Regarding “occupancy”, “bidirectional”, and “similarity”, (1) the greater the amount of data, the greater the importance, (2) the greater the data rate, the greater the importance, (3) the bandwidth occupancy The greater the importance, the greater the importance. (4) The greater the bidirectionality and the greater the importance of the rule for the communication flow in the opposite direction, the greater the importance. (5) The greater the similarity. The greater the importance of a certain rule is, the greater the importance is.

  Next, rule deletion processing from the rule table in this embodiment will be described. The rule control unit 14 refers to the rules existing in the standby rule table 142, and (1) a rule having a hit rate less than a certain value, (2) a flow corresponding to the rule is not received for a certain time. A rule that satisfies the condition of (3) a rule that has passed for a certain period of time after registration is selected and deleted. These conditions are examples and other conditions are possible.

  It should be noted that “rules to be fixedly set” in the processing operations related to the present invention described above and those that match conditions determined in consideration of restrictions imposed on the network can be prevented from being deleted. .

  As described above, this embodiment has various features such as an application for performing many-to-one communication and an application for dynamically reusing a plurality of communication ports in addition to the existing one-to-one communication application. In the bandwidth control rule table in which a finite number of bandwidth control rules are registered in the bandwidth control device that performs bandwidth control by identifying the application from the communication packet of the application, the bandwidth control rules that are relatively frequently used are arranged and the bandwidth Control can be performed.

  The processing from the reception of the communication packet to the execution of bandwidth control is completed in a short time (for example, several minutes or several tens of minutes) by automatic processing of the bandwidth control device.

  By automatically rearranging the rules in the bandwidth control rule table in the order based on the importance, it is possible to shorten the determination time from when the communication packet is received until the bandwidth control is executed.

  FIG. 6 is a block diagram showing a configuration example of a network according to the second embodiment of the present invention. In FIG. 6, in the second embodiment of the present invention, the bandwidth control function is realized by the rule creation devices (RC) 5-1 to 5-4 and the bandwidth control devices (SH) 4-1 and 4-2. This is applied to the configuration to be performed.

  In the present embodiment, rule creation devices (RC) 5-1 to 5-4 that perform traffic identification and rule creation, and bandwidth control devices (SH) 4-1, 4- that perform rule control and bandwidth control. 2 is installed separately. This network includes access networks 101 to 104 and a core network 100.

  An access router (AR) 2-1 is located in the access network 101, an access router (AR) 2-2 is located in the access network 102, and an access router (AR) 2-3 is located in the access network 103. Access routers (AR) 2-4 are arranged in 104, and core routers (CR) 3-1 to 3-4 are arranged in the core network 100.

  The access routers (AR) 2-1 and 2-3 are connected to the core router (CR) 3-1, respectively, and rule creation devices (RC) 5-1 and 5-3 are arranged on each route. The access routers (AR) 2-2 and 2-4 are connected to the core router (CR) 3-4, respectively, and rule creation devices (RC) 5-2 and 5-4 are arranged on each route.

  A bandwidth control device (SH) 4-1 is disposed between the core routers (CR) 3-1 and 3-2, and a bandwidth control device (SH) 4 is disposed between the core routers (CR) 3-4 and 3-3. -2 is arranged.

  The configuration example shown in FIG. 6 is merely an example, and the rule creation devices (RC) 5-1 to 5-4 and the bandwidth control devices (SH) 4-1 and 4-2 are connected to each other via a network. Any arrangement is acceptable.

  In the configuration example shown in FIG. 6, the functions of the bandwidth control devices (SH) 4-1 and 4-2 and the functions of the rule creation devices (RC) 5-1 to 5-4 are realized by a single device. However, it may be a function of the core routers (CR) 3-1 to 3-4 or a function of the access routers (AR) 2-1 to 2-4.

  FIG. 7 is a block diagram showing a functional configuration of a band control device (SH) according to the second embodiment of the present invention. In FIG. 7, the bandwidth control device (SH) 4 according to the present embodiment has the same configuration as that of the first embodiment of the present invention shown in FIG. Instead of the rule table 641 in the bandwidth control apparatus 6 related to the present invention, an operation rule table 141 and a standby rule table 142 are provided.

  FIG. 8 is a block diagram showing a functional configuration of a rule creation device (RC) according to the second embodiment of the present invention. In FIG. 8, a rule creation device (RC) 5 according to the present embodiment includes communication control units 51 and 52 and an inspection unit 53 that analyzes the inside of a packet. The inspection unit 53 is a policy that determines the bandwidth of each flow. 531. The inspection unit 53 performs the same operation as the above-described inspection unit 13 shown in FIG.

  In the second embodiment of the present invention, as compared with the above-described first embodiment of the present invention, the inspection controller 53 of the rule creation device (RC) to the rule control unit 14 of the bandwidth control device (SH) 4. When the rule of the bandwidth control device is added to the network, communication is performed via the communication control unit 52 of the rule creation device (RC) 5 and the communication control unit 11 of the bandwidth control device (SH) 4.

  The operation of the present embodiment will be described below with reference to FIGS.

  The rule addition processing to the rule table according to the present embodiment is that the bandwidth control device (SH) 4 receives information for specifying a flow from the rule creation device (RC) 5 via the network. This is different from the embodiment. Other processes are the same as the similar processes in the first embodiment of the present invention. Specifically, the following processing is performed (see the processing step diagram of FIG. 3 and the rule replacement conceptual diagram of FIG. 4).

  The rule control unit 14 specifies the flow from the inspection unit 53 of the rule creation device (RC) 5 via the communication control unit 52, the network, and the communication control unit 11 of the bandwidth control device (SH) 4 in this order. When information is received and a bandwidth control rule is created (step S1 in FIG. 3), it is checked whether or not there is a space for adding a new rule with reference to the operation rule table 141 (step S2 in FIG. 3).

  When there is no space, the rule control unit 14 moves one rule having the lowest hit rate in the operation rule table 141 to the standby rule table 142 (step S3 in FIG. 3), and then adds the rule to the operation rule table 141. It is added (step S4 in FIG. 3). When there is a vacancy, the rule control unit 14 adds a rule to the operation rule table 141 (step S4 in FIG. 3).

  In the present embodiment, the rule creation device (RC) 5 and the bandwidth control device (SH) 4 are separated, so that a rule can be added from a plurality of rule creation devices to one bandwidth control device. Become.

  The rule replacement process of the operation rule table 141 and the standby rule table 142 in the present embodiment is the same as the similar process in the first embodiment of the present invention.

  The rule deletion process from the rule table of the present embodiment is the same as the similar process in the first embodiment of the present invention.

  In the bandwidth control device, high-speed CPU processing is required to perform high-speed pattern matching for communication packets. On the other hand, in the rule creation device, the inspection of the communication packet to be performed can be performed by relatively low-speed CPU processing. In the present embodiment, if a plurality of rule creation devices are arranged in a distributed manner, the CPU load per device can be further reduced.

  In the present embodiment, the rule creation devices (RC) 5, 5-1 to 5-4 and the bandwidth control devices (SH) 4, 4-1, 4-2 are divided into rule creation devices (RC) 5, 5. A low-speed CPU is mounted on -1 to 5-4 to perform packet inspection and rule creation, and a high-speed CPU is mounted on the bandwidth control devices (SH) 4, 4-1 and 4-2 to perform high-speed pattern matching. By performing the bandwidth control process, the development cost can be reduced.

  A part or all of the above embodiment can be described as in the following supplementary notes, but is not limited to the following description.

[Appendix 1]
Bandwidth control rule operation method used in a bandwidth control system including a bandwidth control device that performs bandwidth control by arranging bandwidth control rules that are relatively frequently used in a bandwidth control rule table in which a finite number of bandwidth control rules are registered Because
The rule creation device holds a policy that is set in advance and is a condition for generating a bandwidth control rule,
A method of operating a bandwidth control rule, wherein the rule creation device executes an inspection process for changing a setting of the bandwidth control rule based on the policy while adapting to a communication situation.

[Appendix 2]
In the bandwidth control device, as the bandwidth control rule table, an operation rule table for registering the bandwidth control rule and a standby rule table for registering a bandwidth control rule that is temporarily saved from the operation rule table are provided,
The bandwidth control device performs bandwidth control by applying the bandwidth control rule registered in the operation rule table to the communication packet,
The bandwidth control device measures the importance of each bandwidth control rule, and when the bandwidth control rule needs to be further added in a state where the number of the operation rule tables is the maximum number, The operation method of the bandwidth control rule according to appendix 1, wherein a process of adding a new rule to the operation rule by moving the bandwidth control rule having a low importance to the standby rule table .

[Appendix 3]
The bandwidth control device periodically executes a process of replacing the bandwidth control rule having a low importance in the operation rule table and the bandwidth control rule having a high importance in the standby rule table. The operation method of the bandwidth control rule according to Supplementary Note 2, which is a feature.

[Appendix 4]
When applying the bandwidth control, the bandwidth control device automatically rearranges the bandwidth control rules in the order of importance in the operation rule table based on the importance measured from the communication status. The bandwidth control rule according to Supplementary Note 2 or Supplementary Note 3, wherein processing is performed in which whether or not the bandwidth control rule is satisfied with respect to the communication packet is checked and applied in descending order of importance. Operation method.

  The present invention can be used by being mounted on a network device that performs bandwidth control. Specifically, routers, firewalls, LAN (Local Area Network) switches, wireless LAN access points, load balancer devices, fixed telephone lines, line termination devices such as ADSL (Asymmetric Digital Subscriber Line) lines and optical fiber lines, mobile phones It can be used by being mounted on a radio base station apparatus of the terminal.

  And a network that includes these devices. ・ A network that provides Internet connection to general users via fixed telephone lines, mobile phone lines, ADSL lines, optical fiber lines, etc. ・ Installed in companies and schools A network that provides applications and Internet connections to users belonging to the network, and in addition to the above, a network that is assumed to be used for data transmission / reception applications such as P2P type networks and mass data transmission / reception applications such as video transfer Can be used on the network.

1,1-1,1-2
4,4-1,4-2 Bandwidth control device (SH)
2-1 to 2-4 Access router (AR)
3-1 to 3-4 Core router (CR)
5,5-1 to 5-4 Rule creation device (RC)
11, 12, 51, 52 Communication control unit
13,53 Inspection Department
14 Rule control part
15 Band control part
100 core network
101-104 access network
131,531 policy
141 Operation rule table
142 Waiting rule table

Claims (8)

In a bandwidth control rule table in which a finite number of bandwidth control rules are registered, a bandwidth control system including a bandwidth control device that performs bandwidth control by placing bandwidth control rules that are relatively frequently used,
The bandwidth control device includes a holding unit that holds a policy that is a flow condition that is set in advance and generates a bandwidth control rule, and an inspection that notifies information specifying the flow when the flow satisfies the policy condition Means,
The bandwidth control device includes, as the bandwidth control rule table, an operation rule table for registering the bandwidth control rule and a standby rule table for registering a bandwidth control rule that is temporarily saved from the operation rule table. Apply the bandwidth control rule registered in the operation rule table to implement bandwidth control,
The bandwidth control device is configured to generate the bandwidth control rule from the information specifying the notified flow and add the bandwidth control rule to an operation rule table; and measure the importance of each of the bandwidth control rules And when it is necessary to add the bandwidth control rule with the maximum number of operation rule tables, the bandwidth control rule with the lower importance is moved to the standby rule table in the operation rule table. And a means for adding a new rule to the operation rule table . In a bandwidth control rule table in which a finite number of bandwidth control rules are registered, a bandwidth control system including a bandwidth control device that performs bandwidth control by placing bandwidth control rules that are relatively frequently used,
A holding unit that holds a policy that is a preset flow condition for generating a bandwidth control rule, and an inspection unit that notifies the bandwidth control device of information specifying the flow when the flow satisfies the policy condition And a rule creation device including
The bandwidth control device includes, as the bandwidth control rule table, an operation rule table for registering the bandwidth control rule and a standby rule table for registering a bandwidth control rule that is temporarily saved from the operation rule table. Apply the bandwidth control rule registered in the operation rule table to implement bandwidth control,
The bandwidth control device is configured to generate the bandwidth control rule from the information specifying the notified flow and add the bandwidth control rule to an operation rule table; and measure the importance of each of the bandwidth control rules And when it is necessary to add the bandwidth control rule with the maximum number of operation rule tables, the bandwidth control rule with the lower importance is moved to the standby rule table in the operation rule table. And a means for adding a new rule to the operation rule table .   The bandwidth control apparatus includes means for periodically exchanging the bandwidth control rule having a low importance in the operation rule table and the bandwidth control rule having a high importance in the standby rule table. The band control system according to claim 1 or 2.   The band control device, when applying the band control, means for automatically rearranging the band control rules in the operation rule table in order of importance based on the importance measured from the communication status 4. The bandwidth according to claim 1, further comprising: a unit that inspects and applies whether or not the bandwidth control rule is satisfied with respect to the communication packet in order from the highest importance level. 5. Control system.   A bandwidth control apparatus comprising the means according to claim 1. In a bandwidth control rule table in which a finite number of bandwidth control rules are registered, bandwidth control rules executed by a bandwidth control system including a bandwidth control device that performs bandwidth control by placing relatively frequently used bandwidth control rules. An operation method ,
The bandwidth control device holds a policy that is a preset flow condition for generating a bandwidth control rule,
When the bandwidth control device satisfies the policy condition , the bandwidth control device executes an inspection process for notifying information identifying the flow ,
In the bandwidth control device, as the bandwidth control rule table, an operation rule table for registering the bandwidth control rule and a standby rule table for registering a bandwidth control rule that is temporarily saved from the operation rule table are provided,
The bandwidth control device performs bandwidth control by applying the bandwidth control rule registered in the operation rule table to the communication packet,
A process in which the bandwidth control device generates the bandwidth control rule from information specifying the notified flow and adds the bandwidth control rule to an operation rule table, and a process of measuring the importance of each of the bandwidth control rules And when it is necessary to add the bandwidth control rule with the maximum number of operation rule tables, the bandwidth control rule with the lower importance is moved to the standby rule table in the operation rule table. And a process for adding a new rule to the operation rule table .   The bandwidth control device periodically executes a process of replacing the bandwidth control rule having a low importance in the operation rule table and the bandwidth control rule having a high importance in the standby rule table. The bandwidth control rule operating method according to claim 6, wherein:   When applying the bandwidth control, the bandwidth control device automatically rearranges the bandwidth control rules in the order of importance in the operation rule table based on the importance measured from the communication status. The bandwidth control according to claim 6 or 7, wherein processing for checking and applying whether or not the bandwidth control rule is satisfied with respect to the communication packet in order from the highest importance is executed. Rule operation method.

Images