JP6076569B2 - Connection path management system, connection path management method, and connection path management program - Google Patents

Description

  The present invention relates to a connection path management system, a connection path management method, and a connection path management program.

  Conventionally, it is necessary to establish a flow in order to perform communication such as Openflow (registered trademark), and there is a system in which a flow control is performed by a controller in charge of a network system (for example, see Non-Patent Document 1). In recent years, this system has been used in an architecture called SDN (Software, Defined, Network).

  A flow is identified based on a flow identifier in a data frame received via an interface, and if the flow does not match a flow that should be received by the interface, it is determined that a data frame has been received by a non-default interface. There is a system (see, for example, Patent Document 1).

JP 2013-115695 A

“OpenFlow Switch Specification Version 1.0.0”, OPEN NETWORKING FOUNDATION, December 31, 2009

  In the conventional system, it is not possible to prevent separate flows from being set in the forward path and the return path for one connection between terminals. It is sufficient to set one bidirectional flow for one connection. When two bidirectional flows are set, network resources are consumed twice, resulting in waste. When two unidirectional flows are set, the management load increases.

  An object of the present invention is to reduce the consumption of network resources.

A connection path management system according to an aspect of the present invention includes:
A setting unit that sets a bidirectional connection path for transferring the packet group in association with the connection between the interfaces of the network in which the packet group including information for identifying the connection between the terminals is input and output;
A connection path between a first input interface that is an interface to which a first packet including information for identifying one connection is input and a first output interface that is an interface to which the first packet is output is the one path. A second packet that includes information for identifying the one connection and is transmitted in the opposite direction to the first packet after being set by the setting unit in association with a connection is an interface different from the first output interface. When input to a two-input interface, a connection path between the first input interface and the second input interface is set in association with the one connection, and another connection path corresponding to the one connection is set. And an aggregation unit to be deleted.

  In the present invention, when a situation occurs in which a plurality of connection paths are set for one connection between terminals, the plurality of connection paths are integrated into one. Therefore, according to the present invention, it is possible to reduce the consumption of network resources. The “connection path” is the same as the flow described above.

The figure which shows the example of a general network structure. FIG. 3 is a diagram illustrating a network configuration example for comparison with the first embodiment. FIG. 3 is a diagram illustrating a network configuration example for comparison with the first embodiment. FIG. 3 is a diagram illustrating a network configuration example for comparison with the first embodiment. 1 is a block diagram showing a configuration of a connection path management system according to Embodiment 1. FIG. 5 is a flowchart showing the operation of the connection path management system according to the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. FIG. 6 shows a network configuration example according to a modification of the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. FIG. 3 is a diagram showing a network configuration example according to the first embodiment. The figure which shows the hardware structural example of the network control apparatus which concerns on embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, the same code | symbol is attached | subjected to the part which is the same or it corresponds in each figure. In the description of the embodiments, the description of the same or corresponding parts will be omitted or simplified as appropriate.

Embodiment 1 FIG.
In this embodiment, there is a possibility that a network system capable of establishing a connection path based on detailed connection packet identification information and a plurality of redundant devices are operating, and the communication path of the connection is different between the forward path and the return path This relates to connection path control when a certain network system is connected by a plurality of redundant interfaces and devices. “Same route” or “same route” means that packets are transmitted and received through the same node or device regardless of the communication direction. “Different paths” or “different paths” are the opposite of “same paths” or “same paths”.

  First, a phenomenon in which a forward path and a return path pass through different paths in a redundant network will be described. A network configuration in which the phenomenon occurs will be described with reference to FIG. The example of FIG. 1 is a general example.

  Router-A, Router-B, Router-E, and Router-F are routers. Switch-C, Switch-D, Switch-G, and Switch-H are layer 2 switches. Subnet-Z is an IP (Internet Protocol) subnet.

  IP-1 is a Router-E interface connected to Switch-C. IP-2 is a Router-F interface connected to Switch-D. IP-3 is a Router-E interface connected to Switch-D. IP-4 is a Router-F interface connected to Switch-C. An “interface” is a port through which a packet is input / output.

  Path-1 is a path through which the packet passes through Router-B, Switch-C, Router-E, and Switch-G in order to reach Subnet-Z. Path-2 is a route in which a packet is transmitted from Subnet-Z and sequentially passes through Switch-H, Router-F, Switch-C, and Router-B.

  Here, Router-A and Router-B are in a redundant relationship with each other while operating normally. In other words, the packet transfer load is shared during a period in which both are operating normally, and if one of them breaks down, the person operating the transfer of the packet that passes through it is undertaken. Switch-C and Switch-D, Router-E and Router-F, Switch-G and Switch-H have the same relationship.

In IP, by applying dynamic routing that automatically searches for the next destination, it is possible to automatically recognize a failure in a route and not select a destination having a failure. In that case, a plurality of destinations can be arranged side by side in a normal state. By deliberately setting a “cost value”, a plurality of destinations can be differentiated so that the highest priority is always selected. However, in the case of an equivalent redundant configuration as shown in FIG. 1, the load is distributed in the normal state without making a difference in cost value. In that case, in Router-A and Router-B as an example, four equal destinations are registered as IP route entries to Subnet-Z as follows.
(Destination 1) Subnet-Z NextHop: IP-1
(Destination 2) Subnet-Z NextHop: IP-2
(Destination 3) Subnet-Z NextHop: IP-3
(Destination 4) Subnet-Z NextHop: IP-4

  Router-A and Router-B normally transfer packets so that the packets are equally distributed to the four destinations according to an algorithm uniquely implemented by the vendor. Normally, the destination is calculated based on connection identification information for specifying an IP connection such as a transmission / reception IP address, a protocol, and a TCP (Transmission / Control / Protocol) port number. By doing so, the destination is not divided in units of packets, but in units of connections, and the order of packets of the same connection is not changed here. However, the IP router is not aware of the connection when transferring. The IP router only forwards packets input from any interface according to the routing table. Therefore, the IP router does not recognize a bidirectional packet of one connection and does not forward the packet so as to pass through the same interface. Even if there is such a situation when there are multiple forwarding destinations, it is only a coincidence. Therefore, for example, when the response of the packet that has passed Path-2 as the forward path has been transferred to Router-B, Router-B selects IP-4 as the destination and passes Router-F in the reverse direction. I am not conscious of that. Router-B only determines the destination by calculating so that the packets are equally distributed to the four destinations (destination 1) to (destination 4). In FIG. 1, IP-1 is selected. The response will eventually pass through Router-E along Path-1. In other words, the route is different between the forward route and the backward route. Furthermore, in the example shown here, the return packet arrives at Router-B, but this is a coincidence.

  Next, a network having a redundant configuration as described above, and a network system configured by a network device that sets connection paths for packet transfer and a control device that controls those connection paths, includes a plurality of redundant A configuration connected by an interface will be described. An example of the configuration will be described with reference to FIG. The example of FIG. 2 is an example for comparison with the present embodiment.

  Router-1 and Router-2 are routers. SDN-SW1, SDN-SW2, SDN-SW3, and SDN-SW4 are SDN switches. Term-0, Term-1, Term-2, and Term-3 are terminals. The terminal is not limited to a client computer but may be a server machine. Term-0 also indicates an interface of Term-0 that is a terminal connected to the network 121. Term-2-1 is a Term-2 interface connected to SDN-SW3. Term-2-2 is a Term-2 interface connected to SDN-SW4. Term-3 also shows a bundle of interfaces of Term-3 that is a terminal connected to SDN-SW4.

  Here, the network 110 composed of SDN switches, which are devices for which connection paths are set, is referred to as SDN. A network 121 such as a LAN (Local Area Network) or a WAN (Wide Area Network), and the router or the layer 2 switch shown in FIG. The other network 120 to be used is referred to as an existing network. A network control device 150, which is an SDN controller, is connected to the SDN.

  A plurality of interfaces connecting the existing network and the SDN are in a redundant relationship. When the packet is input to the router and when the packet is transferred from the router to the SDN, the packet is distributed evenly. Accordingly, the forward path and the return path are different paths, and an event may occur in which an interface through which a packet input from the existing network to the SDN and a packet output from the SDN to the existing network pass are different. The opposite side of the SDN existing network is connected to the terminal. There is a terminal on the other side of the existing network opposite to the SDN. In FIG. 2, as a terminal, Term-0 and Term-1 having one interface, Term-2 having two interfaces of equal redundancy, and link aggregation that makes a plurality of links appear as one link are applied. Term-3 is shown. Here, in both peer redundancy and link aggregation, a round trip packet of one connection does not always pass through the same interface.

  As described above, when there is an existing network or terminal connected to the SDN through two or more interfaces, a situation may occur where the round trip is different. The Term-1 connection may also be a different path that passes through a different interface on the existing network side.

Consider the following four types of communication requests.
(Type 1) Communication request from Term-0 to Term-1 (Type 2) Communication request from Term-1 to Term-0 (Type 3) Communication request from Term-0 to Term-2 (Type 4) Term -2 to Term-0 communication request

  Term-2 and Term-3 are in the same position in the sense that they are connected to the SDN through a plurality of equal interfaces, so the classification is the same. Even if there is a connection similar to Term-2 or Term-3 instead of the existing network, as a result, it is a network or a terminal connected by an equivalently positioned interface, so the positioning is the same. For each of the above four types, let us look at the situation where the round trip is a different route.

  Here, it is assumed that routers such as Router-1 and Router-2 and terminals such as Term-2 and Term-3 perform an operation of outputting packets having the same transmission destination from the same interface. This operation is generally performed to maintain the order of the packets.

  In (Type 1), a request packet is transmitted from Term-0 to Term-1. If the SDN constructs a bidirectional connection path, the response packet from Term-1 hits the reverse connection path and is transferred to the existing network side without any problem. Therefore, the problem of the different path is solved by a basic operation of establishing a bidirectional connection when a communication request comes.

  In (Type 2), a request packet is transmitted from Term-1 to Term-0. Since the response packet from Term-0 is transferred by the router immediately before the SDN, it can take a different path. As shown in FIG. 3, after CP-1 is established, CP-2 may be established. In this case, the request packet passes through Path-1. The response packet passes through Path-2.

  In the example of FIG. 3, CP-1 is a connection path between SDN-SW3 and SDN-SW2. CP-2 is a connection path between SDN-SW1 and SDN-SW3. Path-1 is a path in which a packet is transmitted from Term-1, and reaches Term-0 through CP-1, Router-2, and network 121 in order. Path-2 is a path through which a packet is transmitted from Term-0 and reaches Term-1 through the network 121, Router-2, and CP-2.

  In (Type 3), when a request packet is transmitted from Term-0 to Term-2, a response packet from Term-2 passes through Term-2-2 even if it passes through Term-2-1. Or vice versa. On the existing network side, if the interface is the same on the Term-2 side, no problem occurs for the same reason as in (Type 1). However, if the interface is different in Term-2, the packet may pass through a different interface on the existing network side. As shown in FIG. 4, two connection paths, CP-1 and CP-2, are constructed, and neither of the two ends of these two connection paths may be the same. In this case, the request packet passes through Path-2. The response packet passes through Path-1.

  In the example of FIG. 4, CP-1 is a connection path between SDN-SW4 and SDN-SW2. CP-2 is a connection path between SDN-SW1 and SDN-SW3. Path-1 is a path in which a packet is transmitted from Term-2-2 and reaches CP-0, Router-2, and network 121 in this order. Path-2 is a path in which a packet is transmitted from Term-0 and reaches Term2-1 through the network 121, Router-2, and CP-2.

  In (Type 4), a request packet is transmitted from Term-2 to Term-0. The response packet from Term-0 can take a different path for the same reason as in (Type 2). When a response packet is input from an existing network to a different interface, whether the response packet passes through Term-2-1 or Term-2-2 in connection with Term-2 depends on the connection of network controller 150. It depends on path control.

  In the basic implementation of SDN, separate connection paths are established for the forward path and the return path in the SDN by making the forward path and the return path different. The management of the network control apparatus 150 will also handle two connection paths.

  When a packet is input to an interface, the SDN switch determines whether the packet is a packet corresponding to a connection path set in the same interface. If the packet is a new packet that does not correspond to the set connection path, the SDN switch sends a new connection request to the network control device 150. The network control device 150 sets a new connection path in response to the new connection request. As a countermeasure to the problem of the different route, an operation in which the network control device 150 leaves a connection path newly constructed when the different route becomes clear and deletes the old connection path can be considered.

  In (Type 2), one interface of both ends of the connection path is common. For this reason, a new connection request is generated only by those who are not common. Therefore, once the network control device 150 takes a measure of leaving a new connection path and deleting others, no new connection request is generated thereafter unless there is a change in other conditions.

  However, (type 3) has the following problems.

  As shown in FIG. 4, the interface may be different at both ends of the connection path. That is, CP-2 is first constructed as a connection path for outgoing Path-2. Thereafter, CP-1 is constructed as a connection path for Path-1 on the return path. In the above operation, CP-2 is deleted. However, the existing network tries to maintain Path-2. Therefore, if a packet is transmitted from Term-0, the input to SDN is SDN-SW1. If CP-2 is constructed again, CP-1 is deleted in the above operation. After that, until the state of SDN changes and a connection path connected to Term-2-2 is constructed instead of CP-2 connected to Term-2-1, CP-2 and CP-1 The construction and deletion process is repeated. This makes communication difficult depending on the load state of the network control device 150.

  (Type 4) has the same problem as (Type 3).

  Therefore, in the present embodiment, (a) in the same tenant, (b) when a plurality of connection paths satisfying the condition of being the same connection determined by the highest identifiable layer are detected, A new connection path is constructed between the interfaces to which the packets that cause the connection path are input, and the old connection path is deleted.

  The “same tenant” is a network in the same service unit. In SDN, a network that is logically independent can be configured by network virtualization regardless of the physical configuration. Overlapping IP addresses are allowed between independent networks. It is also possible to construct a plurality of VLANs (Virtual / Local / Area / Network) within each independent network. Therefore, the condition (a) indicates that the condition (b) needs to be established in one logically independent network.

  “The same connection determined by the highest layer that can be identified” refers to a connection in which the pair of transmission / reception IP address and transmission / reception port number matches in the case of TCP / IP. In the connection path entry table of the network control apparatus 150 that is an SDN controller, information indicating the direction of a packet that causes each connection path to be constructed and an input interface are described in predetermined fields. As information indicating the direction of the packet, a transmission / reception IP address can be used.

  Hereinafter, the configuration of the system according to the present embodiment, the operation of the system according to the present embodiment, and the effects of the present embodiment will be described in order.

*** Explanation of configuration ***
With reference to FIG. 5, the configuration of a connection path management system 100, which is a system according to the present embodiment, will be described.

  The connection path management system 100 includes a network 110, a setting unit 151, and an aggregation unit 152. In the present embodiment, the setting unit 151 and the aggregating unit 152 are included in the network control device 150, but the setting unit 151 and the aggregating unit 152 may be divided into separate devices as in a modified example described later.

  The network 110 includes an interface group in which a packet group including information for identifying a connection between terminals is input from the outside of the network 110 or output to the outside of the network 110. Specifically, the “information for identifying a connection” is the connection identification information for specifying the above-described IP connection. Other networks 120 and 130 are connected to the network 110. Each terminal is connected to one of the other networks 120 and 130. In this embodiment, SDN is used as the method of the network 110, but any method may be used as long as it sets a connection path or flow.

  The setting unit 151 associates a bidirectional connection path for transferring the packet group between the interfaces of the network 110 to / from which the packet group including information for identifying the connection between the terminals is input / output. Set. Here, it is assumed that a first packet including information for identifying one connection C 1 is input to one interface of the network 110. In this case, the setting unit 151 associates a connection path between the first input interface, which is an interface to which the first packet is input, and the first output interface, which is an interface to which the first packet is output, with the connection C1. To set.

  The aggregating unit 152 includes information for identifying the connection C1 after the connection path between the first input interface and the first output interface is set by the setting unit 151 in association with the connection C1, and is reverse to the first packet. When the second packet transmitted to the second input interface is input to the second input interface, which is an interface different from the first output interface, the connection path between the first input interface and the second input interface is set in association with the connection C1. To do. The aggregating unit 152 deletes another connection path corresponding to the connection C1. Thereby, the aggregating unit 152 has a problem that the forward path in which the first packet is transmitted through the connection C1 and the return path in which the second packet is transmitted are different paths or a different path has occurred. Can deal with the problem. In the present embodiment, the aggregation unit 152 detects the occurrence of a problem at the timing when the second packet is input to the second input interface. Therefore, the aggregation unit 152 can deal with the problem in advance. “Preliminary” means before setting a connection path that causes a different route. “Corresponding to the problem” means that the connection paths are combined into one so as not to waste resources. As will be described later, the aggregating unit 152 may operate at an arbitrary timing instead of operating at the timing when the second packet is input to the second input interface to deal with the problem later. “Post fact” means after setting a connection path that causes a different route.

  In the present embodiment, the aggregating unit 152 causes the setting unit 151 to set and delete the connection path, but the aggregating unit 152 may set and delete the connection path by itself. In any case, the aggregation unit 152 substantially sets and deletes the connection path.

  In the present embodiment, a packet that requests establishment of the connection C1 corresponds to the first packet, and a packet that responds to the first packet corresponds to the second packet. Specifically, the TCP-SYN packet corresponds to the first packet, and the TCP-SYN-ACK packet corresponds to the second packet. The “TCP-SYN packet” is a packet in which the SYN flag of the TCP header is “1” and the ACK flag is “0”. The “TCP-SYN-ACK packet” is a packet in which both the SYN flag and the ACK flag of the TCP header are “1”.

  The aggregating unit 152 includes an interface that is different from the interfaces IF-A and IF-B at both ends of the connection path in which a packet that includes information for identifying the connection C1 and satisfies the setting condition D1 is associated with the connection C1 and is already set by the setting unit 151 Each time an input is made to IF-X, a connection path between the interface IF-X and one of the interfaces IF-A and IF-B is set in association with the connection C1, and the other corresponding to the connection C1. The connection path may be deleted. Thereby, the aggregating unit 152 can deal with the problem every time the problem occurs that the forward path and the backward path become different paths in the connection C1. Specifically, the aggregating unit 152 establishes the connection C1, which is a TCP connection, as well as the problem that the transmission path of the TCP-SYN packet and the transmission path of the TCP-SYN-ACK packet are different in the connection C1. It is also possible to deal with the problem that the forward path and the return path become different paths later.

  The setting condition D1 may be a condition that is always true. That is, all of the packets including information for identifying the connection C1 may correspond to packets that satisfy the setting condition D1.

  From the viewpoint of improving processing efficiency and enhancing security, packets input to the interface IF-X within a certain period of time after a change in the state of the other networks 120 and 130 connected to the network 110 is detected are set. It is desirable that the packet satisfies the condition D1.

  The change of the routing table in the other networks 120 and 130 corresponds to the state change. The link failure or recovery in the other networks 120 and 130 also corresponds to the state change.

  As a modification of the present embodiment, when the aggregating unit 152 operates at an arbitrary timing, the setting unit 151 includes a packet including information for identifying the connection C1 at both ends of the connection path that has already been set in association with the connection C1. Each time an input is made to an interface IF-X different from the interfaces IF-A and IF-B, a connection path between the interface IF-X and another interface of the network 110 is additionally set in association with the connection C1. The aggregation unit 152 determines whether a plurality of connection paths are set by the setting unit 151 in association with the connection C1. When determining that the plurality of connection paths are set by the setting unit 151 in association with the connection C1, the aggregation unit 152 sets the connection path between the first input interface and the second input interface in association with the connection C1. To do. The aggregating unit 152 deletes another connection path corresponding to the connection C1. As described above, the first input interface is an interface to which the first packet is input. The second input interface is an interface to which the second packet is input. In this modification, a packet that causes the latest connection path to be set by the setting unit 151 among the plurality of connection paths corresponds to the second packet. Of the packets that are transmitted in the opposite direction to the second packet and cause any one of the plurality of connection paths to be set by the setting unit 151, the last input packet corresponds to the first packet. Therefore, the packet that requests establishment of the connection C1 does not necessarily correspond to the first packet, and the packet that responds to the first packet does not necessarily correspond to the second packet.

*** Explanation of operation ***
The operation of the connection path management system 100 will be described with reference to FIG. The operation of the connection path management system 100 corresponds to the connection path management method according to the present embodiment. The operation of the connection path management system 100 corresponds to the processing procedure of the connection path management program according to the present embodiment.

  In S 11, a packet including information for identifying one connection C 1 is input to one interface of the network 110 from the outside of the network 110.

  In S12, it is determined whether or not the setting unit 151 has already set a connection path corresponding to the connection C1 identified by the information included in the packet input in S11. If not set, the flow proceeds to S13. If already set, the flow proceeds to S17. In the present embodiment, the device of the network 110 having the interface to which the packet is input in S11 performs the process of S12. However, the setting unit 151 or the aggregation unit 152 may perform the process of S12.

  In S13, the aggregation unit 152 determines whether or not the packet input in S11 is a packet requesting establishment of the connection C1. If it is not a packet requesting establishment of the connection C1, the flow proceeds to S14. If the packet requests establishment of the connection C1, the flow proceeds to S15. Note that a device of the network 110 having an interface to which a packet is input in the setting unit 151 or S11 may perform the process of S13.

  In S <b> 14, the aggregation unit 152 determines whether or not the setting unit 151 has already set a connection path corresponding to the connection C <b> 1 identified by the information included in the packet input in S <b> 11. If not set, the flow proceeds to S15. If set, the flow proceeds to S16.

  In S15, the setting unit 151 identifies the bidirectional connection path between the interface in which the packet is input in S11 and another interface of the network 110 by the information included in the packet input in S11. Set as a connection path corresponding to the connection C1. Which interface is the other interface in the interface group of the network 110 is mainly determined from the transmission destination of the packet input in S11.

  In S <b> 16, the aggregating unit 152 includes an interface in which a packet that causes the setting unit 151 to set a set connection path corresponding to the connection C <b> 1 from the interface group of the network 110 is input from the outside of the network 110. In step S11, a bidirectional connection path between the interface to which the packet is input from the outside of the network 110 is set as a connection path corresponding to the connection C1 identified by the information included in the packet input in step S11. Then, the aggregation unit 152 deletes another connection path corresponding to the connection C1. As a result, the connection paths are consolidated into one. Note that a packet transmitted in the same direction as the packet that causes the setting unit 151 to set a connection path that has already been set corresponding to the connection C1 due to a state change of the other networks 120 and 130 occurs in S11. May be entered. In that case, the aggregation unit 152 simply deletes the set connection path, and causes the setting unit 151 to perform the process of S15. Therefore, the setting unit 151 sets a bidirectional connection path between the interface into which the packet is input in S11 and another interface of the network 110 as a connection path corresponding to the connection C1.

  In S17, the packet input in S11 is transferred inside the network 110 along the connection path corresponding to the connection C1 identified by the information included in the packet. The packet is output to the outside of the network 110 from the interface on the opposite side of the packet to which the packet is input in S11 among the interfaces at both ends of the connection path. Then, the flow ends.

  With reference to FIG. 7, a network configuration example according to the present embodiment corresponding to the example of FIG. 2 will be described.

  Router-1 and Router-2 are the same routers as in the example of FIG. Router-3 and Router-4 are also routers. SDN-SW1, SDN-SW2, SDN-SW3, and SDN-SW4 are the same SDN switches as in the example of FIG. Term-0 and Term-1 are terminals. Term-0 also indicates an interface of Term-0 that is a terminal connected to the network 121. Term-1 also indicates an interface of Term-1 that is a terminal connected to the network 131.

  Here again, the network 110 composed of SDN switches is referred to as SDN. The network 121 and another network 120 connected to or included in the network 121 and including routers, layer 2 switches, and the like are referred to as existing networks. The network 131 similar to the network 121 and other networks 130 connected to the network 131 or configured by routers, layer 2 switches, and the like included in the network 131 are also referred to as existing networks. A network control device 150 that performs the operation shown in FIG. 6 is connected to the SDN.

  The network control device 150 includes a setting unit 151 and an aggregation unit 152. The setting unit 151 functions as an SDN controller or a part thereof. The aggregation unit 152 implements a connection path reconstruction and connection path aggregation function as one or a plurality of software processes. In general, APIs (Applications, Programming, Interfaces) for adding functions are disclosed for vendors or open source SDN controllers that provide basic functions. It is conceivable to add the function of the aggregation unit 152 using such an API.

  Here, a modification of the present embodiment is shown in FIG.

  When the network control device 150 is a vendor product and is provided as an appliance, the management device 160 including the aggregation unit 152 is separately installed in an environment where the network control device 150 can access the API. In this modification, the management device 160 is a PC (Personal Computer). When the API is provided in a format based on TCP / IP communication such as HTTP (HyperText, Transfer, Protocol) or the like, it is not necessary to be aware of the physical positional relationship when creating software. Therefore, the realization function is the same in both configurations of FIG. 7 and FIG.

  An example of the operation of the connection path management system 100 when a communication request is transmitted from Term-1 to Term-0 with the configuration shown in FIG. 7 will be described with reference to FIGS.

  In the configuration shown in FIG. 7, the interfaces of Router-3 and Router-4 connected to the SDN are a plurality of interfaces of terminals such as Term-2-1 and Term-2-2 in the example of FIG. It can be taken as equivalent.

First, as shown in FIG. 9, the following processing is performed.
(Process 1-1) When the request packet that is the first packet of the connection transmitted by Term-1 reaches the SDN, the request packet is input to IF-4-2 that is the interface of SDN-SW4. Note that SDN-SW 4 and IF-4-2 were selected because of the distribution of routers in the existing network. SDN is not involved in the selection. The request packet may be input to the SDN-SW 3.
(Processing 1-2) The SDN-SW 4 determines whether or not the connection identification information of the request packet corresponds to a connection path that has already been set in the SDN-SW 4. If there is a corresponding connection path, the SDN-SW 4 transfers the request packet according to the connection path. If there is no corresponding connection path, the SDN-SW 4 transmits a connection request 201 including a request packet to the network control device 150.
(Processing 1-3) In the network control device 150, when the setting unit 151 receives the connection request 201, the setting unit 151 makes an inquiry to the aggregation unit 152. The aggregating unit 152 searches for the connection path corresponding to the connection identification information of the request packet included in the received connection request 201 from the existing connection paths according to the conditions (a) and (b) described above. There is no match here. Therefore, the aggregation unit 152 notifies the setting unit 151 to proceed with the subsequent processing as usual. The search here may be performed by the basic function of the setting unit 151 via the API depending on the implementation, and the aggregation unit 152 may receive the result.

Subsequently, as shown in FIG. 10, the following processing is performed.
(Processing 1-4) In the network control device 150, the setting unit 151 performs basic processing as an SDN controller. First, the setting unit 151 calculates a connection path. As a result, the output destination is determined to be IF-1-2 which is the interface of SDN-SW1. The request packet included in the connection request 201 is transferred as a transfer packet 202 to the SDN-SW 1 serving as an exit from the SDN. On the other hand, each SDN switch on the route is instructed to set a connection path by a connection path setting instruction 203. The SDN-SW 1 outputs the request packet received from the network control device 150 from the output destination IF-1-2.
(Process 1-5) The request packet is received by Term-0 through Path-1. Path-1 is a route that passes through SDN-SW1 and Router-2.

  As a result of (Processing 1-4), CP-1 is constructed as shown in FIG. This enables communication from Term-0 to Term-1 that passes through the SDN. Communication in the reverse direction is also possible on the same route. The connection path is bi-directional and is constructed between interfaces that serve as gateways for SDN. CP-1 is set between IF-4-2 and IF-1-2.

Next, as shown in FIG. 12, the following processing is performed.
(Process 2-1) A response packet, which is the first packet of the connection returned by Term-0, is transmitted from Term-0. The response packet is input to the SDN through Path-2. Path-2 is a route that passes through Router-2 and SDN-SW2. The response packet is input to IF-2-1 which is an interface of SDN-SW2. Note that SDN-SW2 and IF-2-1 are selected because of the distribution of routers in the existing network. SDN is not involved in the selection. The response packet may be input to SDN-SW1. In that case, CP-1 can be used.
(Process 2-2) The SDN-SW2 determines whether or not the connection identification information of the response packet corresponds to a connection path already set in the SDN-SW2. If there is a corresponding connection path, the SDN-SW 2 transfers a response packet according to the connection path. If there is no corresponding connection path, the SDN-SW 2 transmits a connection request 204 including a response packet to the network control device 150. Since the input interface is also included in the determination here, even if a response packet from Term-0 is input to IF-1-1, there is no corresponding connection path.
(Processing 2-3) In the network control device 150, when the setting unit 151 receives the connection request 204, it makes an inquiry to the aggregation unit 152. The aggregating unit 152 searches for the connection path corresponding to the connection identification information of the response packet included in the received connection request 204 from the existing connection paths according to the conditions (a) and (b) described above. Here, CP-1 is found as a match.

Subsequently, as shown in FIG. 13, the following processing is performed.
(Processing 2-4) In the network control device 150, the aggregation unit 152 refers to the CP-1 information, and the input interface of the packet that triggered CP-1 is IF-4-2. Confirm that 4-2 can be the destination of the response packet included in the connection request 204. Then, the aggregating unit 152 constructs a new connection path between (i) IF-2-1 which is an input interface of response packets and IF-4-2 which is an interface of SDN-SW4, and (ii) The setting unit 151 is notified to delete the connection path searched and matched.
(Processing 2-5) In the network control apparatus 150, the setting unit 151 calculates a connection path between IF-2-1 and IF-4-2. The route in the SDN is determined according to various preset conditions. The response packet included in the connection request 204 is transferred as a transfer packet 205 to the SDN-SW 4 serving as an exit from the SDN. On the other hand, each SDN switch on the route is instructed to set and delete a connection path by a connection path setting and deletion instruction 206. The SDN-SW 4 outputs the response packet received from the network control device 150 from the output destination IF-4-2.

  As a result of (Process 2-5), CP-2 is constructed and CP-1 is deleted. Thereby, bidirectional communication between Term-0 and Term-1 that passes through the SDN becomes possible. CP-2 is set between IF-4-2 and IF-2-1.

  With the above-described processing, it is possible to reconstruct the connection path in the optimum state when the round trip is different in the first packet passing through the forward path and the return path.

  9 to 13, the request packet corresponds to the first packet, and the response packet corresponds to the second packet. IF-4-2 corresponds to the first input interface, IF-1-2 corresponds to the first output interface, and IF-2-1 corresponds to the second input interface.

  The network configuration and connection establishment patterns described here correspond to (type 3) and (type 4) among the above-described (type 1) to (type 4).

  In the example shown for (Type 3) and (Type 4), Term-2 is connected to the SDN through two interfaces. The two interfaces are handled in the same way, and it is the same as that in Term-2 there is a logical switch or a router that performs distribution. When a configuration similar to the example of FIG. 2 is applied to the present embodiment, Term-2 is configured with a logical network 301 and a virtual PC or blade PC 302 connected to the network 301, as shown in FIG. It can be understood that it is composed. That is, from the perspective of SDN, it is the same as the connection of an existing network having a redundant configuration, and the configuration of FIG. 14 can be considered to be equivalent to the configuration of FIG. Note that the number of connection interfaces here is not limited to two.

  Term-3 is connected to SDN-SW4 by link aggregation. When a packet is transferred from SDN to Term-3, and when a packet is transferred from Term-3 to SDN, it is guaranteed that the same destination will transfer the same packet through the same interface. As described above, this is a general operation for maintaining the packet order. However, it is not guaranteed until a packet in the reverse direction corresponding to a packet received at an interface is transferred through the interface. Link aggregation is a technique for virtually showing a broadband line using a plurality of interfaces, and each opposing device may perform distribution. Therefore, it is not necessary for bidirectional packets of the connection to pass through the same interface, and such implementation is not performed because it requires a lot of processing and resources. Ethernet (registered trademark) is originally a half-duplex line. If it is half-duplex, it may be necessary to be aware of the state of transmission from the opposite side in order to perform more efficient link aggregation. However, full-duplex communication is possible with Ethernet using twisted pair cables such as UTP (Unshielded Twisted Pair) and STP (Shielded Twisted Pair), which have been widely used in recent years. In particular, Gigabit Ethernet is premised on full-duplex communication. Therefore, the round-trip packet passing interface of one connection is different and can be the same as when Term-2 or an existing network is connected. Therefore, different paths also occur in link aggregation, and the configuration can be considered to be equivalent to the configuration of FIG.

  From the above, (type 3) and (type 4) can be handled by the operations of FIGS.

  As for (Type 2), a connection request is transmitted from Term-1, and the response from Term-0 is a different path and arrives at the unique interface of Term-1. Therefore, the IF-4-2 which is an input interface to the Term-1 side SDN in the operations of FIGS. 9 to 13 is always fixed. Regardless of whether it is fixed or not, the operation of saving the interface input first is performed, so the pattern of (Type 2) can also be handled by the operations of FIGS. 9 to 13.

  As described above, the object of the present embodiment can be achieved by the above operation for various network configurations. The additional functions are shown below.

  As described above, the TCP connection occupies most of the communication, and the TCP has a clear connection establishment procedure. Therefore, it can be expected that the load on the network control device 150 is suppressed by recognizing the establishment procedure and determining whether or not the processing is necessary.

  In the case of a TCP-SYN packet, since it is basically a new connection, no search is performed even if information is sent to the aggregating unit 152, and an immediate response is made so that processing is performed as usual. Even when a TCP connection is disconnected for some reason and it is immediately re-established, it is rare that the same port number is applied and it can be recognized as exactly the same connection, and reuse of the connection path can be warped and processing can be heavy. .

In the case of a TCP-SYN-ACK packet, there is a very high possibility that it is a different route, so the processing of the aggregation unit 152 is applied. The processing of the aggregating unit 152 is not limited to a TCP-SYN-ACK packet but is also a packet that is neither a TCP-SYN packet nor a TCP-SYN-ACK packet, that is, a packet without a TCP SYN flag. May be applied. Specifically, the following two situations are conceivable. As a result, a new connection request can be generated even for a packet having no TCP SYN flag.
(Situation 1) The distribution rule to the peer interface of the router of the existing network connected to the SDN is not changed as an entry when there is a failure at a location not directly connected to the router and the route table is changed. However, the sorting may change due to the order on the internal table changing.
(Situation 2) The distribution rule for link aggregation changes when a link failure occurs.

  However, if all TCP packets are supported, there is a possibility that the connection path management system 100 is likely to be the target of an attack or that the connection path management system 100 is likely to fail. Therefore, the correspondence to a packet having no TCP SYN flag is normally in a non-permitted state, and it is conceivable to recognize a number of triggers and enter a permitted state. As the trigger, notification of a change in the dynamic routing table can be used. A link failure or link recovery with a terminal or an external network including link aggregation or the like can also be used. The amount of time allowed is also related to the network design, such as the relationship with the TCP keep-alive timer. This is also related to the setting of the SDN connection path holding time. Therefore, it is left to each designer.

  Here, the relationship between this embodiment and the one-way connection path will be described.

  Since most communication in IP networks in recent years is TCP and bidirectional communication is inevitable, it is better to construct a bidirectional path when the first packet is input and the path is determined. It is more efficient as a control device than receiving connection paths one by one. In the case of one-way, it is necessary to calculate the route for each request and calculate the input / output interface of the SDN switch on the route. However, when setting the connection path in the opposite direction at the same time, This is because the path calculation is substantially unnecessary because it is only necessary to trace back the input / output interface. In addition, by handling one connection path in both directions, (i) it is possible to carry out both directions in a single process at the time of deletion, (ii) bi-directional deletion is immediately possible even with TCP-RST deletion, (iii) ) TCP-FIN bi-directional passage can be recognized by each switch, and the deletion process can be made more efficient. (Iv) Flow transfer process at the time of failure can be processed as one connection path. Is also convenient. Thereby, (Type 1) among (Type 1) to (Type 4) can be handled without additional processing. In addition, the effect of the present embodiment is also greatly exerted by setting bidirectionally.

  By treating the connection path one way at a time, the path setting resource of each switch is not consumed even in the case of a different route, but it is handled as another path. For this reason, calculation resources such as search of the SDN controller and entry table resources, and entry resources for hardware processing of the SDN switch are consumed almost twice as much as possible, which greatly affects the performance as the SDN. When a large number of new connections are generated or when a failure occurs and connections are redirected, there is a possibility that it may take time or may not be able to be processed. In addition, in order to solve the inconvenience in management, the calculation processing is increased, such as displaying on the management screen by taking a two-way correspondence.

  In addition to the one-way connection path entry table, a two-way connection path entry table is prepared and associated with one-way entries. Searches in the SDN controller are calculated by using the two-way table. It is thought that the use of resources can be suppressed. However, on the other hand, the connection processing load of the connection path remains the same as that of the two-way case, and the calculation for association is added, and the connection path is changed and deleted, and it is added even when there is a failure. Therefore, a large amount of computing resources are consumed.

  Therefore, in a network configuration, in order to minimize the use of various resources of the SDN and prevent the operation management from becoming complicated and to reduce the burden, the connection paths are consolidated into one, On the other hand, the switch is in a state in which a bidirectional path is set, and when connecting an existing redundant network or terminal to an SDN, by applying this embodiment, resource consumption is effectively reduced. It becomes possible to suppress.

  At present, SDN is applied to a data center, and a connection request is generally issued from a terminal. Nevertheless, terminals in recent data centers, that is, servers, often provide redundant interfaces via physical or logical switches or the like to support blades and virtualization. ) Or (Type 4), and a different path occurs. However, if the server is connected with one interface, access from the terminal corresponds to (Type 1), and most of the problems can be solved by setting bidirectional settings. However, since terminals are becoming thin clients in recent years, the connection between a thin client and a thin client server is becoming the focus of the (type 1). Connections made before thin client connections remain almost as they are from the thin client server to other servers, so even if they are in the same data center, they are large and have different floors. This embodiment is effective because access to the existing network tends to increase by passing through the existing network or going out to the WAN, and the number of connections corresponding to (Type 2) tends to increase. is there.

  When the SDN and the existing network are connected by four equal redundant interfaces, causing a different path, the probability that the forward path and the return path pass through the same interface is 1/4. Accordingly, 75% of connections in the status of (type 2), (type 3), and (type 4) are different paths. If there are two interfaces, it is halved and 50% is a different path. This embodiment is effective in such an environment.

  In the present embodiment, it is desirable to preferentially leave the latest connection path when consolidating connection paths. For this reason, it is desirable to store information on the established connection paths together with a time or a number indicating the order with sufficient accuracy to indicate the order in which the connection paths are established.

  During operation of the connection path management system 100, the administrator may periodically organize connection path information manually or automatically. If there are a plurality of connection paths having the same connection identification information, specify the interfaces at both ends of the SDN of the plurality of connection paths, and the interface group having a redundant relationship with the interfaces at both ends. The latest connection path established by a packet input from one interface group and the latest connection path established by a packet input from the other interface group are identified and finally two Select a connection path, set a connection path with both ends of the interface of the input packet of the selected connection path, and delete other connection paths.

*** Explanation of effects ***
In the present embodiment, when a situation occurs in which a plurality of connection paths are set for one connection between terminals, the plurality of connection paths are collected into one. For this reason, according to the present embodiment, it is possible to reduce the resource consumption of the network.

  According to the present embodiment, by connecting to an existing network having a redundant configuration through a plurality of interfaces, it is possible to prevent the outgoing route and the returning route from becoming different routes, and to prevent unnecessary consumption of various resources of the SDN. Become.

  According to the present embodiment, it is possible to consolidate two places where the connection path information is registered with the SDN controller. It is possible to suppress consumption of table resources of the SDN controller and reduce calculation load in processing such as search for a new request.

  According to the present embodiment, when a TCP-RST packet passes, the connection path can be deleted, but only one direction is supported, and the load for searching and processing the other is omitted.

  According to the present embodiment, when a TCP-FIN packet is detected and a connection path is deleted, the TCP-FIN itself passes through different connection paths, and those ACKs pass through different connection paths. If the information detected in each connection path is not aggregated, it is possible to prevent efficient deletion.

  According to the present embodiment, even when the connection path is changed due to a failure or the like, the calculation load can be reduced by collecting the connection path entries.

  According to the present embodiment, when SDN is applied, the resources of SDN-related equipment can be designed to be small, and the cost can be reduced and the SDN can be easily introduced at a slow start.

  Hereinafter, a hardware configuration example of the network control apparatus 150 according to the embodiment of the present invention will be described with reference to FIG.

  The network control device 150 is a computer. The network control device 150 includes hardware such as a processor 901, an auxiliary storage device 902, a memory 903, a communication device 904, an input interface 905, and a display interface 906. The processor 901 is connected to other hardware via the signal line 910, and controls these other hardware. The input interface 905 is connected to the input device 907. The display interface 906 is connected to the display 908.

  The processor 901 is an IC (Integrated Circuit) that performs processing. The processor 901 is, for example, a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit).

  The auxiliary storage device 902 is, for example, a ROM (Read / Only / Memory), a flash memory, or an HDD (Hard / Disk / Drive).

  The memory 903 is, for example, a RAM (Random Access Memory).

  The communication device 904 includes a receiver 921 that receives data and a transmitter 922 that transmits data. The communication device 904 is, for example, a communication chip or a NIC (Network, Interface, Card).

  The input interface 905 is a port to which the cable 911 of the input device 907 is connected. The input interface 905 is, for example, a USB (Universal / Serial / Bus) terminal.

  The display interface 906 is a port to which the cable 912 of the display 908 is connected. The display interface 906 is, for example, a USB terminal or an HDMI (registered trademark) (High Definition, Multimedia, Interface) terminal.

  The input device 907 is, for example, a mouse, a stylus pen, a keyboard, or a touch panel.

  The display 908 is, for example, an LCD (Liquid / Crystal / Display).

  The auxiliary storage device 902 stores a program that realizes the function of “unit” such as the setting unit 151 and the aggregation unit 152. This program is loaded into the memory 903, read into the processor 901, and executed by the processor 901. The auxiliary storage device 902 also stores an OS (Operating System). At least a part of the OS is loaded into the memory 903, and the processor 901 executes a program that realizes the function of “unit” while executing the OS.

  Although one processor 901 is shown in FIG. 15, the network control apparatus 150 may include a plurality of processors 901. A plurality of processors 901 may execute a program for realizing the function of “unit” in cooperation with each other.

  Information, data, signal values, and variable values indicating the result of processing of “unit” are stored in the auxiliary storage device 902, the memory 903, or a register or cache memory in the processor 901.

  The “part” may be provided as a “circuitry”. Further, “part” may be read as “circuit”, “process”, “procedure”, or “processing”. “Circuit” and “Circuitry” are not only the processor 901 but also other ICs such as logic IC, GA (Gate / Array), ASIC (Application / Specific / Integrated Circuit), FPGA (Field-Programmable / Gate / Array). It is a concept that includes various types of processing circuits.

  The same hardware configuration as in the example of FIG. 15 can be applied to the management device 160 as well.

  As mentioned above, although embodiment of this invention was described, you may implement this embodiment partially. For example, only one of those described as “parts” in the description of this embodiment may be adopted, or some arbitrary combinations may be adopted. In addition, this invention is not limited to this embodiment, A various change is possible as needed.

  100 connection path management system, 110 network, 120 other network, 121 network, 130 other network, 131 network, 150 network control device, 151 setting unit, 152 aggregation unit, 160 management device, 201 connection request, 202 transfer packet, 203 Connection path setting instruction, 204 Connection request, 205 Transfer packet, 206 Connection path setting and deletion instruction, 301 Network, 302 Virtual PC or blade PC, 901 Processor, 902 Auxiliary storage device, 903 Memory, 904 Communication device, 905 Input interface 906 Display interface, 907 input device, 908 display, 910 signal line, 911 cable Le, 912 cable, 921 a receiver, 922 a transmitter.

Claims (11)

A setting unit that sets a bidirectional connection path for transferring the packet group in association with the connection between the interfaces of the network in which the packet group including information for identifying the connection between the terminals is input and output;
A connection path between a first input interface that is an interface to which a first packet including information for identifying one connection is input and a first output interface that is an interface to which the first packet is output is the one path. A second packet that includes information for identifying the one connection and is transmitted in the opposite direction to the first packet after being set by the setting unit in association with a connection is an interface different from the first output interface. When input to a two-input interface, a connection path between the first input interface and the second input interface is set in association with the one connection, and another connection path corresponding to the one connection is set. Connection with the aggregation part to be deleted To manage the system. A packet requesting establishment of the one connection corresponds to the first packet;
The connection path management system according to claim 1, wherein a packet responding to the first packet corresponds to the second packet.   The aggregating unit each time a packet including information for identifying the one connection is input to an interface different from the interfaces at both ends of the connection path set by the setting unit in association with the one connection. 3. A connection path between a different interface and one of the interfaces at both ends is set in association with the one connection, and another connection path corresponding to the one connection is deleted. The connection path management system described in 1.   In the aggregation unit, a packet including information for identifying the one connection and satisfying a setting condition is input to an interface different from the interfaces at both ends of the connection path already set by the setting unit in association with the one connection. Each time, a connection path between the different interface and one of the interfaces at both ends is set in association with the one connection, and another connection path corresponding to the one connection is deleted. Item 3. The connection path management system according to Item 1 or 2.   5. The connection path management system according to claim 4, wherein a packet input to the different interface within a certain period of time after a state change of another network connected to the network is detected corresponds to a packet that satisfies the setting condition. .   The connection path management system according to claim 5, wherein a change in a routing table in the other network corresponds to the state change.   6. The connection path management system according to claim 5, wherein a link failure or recovery in the other network corresponds to the state change. Each time the setting unit inputs a packet including information for identifying the one connection to an interface different from the interfaces at both ends of the connection path already set in association with the one connection, the different interface and the network A connection path with another interface is additionally set in association with the one connection,
The aggregating unit determines whether a plurality of connection paths are set by the setting unit in association with the one connection, and determines that the plurality of connection paths are set, and determines that the plurality of connection paths are set. A connection path between two input interfaces is set in association with the one connection, and other connection paths corresponding to the one connection are deleted,
Of the plurality of connection paths, the packet that causes the latest connection path to be set by the setting unit corresponds to the second packet,
The packet input last among the packets transmitted in the opposite direction to the second packet and causing any one of the plurality of connection paths to be set by the setting unit corresponds to the first packet. Item 4. The connection path management system according to Item 1.   The connection path management system according to claim 1, further comprising the network. The setting unit sets a bidirectional connection path for transferring the packet group in association with the connection between the interfaces of the network in which the packet group including information for identifying the connection between the terminals is input / output. ,
A connection path between a first input interface, which is an interface to which the aggregation unit receives a first packet including information for identifying one connection, and a first output interface, which is an interface to which the first packet is output. Is set by the setting unit in association with the one connection, and a second packet including information for identifying the one connection and transmitted in the opposite direction to the first packet is different from the first output interface. When input to the second input interface, which is an interface, a connection path between the first input interface and the second input interface is set in association with the one connection, and the other corresponding to the one connection. Connection path to delete connection path Method. On the computer,
A process of setting a bidirectional connection path for transferring the packet group in association with the connection between the interfaces of the network in which the packet group including information for identifying the connection between the terminals is input and output;
A connection path between a first input interface that is an interface to which a first packet including information for identifying one connection is input and a first output interface that is an interface to which the first packet is output is the one path. After being set in association with a connection, a second packet including information for identifying the one connection and transmitted in the opposite direction to the first packet is sent to a second input interface that is an interface different from the first output interface. A process of setting a connection path between the first input interface and the second input interface in association with the one connection and deleting another connection path corresponding to the one connection when input; Connection path management program to execute Beam.

Images