JP2016139908A - Communication system, communication node, control device, communication control method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the load associated with the control of L3 (Layer 3) communication of a control device for controlling a communication node in a centralized control type network.SOLUTION: A communication node 20 extracts an L2 (Layer 2) address and an L3 address of a terminal connected to a device of the communication node 20 from a packet received from the terminal, and stores them as terminal information containing the position of the terminal, the L2 address and the L3 address. The control device 10 collects the terminal information from the communication node 20. The control device 10 generates a flow entry for implementing L3 communication through a virtual L3 switch between terminals on the basis of the configuration of the network, the terminal information collected from the communication node 20 and the network information representing the L2 address of the virtual L3 switch.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication system, a communication node, a control device, a communication control method, and a program, and in particular, a communication system, a communication node, a control device, a communication control method, and a communication device that realize communication by controlling the communication node. , Related to the program.

  In recent years, a technique called open flow has been proposed. In the OpenFlow system, communication is regarded as an end-to-end flow, and path control, failure recovery, load balancing, and optimization are performed on a per-flow basis. The OpenFlow switch (OFS) includes a secure channel for communication with the OpenFlow controller (OFC), and operates according to a flow table instructed to be added or rewritten as appropriate from the OFC. In the flow table, a set (flow entry) of a matching rule that matches a packet header, flow statistical information, and an action (instruction) that defines processing content is defined as control information for each flow (Non-Patent Document 1). 2).

  For example, when receiving a packet, OFS searches the flow table for a flow entry having a matching rule that matches the header information of the received packet. If the flow entry matching the received packet is found as a result of the search, the OFS updates the flow statistical information. Then, the OFS performs processing contents (packet transmission from the designated port, header rewriting, flooding, discarding, etc.) described in the action field of the flow entry for the received packet. On the other hand, if a flow entry that matches the received packet is not found, OFS cannot determine the packet transfer destination by itself, so a copy of the packet information is transferred to the OFC via the secure channel (OpenFlow protocol packet-in message). ).

  The OFC identifies the transmitting / receiving terminal based on the packet information, and instructs the OFS to output a copy of the packet that has been packetized in from the corresponding physical port (OpenFlow protocol packet-out message). Further, when the OFS is correctly connected and path control is possible, the OFC sets a flow entry for transferring the packet in the OFS.

  With OpenFlow, if a large number of packet-in messages are sent from OFS, OFC cannot be processed, packet loss occurs for several minutes, and even existing communication may become unstable due to loss to system control packets. is there. A large amount of packet-in messages may occur when a large number of terminals are activated all at once and broadcast packets such as GARP (Gratuitous Address Resolution Protocol) and DHCP (Dynamic Host Configuration Protocol) discovery are transmitted all at once. It can also occur when a large number of unicast packets are transmitted from a terminal that has been ARP-resolved by static ARP (Address Resolution Protocol) or the like for OS patch update or file synchronization. Furthermore, it may occur when the OFS to which the server in operation is switched due to a network device or cable failure.

  Therefore, in the OpenFlow system, for example, the generation of such a large amount of packet-in messages (inquiries about flow entries) is prevented for communication of the flow control target, for example, L2 (Layer 2) or L3 (Layer 3). Is required.

  Patent Document 1 discloses a technique for reducing such flow entry inquiries to the OFC. Specifically, the OFS described in the same document stacks received packets after a flow entry inquiry to the OFC until a flow entry is set from the OFC. Then, the OFS controls (for example, broadcasts) transfer of packets of the same flow using the stacked packets.

  Also, Patent Document 2 discloses a technique for reducing the flow entry inquiry to the OFC. Specifically, the OFC of the same document sets a flow entry by obtaining terminal information from a virtual machine management system outside the OpenFlow network.

  As a related technique, Patent Document 3 discloses a technique for performing path control for each virtual network in an OpenFlow system. Patent Document 4 discloses a technique for setting control information for broadcasting in an OpenFlow system.

International Publication No. 2013/051386 International Publication No. 2012/033117 Japanese Patent No. 5494668 JP, 2014-027443, A

Nick McKeown and 7 others, “OpenFlow: Enabling Innovation in Campus Networks”, [online], [searched January 21, 2015], Internet <URL: http://www.openflow.org/documents/ openflow-wp-latest.pdf> “OpenFlow Switch Specification” Version 1.1.0 Implemented (Wire Protocol 0x02), [online], [searched January 21, 2015], Internet <URL: http://www.openflow.org/documents/ openflow-spec-v1.1.0.pdf>

  The method of Patent Document 1 is effective when packets belonging to the same flow arrive at the OFS continuously, but has a problem that it cannot cope with packet-in messages that occur simultaneously and frequently.

  Also, the method of Patent Document 2 is effective only for terminals managed by the virtual machine management system and has a problem that it cannot be used for other servers and network devices.

  An object of the present invention is to solve the above-described problems and reduce a load related to control of L3 communication of a control device that controls a communication node in a centralized control network such as an OFC, a communication system, a communication node, and a control. An apparatus, a communication control method, and a program are provided.

  The communication system of the present invention includes a packet processing means for processing a received packet based on control information set by a control device, an L2 address of the terminal from a packet received from a terminal connected to the own device, and A terminal that collects the terminal information from the communication node, and a communication node including a terminal information storage unit that extracts the L3 address and stores the terminal position, the L2 address, and the terminal information including the L3 address. Information collection means, network information storage means for storing the L2 address of the virtual L3 switch as network information, a network configuration constituted by the communication nodes, the terminal information collected by the terminal information collection means, and Based on the network information, the virtual L3 between terminals connected to the communication node It generates the control information for realizing the L3 communication through the switch, and a control device and a control means for setting to the communication node.

  The communication node of the present invention is connected to the communication node based on the network configuration configured by the communication node, terminal information collected from the communication node, and network information indicating the L2 address of the virtual L3 switch. Packet processing means for processing received packets based on the control information set from a control device that generates control information for realizing L3 communication between the terminals via the virtual L3 switch, and connected to the own device Terminal information storage means for extracting the L2 address and L3 address of the terminal from the received packet and storing it as the terminal information including the position, L2 address and L3 address of the terminal; Is provided.

  The control device of the present invention processes the received packet based on the control information set by the control device, and extracts the L2 address and L3 address of the terminal from the packet received from the terminal connected to the own device. Then, terminal information collecting means for collecting the terminal information from the communication node that stores the terminal position, L2 address, and terminal information including the L3 address, and the L2 address of the virtual L3 switch are stored as network information. Based on the network information storage means and the network configuration constituted by the communication node, the terminal information collected by the terminal information collection means, and the terminals connected to the communication node based on the network information Generating the control information for realizing L3 communication through the virtual L3 switch And a control means for setting the node, the.

  In the communication control method of the present invention, the communication node that processes the received packet based on the control information set by the control device uses the L2 address of the terminal from the packet received from the terminal connected to the own device, and L3 address is extracted and stored as terminal information including the terminal location, L2 address, and L3 address, the control device collects the terminal information from the communication node, and the control device Via the virtual L3 switch between the terminals connected to the communication node based on the network configuration constituted by the communication node, the collected terminal information, and the network information indicating the L2 address of the virtual L3 switch Control information for realizing L3 communication is generated and set in the communication node.

  The communication node program according to the present invention is based on the network configuration including the communication node, the terminal information collected from the communication node, and the network information indicating the L2 address of the virtual L3 switch. A received packet is processed based on the control information set from the control device that generates control information for realizing L3 communication between the terminals connected to the node via the virtual L3 switch, and Execute the process of extracting the L2 address and L3 address of the terminal from the packet received from the connected terminal and storing it as the terminal information including the position, L2 address, and L3 address of the terminal Let

  The program for the control device of the present invention processes the received packet on the computer based on the control information set by the control device, and from the packet received from the terminal connected to the own device, the L2 address of the terminal, Then, the L3 address is extracted, and the terminal information is collected from the communication node that stores the terminal location, the L2 address, and the terminal information including the L3 address, and the L2 address of the virtual L3 switch is stored as the network information. And L3 communication between the terminals connected to the communication node via the virtual L3 switch based on the configuration of the network constituted by the communication nodes, the collected terminal information, and the network information. The control information to be realized is generated and set in the communication node.

  The effect of the present invention is that it is possible to reduce the load related to the control of the L3 communication of the control device that controls the communication node in the centralized control type network.

It is a block diagram which shows the characteristic structure of embodiment of this invention. It is a figure which shows the structure of the communication system in embodiment of this invention. It is a flowchart which shows operation | movement of the communication node 20 in embodiment of this invention. It is a flowchart which shows operation | movement of the control apparatus 10 in embodiment of this invention. It is a flowchart which shows the operation | movement (detail of step S103) of flow entry generation in embodiment of this invention. It is a figure which shows the structure of the virtual network implement | achieved on the physical network and the said physical network in embodiment of this invention. It is a figure which shows the example of the terminal information 81 in embodiment of this invention. It is a figure which shows the example of the network information 82 in embodiment of this invention. It is a figure which shows the example of the flow entry 83 in embodiment of this invention. It is a figure which shows the example of the packet transfer in embodiment of this invention.

  First, the configuration of the embodiment of the present invention will be described.

  FIG. 2 is a diagram showing a configuration of a communication system in the embodiment of the present invention. Referring to FIG. 2, the communication system includes a control device 10 and a communication node 20. The control device 10 and the communication node 20 are connected via a control channel. In the example of FIG. 2, one communication node 20 is shown, but there may be a plurality of communication nodes 20. Similarly, a plurality of control devices 10 may be arranged as necessary. The communication node 20 is connected to the terminal 30 or another communication node 20 via a port.

  The control device 10 and the communication node 20 correspond to the OpenFlow controller and the OpenFlow switch disclosed in Non-Patent Documents 1 and 2, respectively, and are virtual on the physical network configured by the communication node 20. Realize the network.

  FIG. 6 is a diagram showing a configuration of a physical network and a virtual network realized on the physical network in the embodiment of the present invention.

  In the example of FIG. 6, in the physical network, the communication node 20A and the communication node 20B are connected, and the communication node 20B and the communication node 20C are connected. Further, the communication nodes 20A, 20B, and 20C are connected to the terminals 30A, 30B, and 30C, respectively. Furthermore, the communication nodes 20A, 20B, and 20C are connected to the control device 10A.

  In the virtual network, two virtual L2 switches 40A and 40B are connected to a virtual L3 (Layer 3) switch 50A (also referred to as a gateway). Terminals 30A and 30B are connected to the virtual L2 switch 40A, and a terminal 30C is connected to the virtual L2 switch 40B. The virtual L2 switch 40 performs L2 communication packet control (L2 control) such as packet transfer based on a MAC (Media Access Control) address, which is an L2 address, between the terminals 30. The virtual L3 switch 50 performs L3 communication packet control (L3 control) such as transfer of packets based on an IP (Internet Protocol) address, which is an L3 address, between L2 networks (broadcast domains).

  The control device 10 includes a terminal information collection unit 11, a terminal information storage unit 12, a network information storage unit 13, and a control unit 14. The control unit 14 includes a flow entry control unit 15, an ARP (Address Resolution Protocol) control unit 16, a virtual network control unit 17, and a BC / MC (Broadcast / Multicast) control unit 18.

  The terminal information collection unit 11 collects terminal information 81 from the communication node 20. The terminal information 81 indicates the position of the terminal 30 (the communication node 20 and the port number to which the terminal 30 is connected), the IP address, and the MAC address.

  FIG. 7 is a diagram showing an example of the terminal information 81 in the embodiment of the present invention. Terminal information 81 in FIG. 7 is an example of terminal information 81A to C generated in communication nodes 20A to 20C in FIG. In the example of FIG. 7, in the terminal information 81, the ID (Identifier) and port number of the communication node 20 to which the terminal 30 is connected are associated with the IP address and MAC address of the terminal 30 and their learning times. Yes. The terminal information 81 may further include a VLAN (Virtual Local Area Network) ID (VALN ID) to which the terminal 30 belongs.

  The terminal information storage unit 12 stores the terminal information 81 collected by the terminal information collection unit 11.

  The network information storage unit 13 stores network information 82. The network information 82 indicates settings related to the virtual L3 switch 50 on the virtual network.

  FIG. 8 is a diagram showing an example of the network information 82 in the embodiment of the present invention. The network information 82 in FIG. 8 is an example of the network information 82 set for the virtual network in FIG. In the example of FIG. 8, the network information 82 is set with the network address of the L2 network (broadcast domain), the IP address of the virtual L3 switch 50A (gateway) in the broadcast domain, and the MAC address. Here, the network address and the IP address of the gateway are set in advance by an administrator or the like based on the configuration of the virtual network, for example. For example, an appropriate automatically generated address is set as the MAC address of the gateway.

  The flow entry control unit 15 of the control unit 14 generates the flow entry 83 based on the configuration of the physical network (connection relationship between the communication nodes 20), the terminal information 81, and the network information 82. Then, the flow entry control unit 15 sets the generated flow entry 83 in the communication node 20.

  FIG. 9 is a diagram showing an example of the flow entry 83 in the embodiment of the present invention. A flow entry 83 in FIG. 9 is an example of the flow entry 83 set for the physical network and the virtual network in FIG. In the example of FIG. 9, in the flow entry 83, a matching rule that is a condition regarding header information of a received packet and an action indicating processing applied to a packet that matches the matching rule are associated.

  The ARP control unit 16 controls transmission of GARP (Gratuitous ARP) to the terminal 30.

  For example, as in the control server described in Patent Document 3, the virtual network control unit 17 emulates a device on the virtual network for a packet-in message. That is, the virtual network control unit 17 performs L2 control and L3 control by the virtual L2 switch 40 and the virtual L3 switch 50 on the virtual network for the packet-in message. Further, the virtual network control unit 17 generates a flow entry 83 for L2 control and L3 control for the packet-in message, and sets the flow entry 83 in the communication node 20. As a result, control of received packets that cannot be handled by the flow entry 83 generated based on the terminal information 81 collected from the communication node 20 and setting of the flow entry 83 are performed.

  For example, the BC / MC control unit 18 generates a flow entry 83 for a broadcast or multicast packet in advance and sets it in the communication node 20 in the same manner as the control server described in Patent Document 4.

  The communication node 20 includes a packet processing unit 21, a terminal information storage unit 22, and a control information storage unit 23.

  The packet processing unit 21 refers to the control information storage unit 23, and if there is a flow entry 83 that matches the received packet, the packet processing unit 21 performs processing (packet transfer or the like) indicated by the action field (instruction field) of the flow entry 83. Run. Further, the packet processing unit 21 generates terminal information 81 based on the received packet for the unlearned terminal 30 and stores it in the terminal information storage unit 22.

  The terminal information storage unit 22 stores the terminal information 81 generated by the packet processing unit 21.

  The control information storage unit 23 stores the flow entry 83 set by the control device 10.

  Note that each of the control device 10 and the communication node 20 may be a computer that includes a CPU (Central Processing Unit) and a storage medium that stores a program and that operates by control based on the program. In this case, the CPU of the control device 10 executes a computer program for realizing the functions of the terminal information collection unit 11 and the control unit 14. Further, the storage medium of the control device 10 stores data of the terminal information storage unit 12 and the network information storage unit 13. The CPU of the communication node 20 executes a computer program for realizing the function of the packet processing unit 21. The storage medium of the communication node 20 stores data in the terminal information storage unit 22 and the control information storage unit 23.

  Next, the operation of the embodiment of the present invention will be described.

  First, the operation of the communication node 20 will be described. FIG. 3 is a flowchart showing the operation of the communication node 20 in the embodiment of the present invention.

  When receiving a packet from the terminal 30, the packet processing unit 21 of the communication node 20 refers to the control information storage unit 23 and searches for a flow entry 83 that matches the packet (step S001).

  When there is a matching flow entry 83 (step S001 / Yes), the packet processing unit 21 performs processing according to the action field of the flow entry 83 on the received packet (step S002).

  On the other hand, when there is no matching flow entry 83 (step S001 / No), the packet processing unit 21 generates terminal information 81 based on the received packet (step S004). Here, the packet processing unit 21 sets the ID of the communication node 20, the port number of the port that received the packet, the IP address of the source terminal 30 extracted from the packet, and the MAC address in the terminal information 81.

  Here, the communication node 20 according to the embodiment of the present invention immediately transmits a setting request (packet-in message) for the flow entry 83 to the control device 10 even when there is no flow entry 83 that matches the received packet. Absent.

  In step S001, even when there is a matching flow entry 83, if the received packet is a broadcast or multicast packet (step S003 / Yes), the packet processing unit 21 generates terminal information 81 (step S004). As described above, in the embodiment of the present invention, even if there is a flow entry 83 that matches a broadcast packet or a multicast packet, it cannot be said that the terminal information 81 of the transmission source terminal 30 has been learned. It is an object of learning.

  Next, the packet processing unit 21 determines whether or not the generated terminal information 81 already exists in the terminal information storage unit 22 (has learned the terminal information 81) (step S005).

  If the terminal information 81 does not exist (the terminal information 81 has not been learned) (step S005 / No), the packet processing unit 21 adds the generated terminal information 81 to the terminal information storage unit 22 (step S006).

  On the other hand, when the terminal information 81 exists (the terminal information 81 has been learned) (step S005 / Yes), the packet processing unit 21 learns the learning time of the terminal information 81 existing in the terminal information storage unit 22 (the previous learning time). ) And the difference from the current time is calculated (step S007).

  When the difference between the current time and the previous learning time exceeds a predetermined threshold value (step S008 / No), the packet processing unit 21 sends a packet-in message for the received packet to the control device 10. Transmit (step S009). As a result, the virtual network control unit 17 of the control device 10 controls the received packet and sets the flow entry 83.

  The predetermined threshold described above is used to determine whether or not the received packet is a packet that cannot be controlled by the flow entry 83 generated based on the terminal information 81 generated by the communication node 20. As the predetermined threshold, for example, the same value as the collection interval of the terminal information 81 by the control device 10 is set.

  Next, the operation of the control device 10 will be described. FIG. 4 is a flowchart showing the operation of the control device 10 in the embodiment of the present invention.

  The terminal information collection unit 11 of the control device 10 periodically collects terminal information 81 from each communication node 20 and stores it in the terminal information storage unit 12 (step S101).

  When the collected terminal information 81 is updated (step S102 / Yes), the flow entry control unit 15 determines that the terminal 30 (newly detected in the communication node 20) is associated with the updated terminal information 81. New terminal 30) is determined. The flow entry control unit 15 generates a flow entry 83 for the terminal 30 (new terminal 30) related to the updated terminal information 81 (step S103).

  Here, the flow entry 83 is generated as follows, for example.

  FIG. 5 is a flowchart showing the flow entry generation operation (details of step S103) in the embodiment of the present invention.

  The flow entry control unit 15 selects one of the sets including the new terminal 30 among the sets of the terminals 30 related to the two different pieces of terminal information 81 stored in the terminal information storage unit 12 (step S201). .

  The flow entry control unit 15 determines whether the selected set of terminals 30 belong to the same broadcast domain (step S202). The broadcast domain to which the terminal 30 belongs can be specified by acquiring the network address to which the IP address of the terminal 30 belongs from the network information 82, for example.

In step S202, when belonging to the same broadcast domain (step S202 / Yes), the flow entry control unit 15 generates a flow entry 83 for L2 control for communication between the selected set of terminals 30 (step S203). )
Here, the flow entry control unit 15 performs bi-directional operation when one of the selected sets of terminals 30 is a source terminal and the other is a destination terminal, and when one is a destination terminal and the other is a source terminal. The flow entry 83 is generated. For each direction, the flow entry control unit 15 determines a packet transfer path from the transmission source terminal to the destination terminal based on the network configuration (connection relationship between the communication nodes 200) stored in a storage unit (not shown). To do. The flow entry control unit 15 sets a matching rule and an action in the flow entry 83 set in each communication node 200 on the transfer path. The flow entry control unit 15 sets the MAC address of the transmission source terminal as the transmission source MAC address and the MAC address of the destination terminal as the destination MAC address as matching rules. Further, the flow entry control unit 15 sets a transfer destination port number corresponding to the transfer path as an action.

  On the other hand, in step S202, when belonging to a different broadcast domain (step S202 / No), the flow entry control unit 15 generates a flow entry 83 for L3 control for communication between the selected sets of terminals 30 ( Step S204).

  Here, the flow entry control unit 15 generates the flow entry 83 for both directions as in step S203. For each direction, the flow entry control unit 15 determines a packet transfer path from the transmission source terminal to the destination terminal based on the network configuration, and sets the flow entry 83 set in each communication node 200 on the transfer path. Matching rules and actions are set. As a matching rule, the flow entry control unit 15 sets the MAC address of the transmission source terminal as the transmission source MAC address, the MAC address of the gateway set in the transmission source terminal as the transmission destination terminal, and the IP address of the destination terminal as the destination IP address. Set. The MAC address of the gateway set in the terminal 30 can be specified by obtaining from the network information 82 the MAC address of the gateway associated with the network address of the broadcast domain to which the terminal 30 belongs. Further, the flow entry control unit 15 sets a transfer destination port number corresponding to the transfer path as an action. Furthermore, for the flow entry 83 set in the communication node 200 to which the destination terminal is connected, the flow entry control unit 15 sets an instruction to rewrite the source MAC address and the destination MAC address as an action. In this case, an instruction to rewrite the source MAC address and the destination MAC address with the MAC address of the gateway and the MAC address of the destination terminal set in the destination terminal, respectively, is set.

  The flow entry control unit 15 repeats the processing from step S201 for all of the two sets of terminals 30 including the new terminal 30 (step S205).

  The flow entry control unit 15 uses the functions of the virtual network control unit 17 to determine the transfer path for the selected set of terminals 30 and generate the flow entry 83 in steps S203 and S204. Also good.

  Next, the control device 10 sets the flow entry 83 generated in step S103 in each communication node 20 (step S104). The communication node 20 stores the flow entry 83 in the control information storage unit 23.

  At this point, the flow entry 83 for L2 control and L3 control for the new terminal 30 has been set, but the new terminal 30 has not learned the ARP information (gateway IP address and MAC address) for the gateway. . For this reason, the new terminal 30 cannot transmit a unicast IP packet to a different broadcast domain.

  Therefore, the ARP control unit 16 transmits a GARP packet to the new terminal 30 using a packet-out message (step S105). Here, the IP address and MAC address of the gateway set in the new terminal 30 are stored in the GARP packet. Thereby, the new terminal 30 can learn the ARP information regarding the gateway.

  Note that the ARP control unit 16 may periodically retransmit the GARP packet to each terminal 30. In addition, the ARP control unit 16 may respond with an ARP Reply with a packet-out message in response to an ARP Request to the gateway received from the terminal 30 with the packet-in message. Thereby, even when the ARP information is periodically cleared in the terminal 30, the terminal 30 can hold the ARP information of the gateway and transmit the IP packet.

  Further, the control device 10 may transmit packets other than the GARP packet to the terminal 30 as long as the terminal 30 can learn the ARP information regarding the gateway.

  Thus, the operation of the embodiment of the present invention is completed.

  Next, a specific example of the embodiment of the present invention will be described.

  Here, a specific example will be described by taking as an example the case of realizing the virtual network of FIG. 6 on the physical network as shown in FIG. It is assumed that the MAC address and the IP address are set in each terminal 30 and the virtual L3 switch 50 as shown in FIG. Further, it is assumed that the network information storage unit 13 stores the network information 82 of FIG.

  First, for example, when the terminals 30A to 30C transmit a broadcast packet, the packet processing unit 21 of each communication node 20 generates terminal information 81A to C as illustrated in FIG.

  The flow entry control unit 15 of the control device 10A collects the terminal information 81A to 81C from the communication nodes 20A to 20C, and determines the terminals 30A to 30C as new terminals 30.

  For example, the flow entry control unit 15 determines the transfer path from the terminal 30A to the terminal 30B as the communication nodes 20A-20B for the set of the terminals 30A and 30B belonging to the same broadcast domain. Then, as illustrated in FIG. 9, the flow entry control unit 15 generates L2 control flow entries 83A1 and 83B1 to be set in the communication nodes 20A and 20B. In addition, the flow entry control unit 15 determines the transfer path from the terminal 30B to the terminal 30A as the communication nodes 20B-20A. Then, as shown in FIG. 9, the flow entry control unit 15 generates flow entries 83B2 and 83A2 for L2 control to be set in the communication nodes 20B and 20A.

  In addition, for example, the flow entry control unit 15 determines a transfer path from the terminal 30A to the terminal 30C as the communication nodes 20A-20B-20C for a set of terminals 30A and 30C belonging to different broadcast domains. Then, as shown in FIG. 9, the flow entry control unit 15 generates flow entries 83A3, 83B3, and 83C1 for L3 control that are set in the communication nodes 20A, 20B, and 20C. Further, the flow entry control unit 15 determines the transfer path from the terminal 30C to the terminal 30A as the communication nodes 20C-20B-20A. Then, as shown in FIG. 9, the flow entry control unit 15 generates flow entries 83C2, 83B4, and 83A4 for L3 control that are set in the communication nodes 20C, 20B, and 20A.

  The flow entry control unit 15 generates a flow entry 83 and sets it in the communication node 20 as shown in FIG. 9 for all of the sets of two terminals 30 among the terminals 30A, 30B, and 30C.

  The ARP control unit 16 transmits the GARP packet to the terminals 30A to 30C.

  Next, it is assumed that the terminal 30A transmits an IP packet to the terminal 30C.

  FIG. 10 is a diagram showing an example of packet transfer in the embodiment of the present invention. In this case, the terminal 30A sets the MAC address of the terminal 30A as the source MAC address, the MAC address of the gateway acquired by the GARP packet as the destination MAC address, and the IP address of the terminal 30C as the destination IP address. The IP packet matches the matching rule of the flow entry 83A3 already set in the communication node 20A. Therefore, the packet processing unit 21 of the communication node 20A transfers the IP packet to the communication node 20B according to the action of the flow entry 83A3. Further, the IP packet matches the matching rule of the flow entry 83B3 that has been set in the communication node 20B. Therefore, the packet processing unit 21 of the communication node 20B transfers the IP packet to the communication node 20C according to the action of the flow entry 83B3. Further, the IP packet matches the matching rule of the flow entry 83C1 already set in the communication node 20C. Therefore, the packet processing unit 21 of the communication node 20B transfers the IP packet to the terminal 30C according to the action of the flow entry 83C1. At this time, the source MAC address and the destination MAC address of the IP packet are rewritten to the MAC address of the gateway and the MAC address of the terminal 30C, respectively, according to the action of the flow entry 83C1.

  As described above, in the embodiment of the present invention, the control device 10 is not a packet-in message from the communication node 20, but triggered by detection of a new terminal 30 connected to the communication node 20. A flow entry 83 necessary for communication is set. For this reason, even if the traffic from the terminal 30 is concentrated in a short time, the frequency of occurrence of packet-in messages or the like can be reduced. As a result, it is possible to reduce the load on the control device 10 and prevent the system from becoming unstable.

  Note that in the embodiment of the present invention, real-time terminal information learning and packet transfer by packet-out are not performed for packet-in triggered by packet reception from the terminal 30. For this reason, until the collection of the terminal information 81 and the setting of the flow entry 83 are completed, a packet having the unlearned terminal 30 as a transmission source or destination is not transferred but discarded. Therefore, it is desirable that the collection interval of the terminal information 81 is as short as possible. The collection interval value of the terminal information 81 is tuned according to the hardware performance of the control device 10 and the communication node 20, the number of the terminal information 81, the update frequency, etc. Considering a learning time that is less likely to be a problem, an interval of about 1 second is appropriate.

  Further, in the embodiment of the present invention, for example, when the communication node 20 to which the terminal 30 is connected moves due to a route change or the like, the time during which the packet cannot be transferred is about several seconds as in the widespread high-speed spanning tree. Occur. However, since it is saved by retransmission processing of an upper layer such as TCP (Transmission Control Protocol), a practical problem hardly occurs.

  Further, when a large number of terminal information 81 are updated all at once, if the flow entry 83 is set for all of the terminals 30 related to the updated terminal information 81, the secure channel between the control device 10 and the communication node 20 is set. There is a possibility of exceeding the processing capacity. Therefore, in accordance with the performance of the control device 10 and the communication node 20, the upper limit of the number of flow entries 83 set per unit time in one control device 10 is set to 1000 entries per second, for example, Tuning is also desirable.

  In the embodiment of the present invention, when the bidirectional flow entry 83 is set for all combinations of the terminals 30 detected by collecting the terminal information 81, the communication node 20 is used in an environment where the number of terminals 30 is large. The number of flow entries 83 set to “1” becomes enormous. For this reason, there is a possibility that the memory of the communication node 20 is depleted or performance is deteriorated. Therefore, the following may be applied as a method of suppressing the number of flow entries 83 to some extent.

  The first method is a method of deleting unnecessary flow entries 83 based on statistical information. In this method, the flow entry control unit 15 sets the flow entry 83 for all the sets of two terminals 30 including the detected terminal 30, but monitors statistical information such as the number of times of use of each flow entry 83, The flow entries 83 that have not been used for a certain period are sequentially deleted. As a result, only the flow entry 83 actually used is left. When communication related to the deleted flow entry 83 resumes, the virtual network control unit 17 sets the flow entry 83 triggered by a packet-in message.

  The second method is a method in which the flow entry 83 is set only for a pair in which the flow entry 83 is highly likely to be used with high frequency among the pair of two terminals 30 including the detected terminal 30. . In this method, the flow entry control unit 15 is only for a set of terminals 30 including a terminal 30 that is assumed to be accessed frequently, for example, a shared server or a proxy server as a transmission source or a destination terminal. Only the flow entry 83 is set. For other sets of terminals 30, the flow entry 83 is set by the virtual network control unit 17 triggered by the packet-in message.

  The third method is a method of collecting the flow entries 83 for each destination terminal. In this method, the source MAC address and VLAN ID of the flow entry 83 for L3 control are made arbitrary, and the flow entry 83 for L3 control is aggregated for each destination terminal. In this case, since packets from different transmission source terminals to the same destination terminal are controlled by the same flow entry 83, the communication path is changed for each transmission source terminal, or access restriction is applied to each transmission source terminal. I can't. Therefore, a flow entry 83 having a high priority may be added to a packet from a specific transmission source terminal, or security may be ensured by using terminal authentication defined by IEEE 802.1X or the like. .

  Next, a characteristic configuration of the embodiment of the present invention will be described.

  FIG. 1 is a block diagram showing a characteristic configuration of an embodiment of the present invention. Referring to FIG. 1, the communication system according to the embodiment of the present invention includes a control device 10 and a communication node 20. The communication node 20 includes a packet processing unit 21 and a terminal information storage unit 22. The packet processing unit 21 processes the received packet based on the flow entry 83 (control information) set from the control device 10. The terminal information storage unit 22 extracts the L2 address and L3 address of the terminal 30 from the packet received from the terminal 30 connected to its own device, and the position, L2 address, and L3 of the terminal 30 It is stored as terminal information 81 including an address. The control device 10 includes a terminal information collection unit 11, a network information storage unit 13, and a control unit 14. The terminal information collection unit 11 collects terminal information 81 from the communication node 20. The network information storage unit 13 stores the L2 address of the virtual L3 switch 50 as network information 82. The control unit 14 performs a flow entry 83 for realizing L3 communication between the terminals 30 via the virtual L3 switch 50 based on the network configuration configured by the communication node 20, the terminal information 81, and the network information 82. Is set in the communication node 20.

  Next, the effect of the embodiment of the present invention will be described.

  According to the embodiment of the present invention, it is possible to reduce a load related to control of L3 communication of a control device that controls a communication node in a centralized control network.

  The reason is that the control device 10 realizes L3 communication between the terminals 30 via the virtual L3 switch 50 based on the network configuration, the terminal information 81 collected from the communication node 20, and the network information 82. This is because the flow entry 83 is generated.

  Thereby, instead of the packet-in message from the communication node 20, the flow entry 83 necessary for the communication of the terminal 30 can be set when the new terminal 30 connected to the communication node 20 is detected. Then, packet-in messages and packet-out messages between the control device 10 and the communication node 20 are reduced. As a result, the load on the control device 10 is reduced and the system is prevented from becoming unstable.

  Further, according to the embodiment of the present invention, it is possible to reduce the load on the control device without impairing the flexibility of network control that the central control network has. The reason is that for the packet-in message from the communication node 20, the virtual network control unit 17 performs packet processing by emulation of a device on the virtual network and the setting of the flow entry 83.

  While the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

DESCRIPTION OF SYMBOLS 10 Control apparatus 11 Terminal information collection part 12 Terminal information storage part 13 Network information storage part 14 Control part 15 Flow entry control part 16 ARP control part 17 Virtual network control part 18 BC / MC control part 20 Communication node 21 Packet processing part 22 Terminal Information storage unit 23 Control information storage unit 30 Terminal 40 Virtual L2 switch 50 Virtual L3 switch 81 Terminal information 82 Network information 83 Flow entry

Claims (10)

Packet processing means for processing a received packet based on control information set from the control device;
Terminal information that extracts the L2 address and L3 address of the terminal from the packet received from the terminal connected to its own apparatus, and stores it as terminal information including the position, L2 address, and L3 address of the terminal Storage means;
A communication node including:
Terminal information collection means for collecting the terminal information from the communication node;
Network information storage means for storing the L2 address of the virtual L3 switch as network information;
The virtual L3 switch between the terminals connected to the communication node based on the network configuration constituted by the communication nodes, the terminal information collected by the terminal information collecting means, and the network information. Control means for generating control information for realizing L3 communication via the communication node and setting the control information in the communication node;
A control device comprising:
A communication system comprising: The control means realizes L3 communication via the virtual L3 switch for each set of different terminals connected to the communication node, with one terminal as a source terminal and the other terminal as a destination terminal. Generating the control information for
The communication system according to claim 1. The control means sets the transfer destination of the received packet as a process in the control information, and as a condition of the process, the destination L2 address is the L2 address of the virtual L3 switch, and the destination L3 address is the destination Set to be the L3 address of the terminal,
The communication system according to claim 2. The control means further sets the change of the destination L2 address to the L2 address of the destination terminal and the change of the source L2 address to the L2 address of the virtual L3 switch as processing in the control information. ,
The communication system according to claim 2 or 3. The control means notifies the L2 address of the virtual L3 switch and the L3 address to a terminal related to the control information when the generated control information is set in the communication node.
The communication system according to any one of claims 1 to 4. The virtual L3 switch between the terminals connected to the communication node based on the network configuration constituted by the communication node, the terminal information collected from the communication node, and the network information indicating the L2 address of the virtual L3 switch Packet processing means for processing a received packet based on the control information set from a control device that generates control information for realizing L3 communication via
A terminal that extracts the L2 address and L3 address of the terminal from the packet received from the terminal connected to the own apparatus and stores it as the terminal information including the position of the terminal, the L2 address, and the L3 address Information storage means;
A communication node comprising: The received packet is processed based on the control information set from the control device, the L2 address and L3 address of the terminal are extracted from the packet received from the terminal connected to the own device, and the location of the terminal Terminal information collection means for collecting the terminal information from a communication node that stores L2 address and terminal information including the L3 address;
Network information storage means for storing the L2 address of the virtual L3 switch as network information;
The virtual L3 switch between the terminals connected to the communication node based on the network configuration constituted by the communication nodes, the terminal information collected by the terminal information collecting means, and the network information. Control means for generating control information for realizing L3 communication via the communication node and setting the control information in the communication node;
A control device comprising: The communication node that processes the received packet based on the control information set from the control device extracts the L2 address and the L3 address of the terminal from the packet received from the terminal connected to the own device, and Store as terminal information including terminal location, L2 address, and L3 address,
The control device collects the terminal information from the communication node;
The control device is configured to connect the terminals connected to the communication node based on network configuration including the communication node, the collected terminal information, and network information indicating an L2 address of a virtual L3 switch. Generating control information for realizing L3 communication via a virtual L3 switch and setting the control information in the communication node;
Communication control method. On the computer,
The virtual L3 switch between the terminals connected to the communication node based on the network configuration constituted by the communication node, the terminal information collected from the communication node, and the network information indicating the L2 address of the virtual L3 switch Processing a received packet based on the control information set from the control device that generates control information for realizing L3 communication via
Extracting the L2 address and L3 address of the terminal from the packet received from the terminal connected to its own device, and storing it as the terminal information including the position, L2 address, and L3 address of the terminal;
A program for the communication node for executing processing. On the computer,
The received packet is processed based on the control information set from the control device, the L2 address and L3 address of the terminal are extracted from the packet received from the terminal connected to the own device, and the location of the terminal The terminal information is collected from the communication node that stores the terminal information including the L2 address and the L3 address,
Store the L2 address of the virtual L3 switch as network information,
Based on the configuration of the network constituted by the communication nodes, the collected terminal information, and the network information, L3 communication between the terminals connected to the communication node via the virtual L3 switch is realized. Generating the control information for setting to the communication node;
A program for the control device for executing processing.

Images