JP6510217B2 - Network control system - Google Patents

Description

  The subject matter disclosed herein relates to network control technology for changing the configuration of a network.

  In recent years, with the spread of the cloud and the progress of server virtualization, the configuration change of the network in the data center and between the data centers is more frequently performed. At that time, if the network configuration is changed in consideration of maintaining the communication performance (communication delay and communication band), the number of work steps for the change becomes large. Therefore, the labor saving of the network configuration change has become an issue. As an example of network configuration change, there are switching of communication paths, or addition of network functions to communication paths between data processing functions or between data processing functions and terminals.

  As a related technology for switching communication paths, there is SDN (Software Defined Networking) adopting a centralized control type architecture with C / U separation, and as a related technology for enabling addition of network functions, it separates network functions from hardware. Functions (NFV) that provide network functions as software. However, only with the centralized control architecture and the technology for separating the network function from hardware, network design for maintaining communication performance is required, and the network configuration change work is not saved.

  The prior art related to the above problem will be described below.

  In Patent Document 1, distributed virtual switches communicate with each other more easily and safely and efficiently even when virtual machines and physical machines are not deployed on the same physical host and / or in the same subnet or VLAN. Make it possible.

  In U.S. Pat. No. 5,959,015, a computerized system is provided for establishing and managing a virtual network (V-net) and a virtual machine (VM) switch that enables protected and isolated interconnection between members of the V-net. Methods, systems and computers are provided.

US Patent Application Publication No. 2010/0257263 U.S. Patent Application Publication No. 2011/0283017

  Below, the subject of a prior art is demonstrated.

  When the technology of Patent Document 1 is applied to a distributed environment composed of a plurality of physically distributed points, the points to be routed, and the places such as load balancer, fire fall, DPI, and IPS can not be changed. When a virtual machine moves to a remote location, it passes through a remote routing point, causing a problem that communication delay becomes large and a problem of consuming a communication band.

  Also, when the destination virtual machine exists at a remote location, the virtual machine that can perform the same data processing as the destination virtual machine is also transmitted remotely even if it exists near the source virtual machine, The problem of increased delay and the problem of consuming the communication band occur.

  Patent Document 2 also has the same problem as Patent Document 1.

  Therefore, there is a demand for a technology that achieves both maintenance of communication performance at the time of network configuration change and labor saving at the time of configuration change.

  What is disclosed is a technique for saving the work in network configuration change by calculating the configuration of a network that maintains communication performance even if the network configuration is changed.

  What is disclosed is a network control system that does not degrade either one or both of communication performance such as communication bandwidth and communication delay and computer resources consumed even if the data processing function moves.

  Specifically disclosed is a network control system that detects the movement of the data processing function and changes the virtual network configuration to which the data processing function belongs.

  More specifically, a network control system that changes the virtual network configuration so that it is processed by the network function at an appropriate location, for example, when the network function that the data processing function has moved to goes through is remote. NCS: Network Control System).

One feature of the disclosed network control system is:
Controller,
It has the data processing function on the first server and the first middle box function in the vicinity,
When the terminal connected to the network control system is in communication with the data processing function via the first middle box function, the data processing function is transmitted from the first server to the second server. The second server and the first middle box communicate the detection function that detects that the data processing function has moved to the server, and the detection function that detects the movement of the terminal and the moved data processing function. And a path control function that is closer to the distance from the network with the function and has a second middle box function having a function equivalent to the first middle box function.

  The detection function may be configured to detect movement of the data processing function that is a transmission source of the communication packet based on a header of the communication packet transmitted by the data processing function.

  Further, a network function capable of deploying the second middle box function although the second middle box function does not exist in the vicinity of the distance between the second server and the network viewpoint of the first middle box function. When the controller is in the vicinity, the controller may be configured to deploy the second middle box function to the network function.

  Further, although the second middle box function and the network function do not exist in the vicinity of the distance between the second server and the network viewpoint of the first middle box function, a network function can be newly deployed. When the resource pool is in the vicinity, the controller may be configured to deploy the network function having the second middle box function in the resource pool.

In addition, the network control system includes a load balancer,
The above controller
Obtain load distribution information from the above load balancer,
A data processing function or a middlebox function or a network function having equivalent functions among the data processing function or the middlebox function or the network function having the IP address of the pool member corresponding to the same virtual server; See
The network control system may be configured to manage in association with a virtual network identifier to which the load balancer belongs.

In addition, the network control system includes DNS.
The above controller
Obtain name resolution information including the correspondence between URI and IP address from the above DNS,
Data having the same function as the data processing function or the middle box function or the network function that has the IP address whose processing is distributed to the same URI by responses of a plurality of IP addresses Treat as a processing function or middle box function or network function,
The network control system may be configured to manage in association with a virtual network identifier to which the DNS belongs.

  In addition, the distance between the network and the network can be determined by the packet response time of the data processing function and the network function in the IP layer (Layer 3) or the length of time in which communication processing in the application layer is performed. Alternatively, the controller may be configured.

Also, as an attribute of the middle box function or the network function,
Identification information of RSFG (risk shared function group),
Information indicating whether or not decapsulation is necessary,
Information indicating the presence or absence of burst resistance information;
Information indicating the presence or absence of a redundant configuration;
The middle box function and / or the network function may be configured to include any one or more of the above.

  According to the disclosure, it is possible to provide a technology that enables a change in network configuration while maintaining communication performance with less man-hours.

It is a figure showing an example of physical composition of a network control system to which an embodiment is applied. It is a figure which shows the example of a logic configuration of the network control system where embodiment is applied. It is a block diagram showing an example of composition of a controller by which an embodiment is applied. It is a block diagram showing an example of composition of a network function to which an embodiment is applied. It is a figure which illustrates the composition of the role group information which a controller holds. It is a figure which illustrates the traffic information which a controller holds. FIG. 8 is a diagram illustrating an example of the configuration of inter-role group passing network function information held by the controller. It is a figure which illustrates the composition of the network function information which a controller holds. It is a figure which illustrates the structure of the network function information arrange | positioned which a controller hold | maintains. It is a figure which illustrates the composition of the transfer rule information of the network function which a controller holds. It is the schematic which illustrates the operation | movement outline at the time of the deployment structure change of a data processing function. It is the schematic which illustrates the operation | movement outline at the time of the deployment structure change of a data processing function. It is the schematic which illustrates the operation | movement outline at the time of the deployment structure change of a data processing function. It is a sequence diagram which illustrates the operation | movement outline | summary at the time of network configuration optimization of a network control system. It is a chart figure which illustrates the operation outline at the time of a controller generating position information on a communication path and a data processing function. FIG. 6 is a chart illustrating an operation outline when the controller changes control information of a communication path.

  Hereinafter, embodiments will be described in detail with reference to the drawings.

  The positional relationship of the devices in this specification (distance in terms of the network) is defined by the response time. That is, two devices being close, near, or close from a network point of view means that the response time is small.

  The response time is the following two types. One is a time (packet response time) in which a single packet is transmitted / received in the IP layer (Layer 3), that is, communication delay. The communication delay is expressed by, for example, RTT (Round Trip Time) or the like.

  The other is time when a series of communication processing in the application layer is performed (time when a plurality of communication packets related to a certain data processing are transmitted and received). The time during which the series of communication processing is performed is, for example, the time from when the user presses the update button or the execution button on the screen until the update screen or the execution result is displayed. The time in which a series of communication processing in the application layer is performed is constituted by data transfer time and data processing time in the server or user terminal.

  Although TCP communication is described as an example in the system of this embodiment, in such a case, data transfer time is inversely proportional to TCP throughput. That is, the fact that the distance from the network viewpoint is far can be expressed as small throughput.

  FIG. 1 is a block diagram showing a physical configuration of a network (NW) system in the present embodiment.

The network control system according to the first embodiment includes a controller (Controller) 100, a network management device (Manager) 200, a network function (NW function) 400, a DNS (Domain Name System) 510, a router (Router) 520, and a load balancer ( LB: Load Balancer (530), server (Server) 540, FW (Firewall) 550, network switch (SW) 560, resource pool (Resource pool) 570, site (Site) 700 for storing the network functions and servers, data center It comprises a network (Network (NW)) 600 for connecting between each other and a terminal 620. .
Also, the network control system of the present embodiment may be implemented virtually. Moreover, although the controller 100 and the network management apparatus 200 are arrange | positioned out of the base 700, you may be arrange | positioned in any base 700. FIG.

  The controller 100 is mainly an apparatus for controlling the network function 400.

  The network management device 200 monitors the states of the controller 100, network function, DNS 510, router 520, load balancer 530, server 540, FW 550, and network switch 560, and manages control information and the like set for them. The network management apparatus 200 can be connected to a management terminal that provides an administrator or the like with an interface for screen display and system operation.

  The network management device 200 includes a processor, a communication device (NIC: Network Interface Card, etc.), a volatile storage device (DRAM, etc.), a non-volatile storage device (flash memory, hard disk drive, etc.), a management monitor, etc. It can be realized using a computer.

  The network function 400 is an apparatus that mainly performs various processes related to packet transfer. In this embodiment, in addition to packet transfer processing, the network function 400 performs load distribution processing, fire fall, functions such as IPS, routing, caching, acceleration, etc. (Middlebox function or Middlebox) as necessary. Prepare to be selectable.

  Each of the above functions of the network function 400 is realized by executing software having the above functions in a general-purpose server. Such a technology is implemented by the existing technology known as the above-mentioned NFV and the like, and therefore details will be omitted.

  Also, since the network function 400 does not necessarily have all middle box functions when initially deployed, it comprises a resource pool 480.

  The functions other than packet transfer processing may be provided outside the network function 400 rather than being provided to the network function 400. In that case, the network function 400 controls the transfer of packets so as to go through the necessary external functions.

  The network function 400 can be realized using a computer including a processor, a communication device, a volatile storage device (DRAM or the like), a non-volatile storage device (flash memory, hard disk drive or the like), and the like.

  A DNS (Domain Name Server) 510 performs name resolution. That is, it is an apparatus that receives a URL and returns an IP address corresponding to the URL.

  The DNS 510 can be realized using a computer including a processor, a communication device, a volatile storage device (DRAM or the like), a non-volatile storage device (flash memory, hard disk drive or the like), and the like.

  The router 520 is a gateway device that connects the network 600 and the base 700. The router 520 may have functions such as protocol conversion, NAT, and fire fall in addition to routing.

  The router 520 can be realized using a computer including a processor, a communication device, a volatile storage device (such as DRAM), and a non-volatile storage device (such as a flash memory or a hard disk drive).

  The server 540 is a computing resource for operating a data processing function and the like, and includes a CPU, a memory, and a storage therefor. The data processing function is a program that performs data processing, and examples include programs such as a web server, an application server, and a DB (Data Base) server. The data processing function may be realized as a VM (Virtual Machine).

  The server 540 can be realized using a computer including a processor, a communication device, a volatile storage device (such as DRAM), and a non-volatile storage device (such as a flash memory or a hard disk drive).

  The FW 550 is a device having a fire fall function of denying or permitting access with reference to the header of the layer 2, layer 3, layer 4 or the like. The FW 550 is a dedicated device using a computer including a processor, a communication device, a volatile storage device (such as DRAM), and a non-volatile storage device (such as a flash memory or a hard disk drive), or on a general-purpose server Is feasible.

  The switch 560 is a layer 3 switch that performs switching at layer 2.

  The resource pool 570 deploys the network function or a part of the functions of the network function (middlebox functions such as the load balancer 530 and FW 550) outside the network function 400 as a single function, or deploys the server 540. It is a surplus computing resource for

  A computing resource is a server with computing processing (CPU), memory, and storage, and surplus computing resources are not used for computing processing capacity, memory and storage, or reserved for other data processing It is not a server.

  When the resource pool 570 is allocated to the network function 400, calculation resources are allocated including the resource pool 480.

  The base 700 is a facility that houses the above-described devices. Examples of bases 700 include data centers, corporate offices, stores, and the like. In the present embodiment, communication between the bases 700 as described above is described as an example, but even if it is communication between racks instead of between bases, even if it is a management area in which a data center is divided into a plurality of data centers. Good. That is, the base 700 may be regarded as a rack or a management area.

  The network 600 is a network that connects between the bases 700, the controller 100, and the network management apparatus 200. The network 600 is a wide area network or a LAN (Local Area Network). Examples of wide area networks include ISP networks (Internet Service Provider networks), dedicated lines, and wide area Ethernet.

  The terminal 620 is a device used by an end user who requests data processing to a data processing function provided in the server, and examples thereof include a personal computer and a tablet.

  The terminal 620 can be realized using a computer including a processor, a communication device, a volatile storage device (such as DRAM), and a non-volatile storage device (such as a flash memory or a hard disk drive).

  FIG. 2 is a block diagram showing the logical configuration of the network control system in this embodiment. The LAN 610 is a network that connects network functions such as load balancers and FWs and servers. The LANs 610-1, 610-3, and 610-5 are connected to the network function 400-1, but the LANs 610-1, 610-3, and 610-5 are not communicably connected to each other via the network function 400-1. The same applies to the LANs 610-2, 610-4, and 610-6.

  The network switch 560 described in FIG. 1 is omitted because it is not a component in the logical network in layer 3. For example, the LAN 610-1 corresponds to a link in which the load balancer 503, the server 540-1, the server 540-2, and the network function 400-1 in FIG. 1 connect the SW 560-1. Note that these links in FIG. 1 correspond to the plurality of LANs in FIG. 2 (that is, the LAN is a virtual LAN (for example, VLAN: Virtual Local Area Network)).

  FIG. 3 is a block diagram showing a configuration example of the network control device (controller) in the present embodiment.

  The controller 100 includes a communication IF 235, a service reception unit 240, a data storage unit 270, and a control processing unit 210.

  The controller 100 can be realized using a computer including a processor, a communication device, a volatile storage device (DRAM or the like), a non-volatile storage device (flash memory, hard disk drive or the like), and the like.

  The communication IF 235 sets, deletes, or changes traffic composed of a series of plural packets in the network function 400 directly or via an EMS (Element Management System). The communication IF 235 also transmits a message including an instruction to transmit information held by the network function 400 to the network function 400. Then, a message including information is received from the network function 400.

  The data storage unit 270 is managed by the control processing unit 210, and the value is referred to or updated. The data storage unit 270 is constructed in a non-volatile storage device or the like provided in the controller 100. The data storage unit 270 includes a configuration information storage unit 275, a traffic information storage unit 280, a network function information storage unit 290, and a role group information storage unit 295.

  The information held by the data storage unit 270 is shown below.

  The configuration information storage unit 275 is a storage unit that holds position information of the data processing function, network topology information, and the like. The traffic information storage unit 280 is a storage unit that holds information on traffic and control information on network functions. The network function information storage unit 290 is a storage unit that holds information on network functions and information on network functions to be newly deployed. The role group information storage unit 295 is a storage unit that holds information on role groups and information on network functions through which communication packets between the role groups pass.

  Role groups are functionally equivalent, ie, equivalent outputs (packets that have the same value except for the layer lower than layer 4 of the packet) Header (layer lower than layer 4 of the packet) Represents a set of data processing functions that return a packet whose value is the same except for.

  The service accepting unit 240 controls to display a network function through which a communication path of traffic and a communication path between role groups pass, via an operation screen of a management terminal connected to the controller 100, or control from a higher-order controller It is a north band interface for

  The control processing unit 210 refers to the value held in the data storage unit 270, calculates the destination and path of each traffic, and instructs the network function 400 to control the path of each calculated traffic. The control processing unit 210 includes functions such as a traffic control function 215, a network function management 220, a role group management 225, and a network configuration management 230.

  The traffic control function 215 performs route control such as packet transfer destination in the network function 400 and rewriting of a packet header, and calculates packet processing methods in other network functions. Network function management 220 manages the state of network function 400. Role group management 225 manages functionally equivalent data processing functions. Network configuration management 230 manages physical network configuration and logical network configuration.

  That is, the functions included in the control processing unit 210 are realized by the program held in the non-volatile storage device provided in the controller 100 being executed by the processor in the volatile storage device. These programs may be stored in advance in a non-volatile storage device, or may be introduced from an external device via a network or a portable storage medium.

  FIG. 4 will be described later.

  FIG. 5 is an explanatory view of the role group information table 3000. As shown in FIG.

The role group information table 3000 is managed by the role group information storage unit 295, and is generated based on the information set in the DNS and the load balancer in the sequence 2150 and the sequence 2200 in FIG. 12 and physical network configuration information.
The role group information table 3000 includes one or more of attributes such as a virtual network identifier, a role group identifier, a position of a data processing function, a virtualization protocol, a virtualization identifier, and a data processing function address.

  The virtual network identifier indicates an identifier of a virtual network. A virtual network is a virtual network overlaid on a physical network, and can be configured without being influenced by the physical network configuration that connects servers and data centers. As a method of realizing a virtual network, there are protocols such as VxLAN, MPLS-TP, and NvGRE.

  The virtual network may be configured across a plurality of domains (for example, an MPLS-TP network, a Vx LAN network, a VLAN network, etc.) implemented by different protocols. That is, when the data processing functions are distributed and arranged across multiple domains such as VxLAN and VLAN, and these data processing functions must be able to communicate with each other (for example, a web server or DB of the same application system) If it is a server), one virtual network identifier is assigned to a network virtualized by a certain virtualization identifier (VNI) of VxLAN and a network virtualized by a certain virtualization identifier (VLAN tag) of VLAN.

  The data processing function identifier is an identifier of the data processing function. If there are multiple functionally equivalent data processes, different identifiers are assigned to each.

  The role group identifier is an identifier of a role group. A role group, as described above, represents a set of data processing functions that return functionally equivalent, ie, equivalent outputs, for equivalent inputs. For example, when there are multiple Web front ends (Web servers etc.) and multiple back ends (DB servers etc.) for load distribution in the same application, each of these Web front ends and back ends is a unique role group. An identifier is assigned.

  The position of the data processing function represents the position in the network of the data processing function identifier of the relevant row. In this embodiment, the position of the data processing function is represented by the identifier of the adjacent network function. The position of the data processing function may be represented by a switch or a router instead of the network function.

A virtualization protocol is a protocol that implements a virtual network. For example, VxLAN, MPLS-TP, PBB-TE, NvGRE and the like can be mentioned.
The virtualization identifier indicates the tag or label name used in the virtualization protocol.
The data processing function address indicates the IP address of the data processing function.

  Among data processing functions capable of performing equivalent processing by managing the role group information table 3000, a virtualization protocol for transferring a packet to a nearby data processing function, its tag or label name, destination IP It becomes possible to grasp the address and transfer the packet to the data processing function. As a result, packets can be transferred to and processed by nearby data processing functions, communication delay is reduced, and the amount of communication bandwidth consumed by networks such as wide area networks connecting with remote data processing functions is reduced. Becomes possible.

  FIG. 6 is an explanatory diagram of the traffic information table 3100.

The traffic information table 3100 is data processing function or information of traffic transmitted to and received from the terminal 620, and is used to grasp traffic control state and traffic for changing a route. It is managed by the traffic information storage unit 280, and is generated in the sequence 2250 of FIG.
The traffic information table 3100 includes a traffic identifier, a transmission source address, a transmission destination address, a transit network function identifier, a transit node identifier, a transmission source address after change, a transmission destination address after change, a path change network function identifier, a transmission change network function after change, And one or more of attributes such as a transit node identifier after change.

The traffic identifier is an identifier of traffic.
The transmission source address is the data processing function that is the transmission source of the traffic or the IP address or MAC address of the terminal 620.
The transmission destination address is an IP address or MAC address of the data processing function or the terminal 620 which is the transmission destination of the traffic.
The transit network function identifier is an identifier of the network function 400 through which traffic passes.
The via node type is a type of network function other than the via network function 400.
The transit node identifier is an identifier of a router 520 other than the network function 400 via which it passes, a DNS 510, a switch 560, an FW 550, a load balancer 530, and the like.
The post-change transmission source address is the data processing function of the transmission source of the post-change traffic when the path is changed in the network function 400 or the IP address or MAC address of the terminal 620.
The post-change transmission destination address is the data processing function of the transmission destination of the traffic after the change when the route is changed in the network function 400, or the IP address or MAC address of the terminal 620.
The post-route change network function identifier is an identifier of the network function 400 changing the route of traffic.
The post-route change node identifier is an identifier of a node that is changing the route of traffic.

FIG. 7 is an explanatory view of the inter-role group passing network function information table 3200. As shown in FIG. The inter-role group passing network function information table 3200 is managed by the role group information storage unit 295, and is generated by the administrator via the network management apparatus 200.
The inter-role group passing network function information table 3200 includes at least one of attributes such as a transmission source role group identifier, a transmission destination role group identifier, a passing network function group, and a passing network function identifier. The source role group identifier and the destination role group identifier respectively indicate the identifiers of the source and destination role groups of the traffic.

  The transit network function group is a group of functionally equivalent network functions through which the traffic passes. The transit network function group is, for example, a type of network function. Types of network functions include fire fall function, IPS function, routing function, load balancing function, DPI function, caching function, accelerating function and the like. These functions are described in the description of FIG.

  The via network function includes zero or more network functions. The transit network function identifier indicates an identifier of a network function through which the traffic passes. The passing network function identifier uniquely indicates which network function is to be passed when there are a plurality of network functions of the same passing network function group.

  By managing the inter-role group passing network function information 3200, it is possible to grasp the type of the network function to be passed when changing the route so as to localize the traffic route.

FIG. 8 is an explanatory view showing the network function information table 3300. As shown in FIG.
The network function information table 3300 is managed by the network function information storage unit 290, is generated by the administrator via the network management apparatus 200, and is updated in the sequence 2290 of FIG.

  Network function information table 3300 includes network function identifier, network function group, position of network function, status of network function, address of network function, redundancy configuration, burst resistance, decapsulation, RSFC (risk shared function group), etc. Contains one or more of the attributes.

  The NW function identifier of the network function information table 3300 may include an identifier of a middle box (load balancer 530, router 520, DNS 510, fire fall 550) which is an apparatus.

  One of the uses of this table is to switch traffic via one network function 400 to a communication path via another network function 400 that is close in terms of the network and functionally equivalent. It is to determine whether the network functions 400 are functionally equivalent. Similarly to the above, by including the identifier of the middle box in the NW function identifier of this table, the traffic passing through a certain middle box is close to the network and is functionally equivalent to the middle box, or When switching to a communication path that is nearby from the viewpoint of the network and that passes through the functionally equivalent network function 400, it is possible to determine which network function 400 is functionally equivalent.

  The network function identifier indicates an identifier of the network function. A network function group is a group of functionally equivalent network functions. The network function group represents, for example, a group in which the type of network function and its setting information are the same. In the figure, only the types of network functions are described for the purpose of easy viewing, but in fact, in order to process packets in the same manner, the same group of network function setting information is also the same Managed as For example, FW (fire fall) is managed as FW 1, FW 2, etc., according to the setting information. The network functions and the types of network functions are as described in FIG.

  The position of the network function represents the position in the network view of the network function identifier of the line concerned. In this embodiment, the position of the network function is represented by the identifier of the adjacent network function. The position of the network function may be represented by a switch or a router instead of the network function. The state of the network function is state information indicating whether or not it can be used from the viewpoint of the operating state or the load state of the network function. The address of the network function represents the IP address of the network function.

  The redundant configuration indicates whether the network function is in a redundant configuration, that is, indicates the degree of reliability. By having redundant configuration information for each network function, when there are multiple network functions belonging to the same network function group, a network configuration optimization request requiring high reliability or a new communication path setting is received. In this case, a reliable network function can be selected.

  Burst resistance indicates whether it is possible to cope with the increase in the amount of traffic by scaling up when traffic flowing to the network function increases rapidly. By having redundant configuration information for each network function, when there are multiple network functions belonging to the same network function group, a network configuration optimization request requiring burst resistance or a new communication path setting is received. In this case, it is possible to select a network function that can be scaled up. This makes it possible to prevent the performance degradation of other traffic when the traffic volume increases bursty.

  Decapsulation indicates whether or not the encapsulation part of the packet header needs to be removed, ie, decapsulated, when passing through the network function. The encapsulation part of the packet header is, for example, a VxLAN header which is a tunneling protocol, a header of Multi Protocol Label Switching (MPLS), or a header of L2 (Layer 2) over L3 (Layer 3). This is to make it possible to determine whether the network function can process a packet in a state of being encapsulated, in the case where encapsulation is necessary. By providing information of decapsulation, it is possible to change the communication route by changing the communication route only by encapsulation, or to change the communication route by changing the transmission destination address or the transmission source address of the packet. It can be judged.

  RSFG refers to a set that is similarly affected when a physical failure or performance failure occurs. This indicates that, for example, when there are a plurality of network functions configured as virtual appliances on the same server, these network functions will be in a failure state when a failure of the server occurs. By holding the RSFG, it is possible to suppress the risk that both the active hair and the spare system will fail simultaneously by selecting the network functions of the working system and the spare system that belong to different RSFGs.

  In this embodiment, the redundant configuration, the burst resistance, the decapsulation, and the RSFG are input by the administrator, but these values can be obtained from the server management or the management apparatus of the middle box (network function). You may receive it.

  By managing the network function information 3300, it is possible to grasp the nearest network function available. This makes it possible to make a decision via the nearest network function when it is via a remote network function.

FIG. 9 is an explanatory view showing a network function information table 3400 to be deployed. The network function information table 3400 to be deployed is managed by the network function information storage unit 290, and is generated in the sequence 2250 of FIG.
The deployed network function information table 3400 includes at least one of attributes such as deployed network function identifier, deployed network function group, deployed network function identifier, deployed resource pool, and deployed network function address. Including.

  The deployed network function identifier indicates an identifier of a newly deployed network function. The deployed network function group is a functionally equivalent group of deployed network functions, and indicates, for example, types of network function functions. The network function identifier for copying the setting indicates the identifier of the network function that is the copy source of the setting information when the content to be set for the newly deployed network function is generated from the setting information of the deployed network function. The address of the network function to be deployed indicates the IP address of the network function.

  FIG. 10 is an explanatory view showing the transfer rule information table 3500 of the network function. The transfer rule information table 3500 of the network function is managed by the traffic information storage unit 280, and is generated in the sequence 2250 of FIG.

The transfer rule information table 3500 of the network function includes control target traffic information (rules) and control content information (action).
The control target traffic information includes at least one of attributes such as a network function identifier, an input source IF, a transmission source virtualization identifier, a transmission source address, and a transmission destination address. The control target traffic information includes the conditions of the traffic to be controlled. The transfer processing described in the control content information is performed on the traffic matching the condition.
The network function identifier is an identifier of the network function. The input source IF is an identifier of an interface through which the network function receives traffic (packets). The transmission source virtualization identifier is a virtualization identifier written in the header of the traffic received by the network function, and is, for example, a tag (VNI) of VxLAN or an MPLS label. The source address is the IP address of the source described in the header of the traffic received by the network function.

The control content information includes one or more of attributes such as a transmission destination virtualization identifier, an output transmission source address, and an output transmission destination address.
The destination virtualization identifier is an identifier of virtualization described in the header of the traffic transmitted by the network function. The output source address is the IP address of the source described in the header of the traffic transmitted by the network function. The output destination address is the IP address of the destination described in the header of the traffic transmitted by the network function. An output IF is an interface through which a network function transmits traffic. The transmission source address, the transmission destination address, the output transmission source address, and the output transmission destination address may include a MAC address and an L4 port number in addition to the IP address.

  It returns to the explanation of FIG.

  FIG. 4 is a block diagram showing a configuration example of a network function in the present embodiment.

The network function 400 is configured to include the following functions that are deployed as needed.
That is, it includes a fire fall function 410, an IPS function 420, a routing function 430, a load balancing function 440, a DPI function 450, a caching function 460, and an accelerating function 470.

  The network function 400 further includes a switching function 490 and a resource pool 480 for deploying the function.

  The switching function 490 plays two roles. One is a role as a general network switch that performs transfer processing between the network function 400 and an external server or router. The other is a role as an internal switch that performs transfer processing between each function in the network function 400. In addition to the transfer processing, the switching function 490 may have a function of general network switches such as priority control, band control, and discard control.

The fire fall function 410 has a general fire fall function. The IPS function 420 has a general Intrusion Prevention System (IPS) function of detecting an intrusion and then preventing the attack.
The routing function 430 comprises general routing functionality. The load balancing function 440 includes a layer 2 load balancing function, a layer 3 load balancing function, and a layer 7 load balancing function. The DPI function 450 has a function of DPI (Deep Packet Inspection) that analyzes the packet header and payload. The caching function 460 has a function of caching packets. The accelerating function 470 has a function of a wide area network (WAN) accelerator that improves congestion control of TCP communication. Also, the resource pool 480 is a computational resource for deploying the above functions.

  FIG. 11 is a schematic view illustrating the outline of the operation at the time of changing the deployment configuration of the data processing function in the present embodiment. In the schematic view, functions (FW 550) other than the transfer processing of the network function 400 are shown as being included outside the network function 400, but may be included inside. Also, in this case, the FW is added, but the same applies to other functions such as WAN accelerator and firewall.

  In FIG. 11, when the data processing function VM (App) is moved, and when the data processing function VM (DB) is replicated, the traffic route and the deployment location of the network function are changed. Illustrate. FIG. 11 shows a pseudo logic configuration for convenience of explanation, but this is the same as FIG. Traffic is traffic that is transmitted from a terminal and reaches a VM (App) and traffic that is transmitted from a VM (App) and reaches a VM (DB), and is indicated by arrows.

  In the schematic diagram, the tunnel between the network functions 400-1 and 400-2 is described linearly for the purpose of improving the visibility, but the tunnel is actually the router 520-1, the network 600, Via router 520-2.

  State 1 shown in FIG. 11A represents a state before the data processing functions VM (App) and VM (DB) are moved or copied. Communication when the terminal 620 uses the VM (App) passes through the router 600 via the network 600 and reaches the VM (App) via the load balancer 530 load balancer 530-1. Communication from VM (App) to VM (DB) reaches VM (DB) via FW 550-1.

  In state 2 shown in FIG. 11B, the VM (App) moves from the server 540-1, 540-2 to the server 540-3, 540-4, and the VM (DB) moves from the server 540-6 to the server. The state after being replicated at 540-5 is shown. In addition, when VM (DB) is not used in base 700-a of FIG. 1, it may be moved instead of duplication (ie, VM (DB) in server 540-6 is deleted or stopped after duplication. Also, migration and copying of the data processing function are performed manually by the processing of the management apparatus or by the instruction and operation of the operation manager of the data processing function.

  When the traffic control function 215 of the controller 100 detects the movement of the VM (App), the traffic control function 215 determines that the LAN 1 connecting the server 540-1 and the server 540-2 and the LAN 1 connecting the server 540-3 and the server 540-4. Between the network function 400-1 and the network function 400-2 by a tunnel. Similarly, a traffic control function 215 connects between the LANs 2 by a tunnel. The communication path of the tunnel connecting the network function 400-1 and the network function 400-2 is the network function 400-1, the switch 560-1, the router 520-1, the network 600, and the router 520 shown in FIG. 2 is a path via the switch 560-2 and the network function 400-2.

  The movement detection method is shown below. The network control function 400-1 notifies the traffic control function 215 of the controller 100 of packet header information of packets such as ARP transmitted by the VM (App) before movement by the packet-in method or the like. Obtains the IP address and MAC address of the VM (App) and the VLAN, and after the traffic control function 215 of the controller 100 moves the VM (App), the VM (App) is notified by the network function 400-2 in the same manner. Know the IP address and MAC address of When the IP address and the MAC address notified from the network function 400-1 and the network function 400-2 are the same, it is determined that the VM (App) is the same, and it is determined that the VM (App) has moved.

  As described above, in the present system, the traffic control 215 of the controller 100 centrally manages header information (information such as a transmission source address, a transmission destination address, and a VLAN tag) learned by a plurality of network functions 400. 215 compares whether there is an identical header in which the different network functions 400 have learned.

  The packet-in mechanism notifies the controller of the information of the header of the packet when the packet having the unknown header arrives, but does not retransmit the packet once learned. Therefore, in the present system, when notifying using packet-in, it is desirable to have a mechanism for deleting the contents learned at certain time intervals. Note that a certain time interval is a fixed time interval or a prescribed time interval that has elapsed since the network function 400 last received a packet having a corresponding header.

  To further describe the determination method, based on the header information of the packet that the network function 400 notifies the traffic control function 215 of the controller 100, a traffic identifier managed by the traffic information storage unit 280, a transmission source address, a transmission destination address, Save the network function identifier. The controller 100 assigns an arbitrary value uniquely determined to the traffic identifier. When the network function 400 receives traffic whose traffic control method is not defined, the switching function 490 of the network function 400 notifies the traffic control function 215 of the controller 100 of packet header information as described above. At that time, the transmission source address and transmission destination address of the header information notified by the traffic control function 215 are the same as the transmission source address and transmission destination address of the traffic information table 3100 and the transit network function identifier transmitted the above notification. When it is different from the identifier of the network function 400, it is determined that the data processing function has moved. This makes it possible to detect the movement of the data processing function.

  Conventional Layer 2 and Layer 3 switches and routers exchange header information such as source and destination addresses of packets forwarded by itself, such as VLAN tags, between different switches or between different routers, and exchange those information. When a switch receives a packet with a header that it does not know, it can not make the next decision because it does not share it.

  The determination is to determine whether the data processing function of the source address of the received packet has moved from a server connected to a different switch or router or is newly deployed. Also, even if it can be determined that it has moved, it can not be determined from which server connected to which switch or router the data processing function has moved, so the logical configuration of the network before the movement (connection configuration of layer 2 or layer 3 And VLAN tag numbers) can not be grasped. As a result, the communication path can not be controlled to maintain the logical configuration of the network before movement.

  On the other hand, in the present system, the traffic control 215 of the controller 100 centrally manages header information (information such as a transmission source address, a transmission destination address, and a VLAN tag) learned by a plurality of network functions 400. However, the above judgment can be made to compare whether there is an identical header in which different network functions 400 have learned.

  Communication from the terminal 620 to the VM (App) is via the network 600 via the router 520-1, and reaches the LAN 1 via the load balancer 530-1. Since the left and right LANs 1 are transparently connected by tunneling, the packet that has reached the LAN 1 reaches the VM (App) that has moved to the server 540-4. Similarly, communication from VM (App) to VM (DB) reaches LAN 2 on the left side via the tunnel between network functions 400-1 and 400-2 via LAN 2 on the right side, and FW 550-1 To reach VM (DB) via

  In state 3 shown in FIG. 11C, the controller 100 recognizes that the role groups of the VMs (DBs) deployed in the server 540-6 and the server 540-5 are identical, that is, functionally equivalent. , The destination of traffic from VM (App) to VM (DB) is changed to VM (DB) deployed from server 540-6 to server 540-5, and between VM (App) and VM (DB) Since there is no FW on the right side through which the traffic of (1) traffic passes, the FW 550-2 is deployed and the FW passed via is changed from FW 550-1 to FW 550-2.

  This localizes traffic from VM (App) to VM (DB). Localizing traffic means, for example, not passing through the network 600. This can avoid an increase in communication delay and a decrease in TCP throughput caused by passing through the network 600. Also, the performance failure in the network 600 can reduce the impact on the application system (in particular, the I / O performance between the VM (App) and the VM (DB) most affected by the performance failure).

  The outline of the operation in the state 3 will be described in more detail with reference to FIG. 12, FIG. 13 and FIG.

  FIG. 12 is a sequence diagram illustrating an outline of operation at the time of network configuration optimization of the network control system in the present embodiment. This sequence diagram shows an outline of the operation of transitioning to state 3 when the network management apparatus 200 transmits a network configuration optimization request to the controller 100 in the state 2 of FIG.

  In sequence 2110, the network configuration management 230 of the controller 100 acquires adjacent node configuration information from the network function 400 via the communication IF 235. Here, the adjacent node is an identifier of the server 540 in which the network function 400 is adjacent in the layer 3 network, the data processing function router 520 on the server, the DNS 510, the FW 550, and the like. Here, the identifier is, for example, a value by which an adjacent node is uniquely determined by an IP address, a MAC address, or the like.

  In sequence 2120, the service reception unit 240 of the controller 100 receives the network configuration optimization request 2120 from the network management apparatus 200. The network configuration optimization request includes inter-role group transit network information 3200 and network function information 3300, a list of virtual network identifiers, a list of identifiers of data processing functions, a list of virtualization protocols, a list of virtualization identifiers, and , Contains a list of data processing function addresses. In addition, when not optimizing all traffic but specifying and optimizing some traffic, information for specifying traffic such as a source role group and a destination role group may be included. .

  The virtual network identifier, the identifier of the data processing function, the virtualization protocol, the virtualization identifier, and the address of the data processing function received by the network configuration management 230 of the controller 100 in the sequence 2150 in sequence 2150 It is added to the network identifier, data processing function identifier, virtualization protocol, virtualization identifier, and data processing function address. Next, among the addresses grasped in the sequence 2120, the identifier of the network function 400 transmitted in the sequence 2120 is the same row of the position of the data processing function as the address matching the data processing function address described in the local group information 3000. Add to

  In sequence 2160, the role group management 225 of the controller 100 sends a name resolution information request to the DNS 510 and refers to the name resolution information. Specifically, information on name resolution set in DNS, that is, correspondence between URI and IP address, etc. is grasped.

  In sequence 2170, the role group management 225 of the controller 100 acquires name resolution information from the DNS 510.

  In sequence 2180, the role group management 225 of the controller 100 transmits the load distribution information request 2180 to the load balancer 530. Specifically, the setting information of load distribution is grasped.

  In sequence 2190, the role group management 225 of the controller 100 acquires load distribution information from the load balancer 530.

  In sequence 2200, the role group management 225 of the controller generates role group information and adds it to the role group information table 3000. The procedure will be described with reference to FIG.

  In step 3110, data processing and packet processing are distributed by replying a plurality of IP addresses to the same URI by DNS round robin or the like among the name resolution information acquired by the role group management 225 in the sequence 2170. The IP address is understood as an IP address of a functionally equivalent data processing function or network function or middle box. Also, the virtual network identifier to which the DNS 510 that has acquired the information belongs belongs.

  In step 3120, of the load distribution information obtained by the role group management 225 in the sequence 2190, the IP addresses of the pool members corresponding to the same virtual server are functionally equivalent data processing functions or network functions or middleboxes, Understand as the IP address of. Also, the virtual network identifier to which the load balancer 530 that has acquired the information belongs is grasped.

  In step 3130, the virtual network identifier and string identified in steps 3110 and 3120 are the addresses of a plurality of functionally equivalent data processing functions identified by role group management 225 in steps 3110 and 3120 as the same role group address. Manage.

In step 3140, the role group management 225 grasps a line (a plurality of lines if there are a plurality) in the role group information table 3000 where the virtual network identifier is the same as the virtual network identifier grasped in step 3130. Next, a row in which the data processing function address of the corresponding row matches any one of a plurality of addresses belonging to one of the role groups identified in step 3130 is recognized as “an entry of data processing functions belonging to the same role group” Do.
Furthermore, in the row (the entry of data processing functions belonging to the same role group), a unique value is entered so that the role group identifier is unique (that is, not used in other rows). When a value is entered in the role group identifier in an entry of the row (an entry of the data processing function belonging to the same role group), the value may be unified to any value. If there are a plurality of role groups identified in step 3130, the procedure of this step is repeated for the identified role groups.

  In step 3150, the role group management 225 refers to the inter-role group network function information 3200 to grasp the source role group identifier, the destination role group identifier, the route network function group, and the route network function identifier. Transmission source role group identifier in which role group group identifier of role group information 3000 is known, and data processing function identifier identical to transmission destination role group identifier, respectively transmission source data processing function identifier, transmission destination data processing Understand as a function identifier. The source address of the traffic information table 3100 is the same as the source data processing function identifier, and the destination address is the same as the destination data processing function identifier. Add network function group and transit network function identifier.

  The above is the description of FIG. This generates role group information. It returns to the explanation of FIG.

  In sequence 2230, the service reception unit 240 transmits an inter-role group passing network function information request to the network management apparatus 200.

  In sequence 2240, the service accepting unit 240 receives inter-role group passing network function information 3200 from the network management device 200.

  In sequence 2250, the controller 100 generates routing control change information and deployment network function information. The procedure in this sequence will be described with reference to FIG.

  At step 3310, the traffic control function 215 identifies the traffic to change the route. The traffic for changing the route is, for example, the following two types.

One is traffic in which an address belonging to the same role group as the role group of the destination address of traffic is present in the vicinity of the destination address.
In this case, the traffic control function 215 refers to the source address and the destination address of the traffic information 3100.
For each of the source address and destination address, the role group identifier of the same row as the data processing function address of the role group information 3000 and the position of the data processing function, the source role group identifier and the transmission source data processing function And the position of the transmission destination role group identifier and the transmission destination data processing function. Among the rows in which the role group identifier is the same as the destination role group identifier, the data processing of the row closer to the location of the source data processing function than the location of the destination data processing function is The function identifier and the data processing function address are grasped as the near data processing function identifier and the near data processing function address. When a plurality of proximity data processing function identifiers that satisfy the conditions are calculated, it is assumed that the line closest to the position of the transmission source data processing function is selected.

In the above judgment, it is necessary to grasp the positional relationship of the data processing function, but the method of judging that the data processing function is closer than the original data processing function is, for example, the communication path of traffic as passing through the data processing function i. Is smaller than a value obtained by subtracting a certain value α (α 機能 0) from the response time T ₀ when the data passes through the data processing function o through which traffic originally passes (Ti <T _o-.alpha.) or to compare the data processing function i is determined to be closer than the original data processing functions o is smaller. When a plurality of data processing functions correspond, it is determined that the data processing function i having the smallest response time Ti is closest to the position of the transmission source data processing function.

  In addition, as a method of grasping response time, for example, grasping RTT (Round Trip Time) etc. by the existing technology such as Ping or grasping it by the existing technology measuring TCP throughput from time required to transmit data I will omit the explanation because it is possible. The traffic for which the proximity data processing function identifier is calculated by the above method is grasped as the traffic for changing the route.

  The other is traffic in which the same type of function as that of the transit node is deployed in the network function 400 through which traffic passes, or in which sufficient computational resources exist in the resource pool 480 for deployment.

  Specifically, the traffic control function 215 refers to the source address and the destination address of the traffic information 3100. Each of the source address and the destination address grasps the via node type in the line where the source address and the destination address of the traffic information 3100 are the same, and the via network function identifier.

  If the network function identifier of the network function information 3300 is the same as the via network function identifier recognized and the same as the via network function group the network function group is recognized, the same type as the via node in the network function 400 Judge that the function of is deployed.

  Also, if there are enough computing resources to deploy the via network function in the resource pool of the network function that is identical to the via network function identifier whose network function identifier of the network function information 3300 is known, sufficient computing resources for deployment Are determined as traffic existing in the resource pool 480.

  At step 3330, the role group management 225 grasps the transit network function of the traffic to be rerouted. Specifically, the transit network function identifier of the line of traffic grasped above in the traffic information table 3100 is grasped.

  In step 3340, the network configuration management 230 checks if the transit network function exists in a logical proximity.

  Specifically, the network configuration management 215 refers to the source address and the destination address of the traffic information 3100. Each of the source address and the destination address grasps the via node type in the line where the source address and the destination address of the traffic information 3100 are the same, and the via network function identifier.

  If the network function identifier of the network function information 3300 is the same as the via network function identifier recognized and the same as the via network function group the network function group is recognized, the same type as the via node in the network function 400 Judge that the function of is deployed. Furthermore, compared with the network function grasped in step 3330, ie, the network function 400 or the middle box, in which the network configuration management 230 originally passes traffic from the viewpoint of the network, the network function 400 grasped in this step is logically In the case of being closely adjacent, it is determined that the network function exists at a closer position in terms of the network.

  In the above, instead of being the same as the via network function identifier of which the network function identifier of the network function information 3300 is known, an identifier of a network function in the vicinity of the via network function of which the network function identifier of the network function information 3300 is known. And may be identical to

  The method of determining that the network function is in the vicinity is the same as in the case of the data processing function shown in step 3310, but will be briefly described below.

The method for determining that the network function 400 is closer to the network function through which traffic is originally transmitted is, for example, the response time Ti when the communication path of the traffic is changed so as to go through the network function i (or middle box). The response time T ₀ when traffic passes through the network function o (may be a middle box) through which traffic is originally passed (before rerouting) is smaller than a value obtained by subtracting a value α (α (0) from the response time T ₀ ( compares Ti <T _o -α), the network function i is determined to closer than the original network function o is smaller. When a plurality of network functions correspond, it is determined that the data processing function i having the smallest response time Ti is the closest network function.

  If it exists, the process proceeds to step 3360. If it does not exist, the process proceeds to step 3350.

  When redundancy configuration and burst resistance are specified as requirements of the application, the redundancy configuration and burst resistance can be selected among the rows which are the via network functions for which the identifier of the network function information 3300 is known. After selecting a row that has a value, calculate the network function of the neighborhood.

  In step 3350, the network function management 220 grasps the network function which is not present in the vicinity, grasps the position (resource pool 570) which is in the vicinity and deployable from the viewpoint of the network, and Understand setting information. The deployable position is a network function in which, among the network functions 400 closest to the via network function grasped in step 3310, the computational resources (CPU processing performance, memory, etc.) necessary for deployment exist in the resource pool. The network function management 220 deploys the network function in the resource pool 570 grasped in this step. In addition, the network function management 220 is a network in which the setting information grasped in this step is deployed in this step so that the deployed network function can perform the same processing as the network function 400 which the traffic originally passed through. The function 400 is set.

Note that the method for determining that the resource pool 570 is in proximity from the viewpoint of the network is, for example, the response time Ti when the traffic communication path is changed to pass through the resource pool 570, originally (before ) and via the traffic network function o (less than a value obtained by subtracting the value α (α ≧ 0) in the response time T ₀ when passing through the well may) in middlebox (Ti <T _o -α) If it is smaller, the resource pool i is determined to be closer than the original network function o. When a plurality of resource pools correspond, it is determined that the data processing function i having the smallest response time Ti is the closest resource pool.

  In step 3360, the traffic control function 215 grasps the next hop of the traffic to be rerouted, or the identifier of the pre-bias hop node. The next hop is the IP address of the next hop node to which the network function 400 transfers the packet, and the pre-bias hop is the IP address of the previous hop node that transferred the packet to the network function 400. The next hop and the pre-bias hop are the IP address of the next hop destination node among the post-change network function identifier of the traffic information table 3100, the post-change transit node identifier, or the post-change transmission destination address. Although the IP address of the next hop destination node is generated from the network configuration information, the description will be omitted because it can be realized by a general means of routing.

  In step 3370, the network function information table 3400 deployed by the traffic control function 215 and the transfer rule 3500 of the network function are generated. Specifically, the type of the nonexistent network function grasped in step 3340 is added to the “Network function group to be deployed” of the network function information table 3400 deployed by the traffic control function 215, and the “setting of the entry” is copied. Add the identifier of the transit node grasped in step 3340 to “Network function identifier to be executed”, and the deployable network function grasped in step 3350 in the resource pool of the deployment destination in “address of network function to be deployed” of the entry And the IP address of the network function. The identifier of the network function to be deployed is assigned an arbitrary value so as to be uniquely determined.

The description now turns to transfer rule information 3500 of the network function. The transit network function grasped in step 3310 is added to the network function identifier of the transfer rule information 3500 of the network function. Add the virtual network identifier of the row that is the same as the source address of the traffic identified in Step 3310 by the data processing function of the role group information table 3000 to the source virtualization identifier of the entry, and the source address of the entry Add the source address and sending address of the above-identified traffic to the destination address. In addition, the next hop and the pre-early hop found in step 3360 are added to the output source address and the output destination address of the entry.
Furthermore, in the role group information table 3000, the “virtualization identifier” of the same row as the transmission destination address of the traffic identified in step 3310 is grasped as the “virtualization identifier of transmission destination” in the data processing function address.
The “destination virtualization identifier” is added to the destination virtualization identifier of the entry of the transfer rule information 3500 of the network function.
Although the input source IF and the output destination IF are generated from network topology information, they are apparent in general routing and SDN control, so detailed description will be omitted.

  The above is the description of FIG. As a result, network function information 3400 to be deployed and control information 3500 of the network function are generated. It returns to the explanation of FIG.

  In sequence 2260, the service reception unit 240 of the controller 100 transmits a network configuration information notification to the network management apparatus 200. Specifically, the network function information 3400 to be deployed generated in the sequence 2250 and control information 3500 of the network function are transmitted.

  In sequence 2270, the service reception unit 240 of the controller 100 receives an execution request from the network management apparatus 200. If an execution request is received, the process proceeds to sequence 2280, and if not received, the process is interrupted.

  In sequence 2280, the controller 100 performs route setting and network function deployment on the network function 400 based on the setting information generated in sequence 2250.

  In sequence 2290, the controller 100 updates the state information. Specifically, the network function information 3400 to be deployed generated in the sequence 2250 is added to the network function information 3300.

100: controller 200: network management device 210: control processing unit 215: traffic control function 220: network function management 225: role group management 230: network configuration management 235: communication IF
240: service reception unit 270: data storage unit 275: configuration information storage unit 280: virtual network information storage unit 290: network function information storage unit 295: role group information storage unit 400: network function 410: fire fall function 420: IPS Function 430: Routing function 440: Load balancing function 450: DPI function 460: Caching function 470: Acceleration function 480: Resource pool 490: Switching function 510: DNS (Domain Name Service)
520: Router 530: Load balancer 540: Server 550: FW (Firewall)
560: Network switch 600: Network 610: LAN (Local Area Network)
620: Terminal 700: Base

Claims (7)

A network control system,
A network function that performs packet transfer processing,
A controller that controls the network function ;
It has the data processing function on the first server and the first middle box function in the vicinity,
When the terminal connected to the network control system is in communication with the data processing function via the first middle box function, the data processing function is a second server from the first server. A detection function that detects movement on the server based on the contents communicated by the data processing function ;
The communication between the terminal and the moved data processing function is closer to the network-based distance between the second server and the first middlebox function, and a function equivalent to the first middlebox function Providing a route control function via the second middle box function ,
The controller centrally manages header information learned by a plurality of network functions,
The network control system according to claim 1, wherein the detection function detects the movement of the data processing function by comparing whether there is an identical header in a network function learned by different network functions . In the network control system according to claim 1,
The network control system, wherein the detection function detects movement of the data processing function that is a transmission source of the communication packet, based on a header of the communication packet transmitted by the data processing function. In the network control system according to claim 1 or 2,
The controller
A network function capable of deploying the second middlebox function although the second middlebox function does not exist near the distance between the second server and the network viewpoint of the first middlebox function, A network control system characterized by deploying the second middlebox function to the network function when it is in the vicinity. In the network control system according to claim 3,
The controller
A resource pool capable of newly deploying a network function although the second middlebox function and the network function do not exist in the vicinity of the distance between the second server and the network viewpoint of the first middlebox function. If there is the vicinity, the network control system is characterized in that the network function having the second middle box function is deployed in the resource pool. The network control system according to any one of claims 1 to 4 .
Equipped with DNS,
The controller
The name resolution information including the correspondence between URI and IP address is acquired from the DNS,
The data processing function or the middle box function or the network function, among the data processing functions or the middle box functions or the network functions, those having the IP address whose processing is distributed by responses of a plurality of IP addresses to the same URI are provided with equivalent functions Treat as a processing function or middle box function or network function,
A network control system characterized by managing in association with a virtual network identifier to which the DNS belongs . The network control system according to any one of claims 1 to 5 .
The controller determines the distance between the network viewpoint and the distance based on the packet response time of the data processing function and the network function in the IP layer (Layer 3) or the length of time in which communication processing in the application layer is performed. Network control system characterized in that . The network control system according to any one of claims 1 to 6 .
The middle box function or the network function has, as an attribute,
Identification information of RSFG (risk shared function group),
Information indicating whether or not decapsulation is necessary,
Information indicating the presence or absence of burst resistance information;
Information indicating the presence or absence of a redundant configuration;
A network control system comprising any one or more of the foregoing.

Images