KR102153585B1 - Method and apparatus for network functions virtualization - Google Patents

Abstract

Network function virtualization including at least one network function virtual machine applying a virtualized network function to a flow, and a network function flow switch that receives the flow and switches the flow to at least one network function virtual machine according to a switching table. A network function virtualization method for applying a virtual network function to a device and a flow is provided.

Description

TECHNICAL FIELD [Method and apparatus for network functions virtualization]

The present invention relates to a method and apparatus for providing network function virtualization.

In recent years, with the development of semiconductor technology, the performance of computer processors has been highly improved, and with the development of multi-core processor technology, the amount of work that can be performed simultaneously on one server has increased.

Meanwhile, in private data centers in the corporate or financial sector, as few as dozens to as many as hundreds of servers are installed to provide corporate or financial services (corporate finance, financial services, securities services, etc.). In addition, in an internet data center (IDC), hundreds or thousands of servers are provided in one place to stably provide various services (web server, mail server, file server, video server, cloud server, etc.) to different users. It is installed on. Therefore, enterprise operators or Internet service providers have demanded to reduce costs and simplify server management by integrating servers, and to control large-scale multi-processors and cluster equipment such as server storage or render farms. . In addition, there is a need to execute an application program dependent on a specific operating system in other hardware or operating system.

To meet these requirements, the concept of server virtualization has emerged. In a server virtualization environment, one or more different virtual machines may exist on one server. These different virtual machines can share the hardware (cpu, memory, storage, network interface, etc.) resources of the virtualized server. The hypervisor can perform functions such as creation, removal, transfer, and resource management of virtual machines within the server. In addition, the hypervisor allows virtual machines to share network and storage. In the case of storage, by setting the hypervisor to use storage in a logically or physically divided area for each virtual machine, the entire storage can be shared between virtual machines without interference.

However, in the case of a network, it is common for several (tens to hundreds) virtual machines installed on a single server to share a small number of network devices. When more than one virtual machine shares a network device, the network device must allow each virtual machine to share the network without interfering with each other at the network level. A technology for solving this problem is a network virtualization technology.

The biggest problem to be solved in network virtualization technology is to logically separate network data generated from one virtual machine from network data generated from another virtual machine. The first technology to solve this problem of network virtualization is a layer 2 virtual local area network (layer 2 VLAN) technology. In Layer 2 VLAN technology, a VLAN ID is independently assigned to the network data generated by each virtual machine in the first Layer 2 switch, and network data generated in one virtual machine is transferred to the network data generated in another virtual machine. Make it logically separate. Since this technology can minimize changes to existing Layer 2 switches, it is currently applied to almost all Layer 2 switches. However, the Layer 2 VLAN technology has a limit of 4096 virtual machines (=2 ¹² , because the VLAN ID is 12 bits).

Technologies such as Q-in-Q and MAC-in-MAC have appeared in order to overcome the limitations of the Layer 2 VLAN technology. Other limitations of Layer 2 VLAN technology, such as edge virtual bridging (EVB) and high efficiency portable archive (HEPA), are also available to solve the network connection problem of different virtual machines within the same hypervisor. Appeared.

Another technology that can implement network virtualization is the Layer 2 virtual network tag (VNTAG) technology. Layer 2 VNTAG technology logically separates network data generated in virtual machines from network data generated in other virtual machines by adding VNTAG that operates independently to the first Layer 2 switch. Layer 2 VNTAG technology can extend the L2 bridge and recognize virtual networks. It also has the advantage of being able to individually configure virtual interfaces like a physical port. However, there is a disadvantage that the function to process the newly added VNTAG at the L2 level must be newly added to the hardware, and in order to use VNTAG, all L2 switches included in the network must support VNTAG.

On the other hand, if such a technology was a virtualization technology based on hardware of the L2 layer, a virtualization technology based on a software virtual switch (vswitch) also appeared. The vSwitch technology switches a flow generated in a virtual machine to a physical network interface by installing a vSwitch in a hypervisor that manages a virtual machine. At this time, the vSwitch in the hypervisor to which the starting virtual machine belongs detects the corresponding flow for all flows newly created in all the starting virtual machines and reports it to the open flow controller. The openflow controller generates a new flow entry and a new flow ID based on the received flow information, and sets a new flow entry and a flow ID for the destination server. In addition, it creates a switching table of openflow switches and sends a message instructing all openflow switches to add a new flow ID. The openflow switch switches network data encapsulated by flow ID. The vSwitch in the hypervisor to which the destination virtual machine belongs can extract the original network data by decapsulating the network data encapsulated by the flow ID.

Recently, network functions virtualization (NFV) technology has been attracting attention along with network virtualization technology. There are numerous hardware equipment in the network operated by the network operator, but various difficulties may arise when the network operator attempts to introduce a new network service using the equipment already possessed. In other words, there are difficulties such as space problems of equipment for new services, power problems, and problems of forming a new structure with complicatedly arranged existing equipment, and it takes a lot of cost and time for network operators to introduce new services. . As such, when a network operator introduces a new service using complex hardware-based equipment, complex technology development is required to design new equipment as well as power and cost issues, and to integrate and operate existing equipment and new equipment. In addition, as the life of the hardware-based equipment is shortened, the process of purchasing, designing, integrating, and building new hardware-based equipment must continue without increasing sales. A more serious problem is that the hardware lifecycle becomes shorter as technology and services are accelerated, so that additional hardware expenditures without increasing sales hinder the introduction of new network services that can increase sales and become a network-centric world. It is limiting innovative improvement.

NFV technology is a technology in which a network operator uses IT virtualization technology to design a network structure using industry standard servers, switches, and storage existing in data centers, network nodes or end-user equipment in order to solve these problems. In other words, NFV technology implements network functions with software that can operate on existing industry standard servers and hardware. NFV technology's software can be moved to various locations on the network as needed without installing new equipment. Network to which NFV technology can be applied?? Equipment includes switching equipment (BNG, CG-NAT, router, etc.), mobile network node equipment (HLR/HSS, MME, SGSN, GGSN/PDN-GW, RNC, Node B, eNode B, etc.), home router and set-top box. Equipment, tunneling gateway equipment (IPSec/SSL VPN gateway, etc.), traffic analysis equipment (DPI, QoE measurement, etc.), service guarantee and SLA monitoring and test and verification equipment, NGN signaling equipment (SBCs, IMS, etc.), network function equipment ( AAA servers, policy control and billing platforms, etc.), application level optimization equipment (CDNs, Cache Servers, Load Balancers, etc.), acceleration equipment, and security equipment (Firewalls, virus detection, intrusion detection systems, spam protection, etc.).

Technologies that support NFV technology include cloud computing technology and industry standard high volume servers technology. The core of cloud computing technology is a technology that connects traffic between virtual machines and physical interfaces by virtualizing hardware using a hypervisor and a virtual Ethernet switch (vSwitch). For communication-oriented functions, data is routed directly to the virtual machine memory using an ultra-high-speed multi-core CPU with high-speed I/O bandwidth and a smart Ethernet NIC card that supports load distribution and TCP offloading. In addition, it is possible to enable high-performance data processing by using an Ethernet driver (LINUX NAPI or Intel DPDK) in polling mode rather than an interrupt-based method. In addition, the cloud infrastructure provides automatic installation of virtual equipment on the network, resource management that allocates virtual equipment to the correct CPU cores, memory and interfaces, reinstallation of failed VMs, and organization and management applicable to VM state snapshots and VM migration. Orchestration and management mechanisms can be used to improve the availability and availability of resources. Finally, the provision of open application programming interfaces (APIs) (Openflow, OpenStack, OpenNaaS, OGF's NSI, etc.) to the management plane and data plane can provide additional integration between NFV and cloud infrastructure.

In the industry standard mass server technology, the use of industry standard mass servers is a major factor in NFV technology in terms of economics. NFV technology takes advantage of economies of scale in the IT industry. Industry-standard bulk servers use standardized IT products (eg, x86-architecture CPUs) that sell millions of units to configure servers. Servers using standardized IT products generally have competing suppliers of server components. As the development cost of ASICs is increasing exponentially, companies developing hardware equipment using ASICs in the future will be pushed out of the competition for equipment developed using general-purpose processors. In the future, hardware products using ASICs are expected to be limited to products dedicated to ultra-high-speed processing performance.

There are numerous technical challenges in NFV technology. First, there is a problem of portability and interoperability. When different products made by different companies are used in different standardized data center environments of different network operators, network functions must be installed in each environment without problems and be able to run on virtual machines. The challenge to be solved is to clearly segment the network software to define a unified interface. Another problem is the performance trade off. Because network function virtualization is based on vendor standard hardware, it can imply a decrease in performance. Therefore, it should be possible to minimize latency, throughput, and processing overhead by minimizing performance degradation by using the appropriate hypervisor and the latest software technology. Another problem is the problem of migration and co-existency of legacy & compatibility with existing platforms. The NFV equipment must be able to coexist with the existing network equipment of the network operator, and must be compatible with the existing element management systems, network management systems, and OSS/BSS. Another problem is the management and orchestration problem. NFV technology requires a consistent management and organizational structure. NFV technology must be able to operate software network equipment as an open and standardized infrastructure according to well-defined, standardized, and abstracted specifications through the flexibility of software-based technology. This will greatly reduce the cost and time required to integrate new virtual equipment into the network operating environment. The next challenge is the automation problem. NFV technology can only be scaled up when all functions can be automated. Thus, automation is an important component of success. The next challenge is security & resilence. It should be possible to ensure that the newly introduced NFV technology does not compromise the security, resilience and availability of the network. NFV technology is expected to improve network resilience and availability by regenerating network functions even in the event of equipment failure. Virtual devices should be as secure as real devices if the infrastructure is secure, especially if the hypervisor and hypervisor settings are normal. Network operators will develop tools to control and verify hypervisor settings. It will also request a certified hypervisor and virtual device. The next challenge is the problem of network stability. Ensuring network stability means that many virtual machines between different hardware manufacturers and different hypervisors are not affected by each other as they are managed and organized. This is particularly important when the virtual function is reset due to hardware or software failure, or the location of the virtual function is changed due to a cyber attack. The next challenge is the question of simplicity. This means that the virtual network platform should be simpler than running the current equipment. An important concern of current network administrators is to simplify the operation of the network while maintaining continuous support of sales production services for the redundant and complex network platforms and support systems that have evolved as network technology has evolved over the past decades. The next challenge is the problem of integration. The seamless integration of multiple virtual machines into existing industry standard bulk servers and hypervisors is one of the most important challenges of NFV technology. Network operators should not incur significant consolidation costs when mixing servers, hypervisors and virtual equipment purchased from different manufacturers.

While attempting to solve the problems of the NFV technology mentioned above, the CHANGE project used the structure of The Flowstream platform to solve the performance problem. In the flowstream platform, commercial hardware was used as a platform for processing flows. In addition, a programmable switch was used to switch traffic to a module host that performs network functions. Traffic transferred from the switch to the module host can be switched by user-defined processing functions executed on the module host. In the Flowstream platform, netmap technology, clickOS technology, and FlowOS technology were used to solve the performance problem of the module host. Netmap technology, as the existing technology, was further improved in the CHANGE project. Netmap is a framework for processing user-level data at high speed. Netmap can remove unnecessary things from the general data stack by allowing direct high-speed access to the NIC's ring buffer while ensuring security in user space. Netmap can process 1.4 million data per second on a CPU core running at 900MHz. ClickOS is a structure that combines the Click software router and MiniOS. ClickOS can build lightweight virtual machines that can run on existing hypervisors (Xen, etc.). ClickOS enables a click (one of the network functions as a module router) to operate at the OS level, so that multiple users can share the same hardware while guaranteeing the same level of isolation between click modules as Xen. You can provide better performance through ClickOS. FlowOS is a kernel module that processes IP data received from the NIC. FlowOS creates a shared virtual queue for each flow and sends the received IP data to the virtual queue to which the data belongs. One flow can maintain multiple data stream virtual queues with one queue per protocol (eg, IP, TCP, UDP, etc.). The processing module is a kernel module that is connected to one flow and processes data belonging to the flow. Each processing module operates on a specific layer of the flow, and generates a corresponding processing kernel module for each data processing. Flow OS may be composed of a classifier, a merger, a flow controller, and a processing pipeline. The classifier is located on the side of receiving the traffic and delivers IP data to the appropriate flow according to the rules set by the flow controller. The integrator is located on the side that outputs the traffic, reassembles the IP data and delivers it to the output interface. The flow controller creates and manages queues for each protocol in the flow. It is also responsible for adding and deleting flows, modifying the definition of flows, and dynamically connecting or disconnecting processing modules to flows. In addition, the flow controller is responsible for communication with other entities in the network (flow transmission unit, flow reception unit, counterpart flow processing platform, etc.). In the Flowstream platform, these three technologies (Netmap, ClickOS, and FlowOS) are used in parallel and mutually secured. Netmap and FlowOS can run simultaneously within ClickOS to ensure better independence. FlowOS can also be implemented using Netmap to use Netmap's high-speed data path processing technology.

However, the Flowstream platform showed the possibility of the NFV concept by using ClickOS and Netmap, but the generality is much inferior because the kernel mode software was modified and used. In addition, in the case of ClickOS, it is difficult to satisfy the diversity required by NFV because the functions that can be provided are limited and the scalability is not excellent. FlowOS also performs parallel processing using multiple virtual queues for each protocol at the kernel level, but the performance of the classifier and integrator at the kernel level is the key, and the effect of parallel processing is not clear.

An object of the present invention is to provide a network function virtualization apparatus and method capable of providing a virtual network function according to a flow attribute.

According to an embodiment of the present invention, a network function virtualization method for applying a virtualized network function to a flow is provided. The network function virtualization method includes receiving a flow, switching a flow to at least one network function virtual machine according to a switching table of a network function flow switch, and applying a virtualized network function to the flow. .

The network function virtualization method may further include receiving an updated flow table based on flow information of a new flow generated in the virtual machine, and updating the switching table according to the flow table.

The network function virtualization method further includes the step of checking a data attribute or a service attribute of a flow after the receiving step, and the switching step includes at least one network function according to the switching table based on the data attribute or the service attribute. You can switch the flow to a virtual machine.

Switching in the network function virtualization method may include switching a flow according to a service property of at least one network function virtual machine.

In the network function virtualization method, the step of switching the flow according to the service attribute of at least one network function virtual machine may include, when the service attribute of the at least one network function virtual machine is a server-server, the service attribute is a server-server flow. Assigning the best priority to the at least one network function virtual machine, and when the service attribute of the at least one network function virtual machine is a subscriber-server, giving the best priority to a flow in which the service attribute is a subscriber-server. .

In the network function virtualization method, the step of switching the flow according to the service attribute of at least one network function virtual machine is best for a flow in which the service attribute is real-time QoS when the service attribute of the at least one network function virtual machine is a real-time service. The step of assigning a priority of, and when the service attribute of the at least one network function virtual machine is a delay sensitive service, giving the best priority to a flow whose service attribute is a delay sensitive QoS.

Applying the virtualized network function in the network function virtualization method may include virtualizing a DHCP, NAT, Firewall, DPI or load balancing function and applying it to a flow.

The network function virtualization method may further include analyzing a first flow to which a virtualized network function is applied, and switching the first flow to a virtual machine or a virtual machine different from the virtual machine.

Analyzing the first flow in the network function virtualization method includes extracting first flow information of the first flow and determining whether the first flow is a new flow based on the first flow information, and the first flow is new. In the case of a flow, it may include receiving an updated flow table based on the first flow information, and updating a switching table based on the updated flow table.

The network function virtualization method may further include storing the first flow information in a flow table cache.

According to another embodiment of the present invention, a network function virtualization apparatus for applying a virtual network function to a flow is provided. The network function virtualization apparatus includes at least one network function virtual machine applying a virtualized network function to a flow, and a network function flow switch that receives the flow and switches a flow to at least one network function virtual machine according to a switching table. Includes.

The network function virtualization apparatus may further include a network function agent for receiving an updated flow table based on flow information of a new flow generated in the virtual machine and updating the switching table.

In the network function virtualization apparatus, the network function flow switch may check the data attribute or service attribute of the flow, and switch the flow to at least one network function virtual machine according to the switching table based on the data attribute or service attribute.

In the network function virtualization apparatus, the network function flow switch may switch flows according to service properties of at least one network function virtual machine.

In the network function virtualization apparatus, the network function flow switch, when the service attribute of at least one network function virtual machine is a server-server, gives the best priority to a flow whose service attribute is a server-server, and at least one network When the service attribute of the functional virtual machine is subscriber-server, the best priority can be given to a flow in which the service attribute is subscriber-server.

In the network function virtualization apparatus, the network function flow switch, when the service attribute of at least one network function virtual machine is a real-time service, gives the best priority to the flow in which the service attribute is real-time QoS, and at least one network function virtual machine When the service attribute of the machine is a delay sensitive service, the best priority can be given to a flow whose service attribute is delay sensitive QoS.

In the network function virtualization apparatus, at least one network function virtual machine may virtualize a DHCP, NAT, Firewall, DPI, or load balancing function and apply it to a flow.

In the network function virtualization apparatus, the network function flow switch may analyze a first flow to which a virtualized network function is applied, and switch the first flow to a virtual machine or a virtual machine different from the virtual machine.

In the network function virtualization apparatus, the network function flow switch extracts first flow information of the first flow, determines whether the first flow is a new flow based on the first flow information, and the network function agent determines whether the first flow is In the case of a new flow, an updated flow table may be received based on the first flow information, and the switching table may be updated based on the updated flow table.

In the network function virtualization apparatus, the network function flow switch may store first flow information in a flow table cache.

According to an embodiment of the present invention, a virtualized network function may be applied in parallel by checking a data attribute and a service attribute of a received flow, and switching the flow to a network function virtual machine according to the data attribute and service attribute. In addition, QoS can be guaranteed according to the data attribute or service attribute of the flow. In addition, it is possible to update the switching table of the network function flow switch according to a single request or periodically based on the flow information of the flow.

1 shows a network function virtualization system according to an embodiment of the present invention.
2A and 2B are flowcharts illustrating a method of processing an ingress flow according to an embodiment of the present invention.
3A and 3B are flowcharts illustrating a method of processing an egress flow according to an embodiment of the present invention.
4 shows a network function virtualization system according to another embodiment of the present invention.
5A to 5C are flowcharts illustrating a method of processing an ingress flow according to another embodiment of the present invention.
6A and 6B are flowcharts illustrating a method of processing an egress flow according to another embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. However, the present invention may be implemented in various forms and is not limited to the embodiments described herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and similar reference numerals are assigned to similar parts throughout the specification.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, terms such as "...unit", "...unit", "...group", "module", and "block" described in the specification mean a unit that processes at least one function or operation, which is a software or microprocessor. It may be implemented by hardware such as, or a combination of software and hardware.

1 shows a network function virtualization system according to an embodiment of the present invention.

Referring to FIG. 1, an NFV system according to an embodiment of the present invention includes a server 100, a switch 110, a network function server 120, and a flow control unit 130.

The server 100 includes an edge flow switch 104 and an edge agent 105, and the edge flow switch 104 is connected to a plurality of virtual machines 101 to 10n included in the server. Further, the edge flow switch 104 is connected to the switch 110 through at least one network interface 131. In addition, the edge agent 105 is connected to the flow control unit 130 through the management and control interface 133.

The virtual machines 101 to 10n of the server 100 are OS (LINUX, NetBSD, FreeBSD, Solaris, Windows) operating on logical hardware (virtual CPU, virtual memory, virtual storage, virtual network interface, etc.) provided by the hypervisor. Etc). The virtual machines 101 to 10n generate data flows according to the services (web server, file server, video server, cloud server, corporate finance, finance, securities, etc.) provided by the virtual machine, and each data flow is provided. Different services have different service QoS requirements. The edge flow switch 104 analyzes the data flow generated in the virtual machines 101 to 10n and transmits the new data flow to the edge agent 105. And the edge flow switch 104 processes a data flow other than a new data flow as described in the switching table in the edge flow switch 104. The edge agent 105 updates new flow information based on the information received from the flow control unit 130. In this case, the edge agent 105 may periodically update the switching table and the virtual machine table through the flow control unit. The virtual machine table, which is updated periodically, provides network information for each virtual machine and QoS information of the service provided by the virtual machine (real-time/non-real-time service, high bandwidth service, low bandwidth service, delay sensitive/insensitive service, service data direction). (Subscriber-server, server-server), virtual machine bandwidth information, etc.). The periodically updated switching table includes network information for each flow, operation information (forwarding, drop, edge agent delivery, field modification, tunneling, etc.), QoS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/ It may include insensitivity, secure/unsecure data, direction of service data (subscriber-server, server-server, etc.).

The switch 110 includes a flow switch 111 and a switch agent 112. The switch 110 is connected to the server 100 and the network function server 120 through at least one network interface 131 and 132. In addition, the switch agent 112 is connected to the flow control unit 130 through the management and control interface 134. The switch 110 is connected to the server 100 through at least one network interface 131 through an L2 switch or an L3 switch or through an L2 switch and an L3 switch. The switch agent 112 updates the virtual machine table and the switching table of the switch 110 based on the new flow information received from the flow controller 130 through the management and control interface 134. In this case, the switch agent 112 may periodically receive new flow information from the flow control unit 130. The virtual machine table, which is updated periodically, includes network information and QOS information for each virtual machine (real-time/non-real-time service, high bandwidth service, low bandwidth service, delay sensitive/insensitive service, service data direction (subscriber-server, server- Server), virtual machine bandwidth information, etc.). The periodically updated switching table includes network information for each flow, operation information (forwarding, drop, edge agent delivery, field modification, direction of service data (subscriber-server, server-server), etc.), and services provided by virtual machines. QOS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive, service data direction (subscriber-server, server-server), etc.) can be included.

The switch 110 receives the data flow generated in the virtual machines 101 to 10n of the server 100 through the L2 switch or the L3 switch or through the L2 switch and the L3 switch. The switch 110 analyzes the received data flow and extracts flow information. Thereafter, the switch 110 includes the virtual machine network information (the IP address of the virtual machine, the MAC address of the virtual machine, the NAT translation information of the virtual machine, the bandwidth information of the virtual machine, etc.) of the switching table updated by the switch agent 112. Apply virtual machine and flow QoS policy to data flow based on QoS information ((real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive, service data direction (subscriber-server, server-server), etc.) Since the switch 110 periodically updates QoS information for all flows in the switch as well as network information and QoS information for the virtual machine in the system, the service provided by the corresponding virtual machine is Depending on the type, it is possible to provide optimal QoS for each flow In this case, the switch 110 manages the QoS of the flow by distinguishing the direction of service data (subscriber-server or server-server) among QoS information of each virtual machine. For example, if the service attribute of the virtual machine is server-server, the data attribute gives high priority to the server-server flow, and if the service attribute of the virtual machine is subscriber-server, the data attribute is subscriber. -By assigning a high priority to server-in flow, service quality can be provided to service data In addition, if the service attribute of the virtual machine is a real-time service, the flow with real-time QoS attribute among the data flows created by the virtual machine is Service quality can be provided to service data by assigning a high priority to the service data In addition, if the service attribute of the virtual machine is a delay sensitive service, the flow with the delay sensitive QoS attribute has a high priority among the data flows created by the virtual machine. Service quality can be provided to service data by assigning a ranking.

The network function server 120 includes a network function flow switch 124 and a network function agent 15, and the network function flow switch 124 includes a plurality of network function virtual machines 121 to 12n included in the network function server. Is connected with Further, the network function flow switch 124 is connected to the switch 110 through at least one network interface 132. In this case, the network function server 120 may be connected to the switch 110 through an L2 switch or an L3 switch or through an L2 switch and an L3 switch. Further, the network function agent is connected to the flow controller 130 through the management and control interface 135.

The network function flow switch 124 receives the data flow from the switch 110 through the L2 switch or the L3 switch or through the L2 switch and the L3 switch. The network function flow switch 124 analyzes the data flow received from the switch 110 and extracts flow information. If the extracted flow information is a new data flow, the network function flow switch 124 transfers the received data flow to the network function agent 125. However, if it is not a new flow, the flow is switched to the network function virtual machines 121 to 12n according to the switching table of the network function flow switch 124. In addition, the network function flow switch 124 analyzes the data flow received from the network function virtual machines 121 to 12n to extract flow information. At this time, if the extracted flow information is a new data flow, the network function flow switch 124 transfers the data flow received from the network function virtual machines 121 to 12n to the network function agent 125. However, if it is not a new flow, the network function flow switch 124 switches the received data flow to the switch 110 or other network function virtual machines 121 to 12n according to the network function switching table. The network function flow switch 124 adds the switching table used when detecting a new data flow to the switching table cache. The network function flow switch 124 deletes the corresponding switching table from the switching table cache at the end of the data flow. The network function flow switch 124 may use a switching table of the same other data flow stored in the switching table cache for the same data flow.

When the network function virtual machines (121 to 12n) create a new data flow, each data flow may have different QoS requirements according to the network function. In addition, the network function flow switch 124 may be configured for each network function. QoS can be managed by assigning different QoS priorities to data flows according to service properties among the QoS information of the virtual machine, for example, the network function flow switch 124 provides the direction of service data of the network function virtual machine (subscriber -Server or server-server) can process data flow by distinguishing information.

Network function virtual machines (121 to 12n) are OS (LINUX, NetBSD, FreeBSD, Solaris, Wondows, mini-OS) operating on logical hardware (virtual CPU, virtual memory, virtual storage, virtual network interface) provided by the hypervisor. , micro-OS, etc.) to perform network functions (DHCP, NAT, Firewall, DPI, Load Balancing, etc.). In an embodiment of the present invention, a plurality of network function virtual machines may be included in a plurality of network function servers, so that network functions may be applied in parallel to a flow. The network function virtual machines 121 to 12n receive and process the data flow from the network function flow switch 124 according to the network function (DHCP, NAT, Firewall, DPI, Load Balancing, etc.) to be performed, and then transmit the result to the network function. It may be transmitted to the flow controller 130 through the agent 125. In addition, after the network function virtual machines 121 to 12n process the received data flow, a new data flow may be generated and transmitted to the network function flow switch 124.

The network function agent 125 connects to the flow controller 130 through the management and control interface 135 to update new flow information. In addition, the network function agent 125 periodically connects with the flow controller 130 to update the switching table and the network function virtual machine table. The network function virtual machine table, which is periodically updated, includes network information for each network function virtual machine 121 to 12n, and QOS information of the network function service provided by the network function virtual machines 121 to 12n (real-time/non-real-time service, It may include a high-bandwidth service, a low-bandwidth service, a delay sensitive/insensitive service, a network function service data direction (subscriber-server or server-server), network function virtual machine bandwidth information, etc.). The periodically updated switching table includes network information for each flow, operation information (forwarding, drop, edge agent delivery, field modification, tunneling, etc.), QOS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/ It may include insensitivity, secure/non-secure data, orientation of service data (subscriber-server or server-server).

The network function flow switch 124 may manage QoS of a flow by discriminating the direction of service data (subscriber-server or server-server) among QoS information of each network function virtual machine 121 to 12n. For example, when the service attribute of the network function virtual machines 121 to 12n is a server-server, the network function flow switch 124 gives the best priority to a flow in which the service attribute is a server-server, and When the service attribute of the machine is subscriber-server, service quality can be provided to service data by giving the best priority to a flow in which the service attribute is subscriber-server.

In addition, when the service attribute of the network function virtual machine (121 to 12n) is a real-time service, a high priority is given to the flow with real-time QoS attribute among the data flows created by the network function virtual machine, providing service quality to service data. can do. In addition, when the service attribute of the network function virtual machines 121 to 12n is a delay sensitive service, high priority is given to the flow with the delay sensitive QoS attribute among the data flows generated by the network function virtual machine, Can provide.

2A and 2B are flowcharts illustrating a method of processing an ingress flow according to an embodiment of the present invention.

2A and 2B, first, the virtual machines 101 to 10n included in the server 100 provide services (web server, mail server, file server, video server, cloud server, corporate finance, finance, securities). Etc.), and transmits the flow to the edge flow switch 104 (S202).

The edge flow switch 104 analyzes the flow generated by the virtual machines 101 to 10n to extract flow information (S203), and analyzes the extracted flow information to determine whether the flow is a new flow (S204).

If the flow generated by the virtual machines 101 to 10n is a new flow, the edge flow switch 104 delivers the flow information (new flow information) of the new flow to the edge agent 105 (S205). Then, the edge agent 105 transmits the new flow information to the flow control unit 130 (S206).

Thereafter, the flow control unit 130 updates the flow table of the flow control unit 130 by generating virtual flow information and network function information for the new flow through the new flow information (S207). In this case, the flow table may include a switching table and a network function table.

Thereafter, the edge agent 105 receives the updated flow table of the flow control unit 130 (S208), and updates the switching table of the edge flow switch 104 according to the updated flow table (S209).

Further, the switch agent 112 also updates the switching table of the switch 110 according to the updated flow table of the flow control unit 130 (S210).

In addition, the network function agent 125 also updates the switching table of the network function flow switch 124 according to the updated flow table of the flow control unit 130 (S211).

Thereafter, the edge flow switch 104 processes the flow generated by the virtual machines 101 to 10n of the server 100 according to the switching table (S212), and through the L2 switch or the L3 switch or through the L2 switch and the L3 switch, etc. The flow is transmitted to the switch 110 through at least one network interface 131 (S213).

The flow switch 111 analyzes the flow generated by the virtual machines 101 to 10n and extracts flow information (S214). The flow switch 111 uses the extracted flow information, from the switching table, to virtual machine network information (virtual machine IP address, virtual machine MAC address, virtual machine NAT translation information, virtual machine bandwidth information, etc.), Machine QOS information (real-time/non-real-time data, high/low bandwidth, delay sensitive/insensitive, service data direction (subscriber-server, server-server), etc.) and QoS information of flow (real-time/non-real-time data, high/low bandwidth, etc.) It finds low bandwidth, delay sensitive/insensitive, secure/non-secure data service, data direction (subscriber-server, server-server, etc.) and decides the QoS policy for the received flow. Then, the flow switch 111 applies the QoS policy determined for the corresponding flow (S215).

In addition, the switch 110 switches the data flow received from the server 100 according to the updated switching table (S216). If network function virtualization is to be performed for the corresponding data flow, the switch 110 switches the flow to the network function server 120 according to the switching table. If network function virtualization is not performed for the corresponding data flow, the flow is switched to another server 100 according to the switching table.

Thereafter, the network function flow switch 124 of the network function server 120 checks the data attribute (video data, voice data, text data, etc.) or service attribute (real-time service, delay sensitive service, etc.) of the received flow ( S217). In addition, the network function flow switch 124 flows to the network function virtual machines 121 to 12n capable of performing a virtual network function according to the switching table of the network function flow switch 124 based on the data attribute or service attribute of the flow. To switch (S218).

The network function virtual machines 121 to 12n apply the virtualized network function to the data flow received from the network function flow switch 124 (S219).

3A and 3B are flowcharts illustrating a method of processing an egress flow according to an embodiment of the present invention.

The network function virtual machines 121 to 12n apply the virtualized network function to the data flow received from the network function flow switch 124 (S301). In addition, the network function virtual machines 121 to 12n generate a flow according to the virtualized network functions (DHCP, NAT, Firewall, DPI, Load Balancing, etc.) (S302) and transmit the flow to the network function flow switch 124 ( S303).

The network function flow switch 124 analyzes the flow generated by the network function virtual machines 121 to 12n and extracts flow information (S304). Thereafter, the network function flow switch 124 checks whether the flow generated by the network function virtual machines 121 to 12n is a new flow or an existing flow through the extracted flow information (S305).

If the flow generated by the network function virtual machines 121 to 12n is a new flow, the network function flow switch 124 transfers the extracted flow information (new flow information) of the new flow to the network function agent 125 ( S306).

The network function agent 125 transmits new flow information to the flow control unit 130 (S307). The flow control unit 130 updates the switching table and the network function table of the flow control unit 130 by generating virtual flow information and network function information for the new flow based on the corresponding new flow information (S308), and stores the updated table. It is transmitted to the edge agent 105, the switch agent 112, and the network function agent 125 (S309).

The edge agent 105 updates the switching table of the edge flow switch 104 according to the switching table updated by the flow control unit 130 (S310). The switch agent 112 updates the switching table of the switch 111 according to the virtual machine switching table updated by the flow control unit 130 (S311). The network function agent 125 updates the switching table of the network function flow switch 124 according to the virtual machine switching table and the network function table updated by the flow control unit 130 (S312).

The network function flow switch 124 processes the data flow generated by the network function virtual machines 121 to 12n according to the switching table of the network function flow switch 124 (S313), and transmits it to the switch 110 or another network. It is transmitted to the functional machines 121 to 12n (S314).

The switch 110 analyzes the data flow received from the network function flow switch 124 and extracts flow information (S315). The flow switch 111 of the switch 110 uses the extracted flow information, and the network information of the virtual machine (the IP address of the virtual machine, the MAC address of the virtual machine, the NAT conversion information of the virtual machine, the virtual machine bandwidth information, etc.) , QOS information of virtual machine (real-time/non-real-time data, high/low bandwidth, delay sensitive/insensitive, data directionality (subscriber-server, server-server), etc.) and flow's QOS information (real-time/non-real-time data, high / Finds low bandwidth, delay sensitive/insensitive, secure/non-secure data service, data direction (subscriber-server, server-server, etc.) and decides QoS policy for the received flow based on this. Then, the flow switch 111 applies the determined QoS policy found to the received flow (S316).

Thereafter, the switch 110 switches the data flow transmitted through the network function flow switch 124 according to the switching table (S317). If network function virtualization is to be applied to the corresponding data flow, the data flow is switched to the network function server 120 according to the switching table. If network function virtualization is not applied to the data flow, the data flow is switched to the other server 100 according to the switching table.

The edge flow switch 104 of the server 100 is a virtual machine (101 to 10n) that can perform a virtual computing function according to the switching table of the edge flow switch 104, the data flow transmitted through the switch 110 Switch to (S318). Alternatively, the network function flow switch 124 of the network function server 120 is a network capable of performing a virtual network function according to the switching table of the network function flow switch 124 for the data flow transmitted through the switch 110 It is possible to switch to the functional virtual machines 121 to 12n.

Thereafter, the virtual machines 101 to 10n apply a virtual computing function to the data flow received from the edge flow switch 104 (S319). Then, the network function virtual machines 121 to 12n apply the virtual network function to the data flow received from the network function flow switch 124 (S320).

4 shows a network function virtualization system according to another embodiment of the present invention.

4, a network function virtualization system according to another embodiment of the present invention includes a plurality of virtual computing servers 410, a plurality of virtual network function servers 420, It includes a switch 430, a flow controller 440, and a network functions manager 450.

The plurality of virtual computing servers 410 are connected to the switch 430 through at least one network interface 480 and 481 through an L2 switch or an L3 switch or through an L2 switch and an L3 switch. In addition, the plurality of computing servers 410 are connected to the flow controller 440 through management and control interfaces 490 and 491. The switch 430 is connected to the flow controller 440 through a switch management and control interface 494.

The plurality of network function servers 420 are connected to the switch 430 through at least one network interface 482 and 483 through an L2 switch or an L3 switch or through an L2 switch and an L3 switch. In addition, the plurality of network function servers 420 are connected to the flow controller 440 through management and control interfaces 492 and 493.

The flow control unit 440 is a network function management unit 450 including a man-machine interface (MMI), a virtual machine manager or a cloud operating system (OS) through a management and control interface 495 Is connected with.

The plurality of virtual computing servers 410 includes a plurality of virtual machines 411, an edge flow switch 412, an edge agent 413 and a hypervisor 414.

The plurality of virtual machines 411 are OSs (LINUX, NetBSD, FreeBSD, Solaris, and Wondows) operating on logical hardware (virtual CPU, virtual memory, virtual storage, virtual network interface) provided by the hypervisor 414. The virtual machine 411 creates a data flow according to the services (web server, file server, video server, cloud server, corporate finance, finance, securities, etc.) provided by the virtual machine, and each data flow is It has different service QoS requirements.

The edge flow switch 412 analyzes the data flow generated by the plurality of virtual machines 411 and, if it is a new data flow, transfers it to the edge agent 413. If it is not a new data flow, the edge flow switch 412 processes the flow according to the switching table. The edge agent 413 connects with the flow controller 440 through the management and control interfaces 490 and 491 to update new flow information. At this time, the edge agent 413 periodically connects with the flow control unit 440 to update the switching table and virtual machine table information. The virtual machine table, which is periodically updated, includes network information for the virtual machine 411, QoS information of services provided by the virtual machine (real-time/non-real-time service, high bandwidth service, low bandwidth service, delay sensitive/insensitive service, service data). May include the direction of (subscriber-server or server-server), virtual machine bandwidth information, etc. The switching table that is updated periodically is network information about flow, operation information (forwarding, drop, edge agent delivery, field modification, tunneling, etc.), QoS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive). , Security/non-security data, and direction of service data (subscriber-server or server-server).

The hypervisor 414 provides logical hardware (virtual CPU, virtual memory, virtual storage, virtual network interface) virtualizing physical hardware (CPU, memory, storage, network interface, etc.) to the plurality of virtual machines 411. In addition, the hypervisor 414 directly performs the virtual machine management (create, change, remove, transfer, etc.) and server resource management functions according to the management command for the virtual machine 411 received from the flow control unit 440 Thus, the result is reported to the flow controller 440.

The network function server 420 includes a plurality of network function virtual machines 421, a network function flow switch 422, a network function agent 423, and a hypervisor 424.

The network function flow switch 422 receives the data flow from the switch 430 through at least one network interface 482 and 483 through the L2 switch or the L3 switch or through the L2 switch and the L3 switch. Thereafter, the network function flow switch 422 analyzes the data flow received from the switch 430 and extracts flow information. If the received data flow is a new data flow, the data flow is transmitted to the network function agent 423. If it is not a new flow, the flow is switched to the network function virtual machine 421 according to the network function switching table of the network function flow switch 422. In addition, the network function flow switch 422 analyzes the data flow received from the network function virtual machine 421 to extract flow information. If it is a new data flow, it is transmitted to the network function agent 423. However, if it is not a new flow, the data flow is switched to the switch 430 or another network function machine 421 according to the network function switching table of the network function flow switch 422.

At this time, the network function flow switch 422 adds the switching table used when detecting a new data flow to the switching table cache. The network function flow switch 422 deletes the corresponding switching table from the switching table cache at the end of the data flow. The network function flow switch 422 may use a switching table of the same other data flow stored in the switching table cache for the same data flow. When the network function virtual machines 421 create a new data flow, each data flow may have different QOS requirements according to the network function being performed.

The network function virtual machine 421 operates on logical hardware (virtual CPU, virtual memory, virtual storage, virtual network interface) provided by the hypervisor 424 (LINUX, NetBSD, FreeBSD, Solaris, Wondows, mini- This is a module that performs network functions (DHCP, NAT, Firewall, DPI, Load Balancing, etc.) in OS, micro-OS, etc. In an embodiment of the present invention, a plurality of network function virtual machines may be included in a plurality of network function servers, so that network functions may be applied in parallel to a flow. The network function virtual machines 421 receive and process the data flow from the network function flow switch 422 according to the network function (DHCP, NAT, Firewall, DPI, Load Balancing, etc.) to be performed, and then process the result as a network function agent ( It may be transmitted to the flow control unit 440 through 423. In addition, after processing the received data flow, the network function virtual machine 421 may generate a new data flow and transmit it to the network function flow switch 422.

The hypervisor 424 provides logical hardware (virtual CPU, virtual memory, virtual storage, virtual network interface) virtualizing physical hardware (CPU, memory, storage, network interface, etc.) to the network function virtual machine 421. In addition, the hypervisor 424 performs management (create, change, remove, transfer, etc.) and network function server resource management functions of the network function virtual machine in response to the management command for the network function virtual machine received from the flow control unit 440. It is performed directly and the result is reported to the flow control unit 440.

The network function agent 423 connects with the flow control unit 440 to update new flow information. The network function agent 423 periodically connects with the flow control unit 440 to update the switching table and the network function virtual machine table information. The network function virtual machine table, which is updated periodically, provides network information on the network function virtual machine, QoS information of the network function service provided by the network function virtual machine (real-time/non-real-time service, high bandwidth service, low bandwidth service, delay sensitive/ Insensitive services, direction of service data (subscriber-server or server-server), network function virtual machine bandwidth information, etc. may be included. The switching table that is updated periodically is network information about flow, operation information (forwarding, drop, edge agent delivery, field modification, tunneling, etc.), QoS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive). , Security/non-security data, and direction of service data (subscriber-server or server-server). The network function flow switch 422 can manage the QOS by processing the flow by discriminating the direction of service data (subscriber-server or server-server) among QoS information of each network function virtual machine 421. For example, when the service attribute of the corresponding network function virtual machine 421 is a server-server, a high priority is given to a flow whose data attribute is a server-server, and the service attribute of the corresponding network function virtual machine 421 is a subscriber. -In the case of a server, it is possible to provide an appropriate quality of service to service data by assigning a high priority to the subscriber-server flow with the data attribute. In addition, when the service attribute of the network function virtual machine 421 is a real-time service, a higher priority is given to a flow having a real-time QoS attribute among data flows of the network function virtual machine to provide better service quality to service data. have. In addition, when the service attribute of the network function virtual machine 421 is a delay sensitive service, a high priority is given to a flow having a delay sensitive QoS attribute among the data flows of the network function virtual machine, thereby providing an appropriate service quality for service data. can do.

The switch 430 is connected to the server 410 through at least one network interface 480 and 481 through an L2 switch or an L3 switch or through an L2 switch and an L3 switch. In addition, the switch 430 is connected to the flow controller 440 through a management and control interface 494. In addition, the switch agent 432 included in the switch 430 determines the virtual machine table and the switching table of the switch 430 based on the new flow information received from the flow controller 440 through the management and control interface 494. It is updated periodically. The virtual machine table, which is updated periodically, includes network information and QOS information (real-time/non-real-time service, high bandwidth service, low bandwidth service, delay sensitive/insensitive service, and direction of service data (subscriber-server or server-server)). ), virtual machine bandwidth information, etc.). The periodically updated switching table includes network information about flow, operation information (forwarding, drop, edge agent delivery, field modification, direction of service data (subscriber-server or server-server), etc.) and services provided by the virtual machine. QoS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive, direction of service data (subscriber-server or server-server), etc.) may be included.

The switch 430 receives the flow generated by the virtual machine 411 of the server 410 through at least one network interface 480 and 481 through the L2 switch or the L3 switch, or through the L2 switch and the L3 switch. Then, the switch 430 analyzes the data flow generated by the virtual machine 411 to extract flow information. And, the switch 430, the virtual machine network information (virtual machine IP address, virtual machine MAC address, virtual machine NAT translation information, virtual machine bandwidth information, etc.) and QoS information updated by the switch agent 425 QoS policy is applied to data flow based on (real-time/non-real-time data, high/low bandwidth, delay sensitive/insensitive, service data direction (subscriber-server, server-server), etc.). Since the switch 430 periodically updates QoS information for all flows in the switch as well as network information and QoS information for virtual machines included in the system, the service provided by the corresponding virtual machine Optimal QoS can be provided for each flow depending on the type. The switch 430 may manage QoS by processing a flow by discriminating the direction of service data (subscriber-server or server-server) among QoS information of each virtual machine. For example, if the service attribute of the virtual machine is server-server, the data attribute gives high priority to the server-server flow, and if the service attribute of the virtual machine is subscriber-server, the data attribute is subscriber-server. By giving high priority to in-flow, it is possible to provide optimal service quality to service data. In addition, when the service attribute of the corresponding virtual machine is a real-time service, a flow having a real-time QoS attribute among the data flows of the virtual machine is given a high priority to provide optimal service quality to service data. In addition, when the service attribute of the virtual machine is a delay-sensitive service, an optimal service quality can be provided to service data by giving a high priority to a flow having a delay-sensitive QoS attribute among data flows of the virtual machine.

The flow controller 440 may manage (create, change, remove, transfer, etc.) the virtual machine of the server 410 according to an MMI command of an administrator, a command of a virtual machine manager, or a command of a cloud OS. In addition, the flow controller 440 may transmit a command or a server resource management command to the hypervisor 414 of the server 410 through the management and control interfaces 490 and 491. The hypervisor 414 included in the server 410 directly performs management (create, change, remove, transfer, etc.) and server resource management functions of the corresponding virtual machine according to the corresponding command, and results information and virtual machine Information can be delivered to the flow control unit 440. The flow control unit 440 transmits result information about the command received from the hypervisor 414 back to the MMI, the cloud OS, and the virtual machine manager 450. In addition, the flow control unit 440 transmits a management (create, change, delete, transfer, etc.) command or a network function server resource management command of the network function virtual machine 421 of the network function server 420 to the administrator's MMI command, a network function management unit. It is transmitted to the hypervisor 424 included in the network function server 420 according to the command of 450 or the command of the cloud OS. The hypervisor 424 included in the network function server 420 directly performs the management (create, change, remove, transfer, etc.) of the network function virtual machine and the network function server resource management function according to the corresponding command, and the corresponding command The result information and the network function virtual machine information are transmitted to the flow controller 440. The flow control unit 440 transmits the result back to the MMI, the cloud OS, and the virtual machine manager 450. In addition, the flow control unit 440 transmits a flow management command and information to the edge agent 413 included in the server 410. The edge agent 413 directly performs a flow management function according to a corresponding command to update a switching table and a virtual machine table, and transmits result information about the command to the flow controller 440. In addition, the flow control unit 440 transmits the flow management command and information to the switch agent 432 included in the switch 430 through the switch management and control interface 494. The switch agent 432 directly performs a flow management function according to a corresponding command to update a switching table and a virtual machine table, and transmits result information about the command to the flow controller 440. The virtual machine table of the flow control unit 440 includes network information for each virtual machine and QoS information of services provided by the virtual machine (real-time/non-real-time service, high bandwidth service, low bandwidth service, delay sensitive/insensitive service, service data). May include the direction of (subscriber-server or server-server), virtual machine bandwidth information, etc. The switching table of the flow controller 440 includes network information for each flow, operation information (forwarding, drop, edge agent delivery, field modification, tunneling, etc.), QoS information (real-time/non-real-time data, high bandwidth, low bandwidth, and delay). This may include sensitive/insensitive, secure/non-secure data services, data directionality (subscriber-server or server-server, etc.). In addition, the flow control unit 440 is a management (create, change, remove, transfer, etc.) command of the network function virtual machine 421 of the network function server 420 according to the MMI command of the administrator and the command of the network function management unit 450 Alternatively, the network function server resource management command is transmitted to the hypervisor 424 included in the network function server 420 through the management and control interfaces 492 and 493. The hypervisor 424 included in the network function server 420 directly performs the management (create, change, remove, transfer, etc.) and network function resource management functions of the corresponding network function virtual machine according to the corresponding command. The result information and the network function virtual machine information are transmitted to the flow controller 440. In addition, the flow control unit 440 transmits the network function flow management command and information to the network function agent 423 included in the network function server 420 through the network function server management and control interfaces 492 and 493, and so on. The network function agent 4213 directly performs a network function flow management function according to a corresponding command to update a switching table and a virtual machine table, and transmits result information about the command to the flow controller 440.

5A to 5C are flowcharts illustrating a method of processing an ingress flow according to another embodiment of the present invention.

The network function management unit 450 including the administrator's MMI command, the virtual machine manager's command, or the cloud OS provides services through the server 410 (web server, mail server, file server, video server, cloud server, corporate finance, In order to provide finance, securities, etc.), a virtual machine 411 may be created, or the virtual machine 411 may be transferred to another server 410. In addition, the network function management unit 450 creates a network function virtual machine 421 to provide a virtual network function (DHCP, NAT, Firewall, DPI, Load Balancing, etc.) through the network function server 420 or Machine 421 can be transferred to another network function server.

The network function management unit 450 including the manager's MMI command, the virtual machine manager's command, or the cloud OS transmits network information for the virtual machine 411 and QoS information of the virtual machine to the flow control unit 440 ( S501).

In addition, the flow control unit 440 updates network information for the corresponding virtual machine 411 and QoS information of the virtual machine (S502). The edge agent 413 receives network information for the virtual machine 411 and QoS information of the virtual machine from the flow controller 440 through the management and control interfaces 490 and 491 (S503), and the edge flow switch 412 Is updated (S504). The switch agent 432 receives the updated network information on the virtual machine 411 and QoS information of the virtual machine from the flow control unit 440 through the management and control interface 494 (S505) and updates the switch 430 Do (S506).

The network function management unit 450 transfers network information about the network function virtual machine 421 and QoS information of the network function virtual machine 421 to the flow control unit 440 (S507).

Thereafter, the flow controller 440 updates network information and QoS information for the network function virtual machine 421 (S508). The network function agent 423 receives the network information and QoS information for the network function virtual machine 421 updated by the flow control unit 440 through the management and control interfaces 492 and 493 (S509), and The switch 422 is updated (S510). The switch agent 432 also receives the network information and QoS information for the network function virtual machine 421 updated by the flow control unit 440 through the management and control interface 494 (S511) to receive the switch 430. Update (S512).

The server 410 generates a flow according to the services (web server, mail server, file server, video server, cloud server, corporate finance, finance, securities, etc.) provided by the virtual machine 411 (S513) and edge flow It is transmitted to the switch 412 (S514).

The edge flow switch 412 analyzes the flow generated by the virtual machine 411 of the server 410 and extracts flow information (S515).

The edge flow switch 412 checks whether the flow generated by the virtual machine 411 is a new flow or an existing flow through the extracted flow information (S516).

If the flow is a new flow, the edge flow switch 412 delivers the extracted new flow information to the edge agent 413 (S517).

The edge agent 413 transmits the new flow information to the flow control unit 440 (S518). The flow control unit 440 updates the flow table (switching table and network function table) of the flow control unit 440 by generating virtual flow information and network function information for a corresponding new flow (S519).

The edge agent 413 updates the switching table in the edge flow switch 412 according to the flow table updated by the flow control unit 440 (S520 and S521). The switch agent 432 updates the switching table of the switch 430 according to the flow table updated by the flow control unit 440 (S522 and S523). The network function agent 423 updates the switching table of the edge flow switch 412 according to the flow table updated by the flow control unit 440 (S524 and S525).

The edge flow switch 412 processes the flow generated by the virtual machine 411 according to the switching table of the edge flow switch 412 (S526), and processes the processed flow through the L2 switch or the L3 switch, or through the L2 switch and the L3 switch. At least one of the network interfaces 480 and 481 is transmitted to the switch 430 through the switch (S527).

The switch 430 extracts flow information by analyzing the flow transmitted from the at least one network interface 480 and 481 through the L2 switch or the L3 switch or through the L2 switch and the L3 switch (S528). The switch 430 uses the extracted flow information from the switching table, the virtual machine's network information (the virtual machine's IP address, the virtual machine's MAC address, the virtual machine's NAT translation information, the virtual machine bandwidth information, etc.), the virtual machine QoS information (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive, service data direction (subscriber-server or server-server), etc.) and flow QoS information (real-time/non-real-time data, high bandwidth , Low bandwidth, delay sensitive/insensitive, secure/non-secure data service, data direction (subscriber-server or server-server), etc., and determine the QOS policy for the flow based on this. Then, the switch 430 applies the QoS policy determined for the corresponding flow (S529).

Thereafter, the switch 430 switches the data flow received from the server 410 according to the updated switching table (S530). If network function virtualization is to be performed for the corresponding data flow, the switch 430 may switch the data flow to the network function server 420 according to the switching table. If network function virtualization is not performed for the corresponding data flow, the switch 430 may switch the data flow to another server 410 according to the switching table.

The network function flow switch 422 of the network function server 420 checks the data attribute and the service attribute in the data flow received from the switch 430 (S531). Thereafter, the network function flow switch 422 switches to a network function virtual machine 421 capable of performing a virtual network function according to the switching table of the network function flow switch 422 based on the data attribute and service attribute of the data flow. Do (S532).

Thereafter, the network function virtual machine 421 may apply the virtual network function to the data flow received from the network function flow switch 422 (S533).

6A and 6B are flowcharts illustrating a method of processing an egress flow according to another embodiment of the present invention.

6A and 6B, first, the network function virtual machine 421 applies the virtual network function to the data flow received from the network function flow switch 422 (S601). In addition, the network function virtual machine 421 included in the network function server 420 flows according to the virtual network function (DHCP, NAT, Firewall, DPI, Load Balancing, etc.) operating in the network function virtual machine 421. It is generated (S602) and transmitted to the network function flow switch 422 (S603).

The network function flow switch 422 analyzes the flow generated by the network function virtual machine 421 included in the network function server 421 and extracts flow information (S604). The network function flow switch 422 checks whether the flow is a new flow or an existing flow through the extracted flow information (S605).

If the flow is a new flow, the network function flow switch 422 transmits the extracted new flow information to the network function agent 423 (S606). The network function agent 423 transmits the new flow information to the flow control unit 440 (S607), and the flow control unit 440 generates virtual flow information and network function information for the corresponding new flow. The flow table (switching table and network function table) is updated (S608).

The edge agent 413 updates the switching table of the edge flow switch 412 according to the flow table updated by the flow control unit 440 (S610). The switch agent 432 updates the switching table of the switch 430 according to the flow table updated by the flow control unit 440 (S611). The network function agent 423 updates the switching table of the network function flow switch 422 according to the flow table updated by the flow control unit 440 (S612).

The network function flow switch 422 processes the flow generated by the network function virtual machine 421 included in the network function server 421 according to the switching table of the network function flow switch 422. Thereafter, the network function flow switch 422 transfers the flow processed through the L2 switch or the L3 switch or through the L2 switch and the L3 switch to the switch 430 through at least one network interface 482 and 483 (S613, S614).

The switch 430 analyzes the flow transmitted from the at least one network interface 482 and 483 and extracts flow information (S615). The switch 430 uses the extracted flow information, and in the switching table, the network information of the virtual machine (the IP address of the virtual machine, the MAC address of the virtual machine, the NAT translation information of the virtual machine, the network function virtual machine bandwidth information, etc.) , QoS information of virtual machine (real-time/non-real-time data, high bandwidth, low bandwidth, delay sensitive/insensitive, service data directionality (subscriber-server or server-server), etc.) and QoS information of flow (real-time/non-real-time data) , High bandwidth, low bandwidth, delay sensitive/insensitive, secure/non-secure data service, data direction (subscriber-server or server-server), etc., and based on this, determine the QoS policy for the flow. Then, the switch 430 applies the QoS policy determined for the corresponding flow (S616).

Thereafter, the switch 430 switches the data flow received from the network function server 420 through the network function flow switch 422 according to the switching table (S617). If network function virtualization is to be applied to the corresponding data flow, the virtual network function server 421 is switched according to the switching table. If network function virtualization is not applied to the corresponding data flow, it switches to another server 410 according to the switching table.

The edge flow switch 412 of the server 410 switches the data flow received from the switch 404 to a virtual VM 411 capable of performing a virtual computing function according to the switching table of the edge flow switch 412. (S618). The network function flow switch 422 of the virtual network function server 420 is a virtual network function capable of performing a virtual network function according to the switching table of the network function flow switch 422 for the data flow received from the switch 430 Switching to the virtual machine 421 (S618).

The virtual machine 411 applies a virtual computing function to the data flow received from the edge flow switch 412 (S619). The network function virtual machine 421 applies the virtual network function to the data flow received from the network function flow switch 422 (S619). As described above, according to an embodiment of the present invention, the data attribute of the received flow And check the service property and switch the flow to the network function virtual machine according to the data property and service property, and apply the virtualized network function in parallel. In addition, QoS can be guaranteed according to the data attribute or service attribute of the flow. In addition, it is possible to update the switching table of the network function flow switch according to a single request or periodically based on the flow information of the flow.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (25)

delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete As a method for the server to process the ingress flow,
When the flow generated by the virtual machine in the server is a new flow, transmitting flow information of the new flow to a flow control unit,
Receiving a flow table updated by the flow controller based on the flow information,
Updating the switching table of the edge flow switch in the server according to the updated flow table, and
Delivering the new flow and the next flow to a switch connected through a first network interface according to an updated switching table so that the new flow and the next flow can be delivered to the network function server
Including,
The next flow is a flow generated by the virtual machine after a new flow is created, the new flow and the next flow are flows to which a network function virtualized by the network function server is applied, and the switch provides a second network interface. A method of processing an ingress flow, connected with the network function server through. As a method for a network function server to process an ingress flow,
When the flow generated by the server virtual machine in the server connected to the switch is a new flow, receiving a flow table updated by the flow control unit based on the flow information of the new flow,
Updating a switching table of a network function flow switch in the network function server according to the updated flow table,
Receiving the new flow and the next flow of the new flow generated by the server virtual machine from the switch, and
A network function virtual machine in the network function server to check the data attribute or service attribute of the new flow and the next flow, and determine the new flow and the next flow according to a switching table updated based on the data attribute or the service attribute. Switching to
A method for processing an ingress flow comprising a. In claim 22,
Applying, by the network function virtual machine, a virtualized network function to the new flow and the next flow
A method for processing an ingress flow further comprising. In clause 23,
The virtualized network function includes a virtualized dynamic host configuration protocol (DHCP), a virtualized network address translation (NAT), a virtualized firewall, and a virtualized deep packet inspection. inspection, DPI), or virtualized load balancing functions. As a method for a network function server to process an egress flow,
When the flow generated by the network function virtual machine in the network function server is a new flow, transmitting flow information of the new flow to a flow control unit,
Receiving a flow table updated by the flow controller based on the flow information,
Updating a switching table of a network function flow switch in the network function server according to the updated flow table, and
Delivering the new flow and the next flow to a switch connected through a second network interface according to an updated switching table so that the new flow and the next flow can be delivered to the server
Including,
The next flow is a flow generated by the virtual machine after a new flow is created, the new flow and the next flow are flows to which a virtualized network function is applied, and the switch is connected to the server through a first network interface. , How to handle egress flow.

Images