KR102343418B1 - Method and apparatus for controling traffic using open flow switches and controller - Google Patents

Abstract

The present specification discloses a network control device. The apparatus includes: a forwarding path request receiving unit for receiving a forwarding path request for data introduced into the network; a transmission path determining unit configured to determine a transmission path of the data according to characteristics of the received data; and a forwarding path providing unit that transfers the determined forwarding path to a switch in the network.

Description

Traffic control method and device using open flow switch and controller

The present specification relates to an open flow-based network controller device, and more particularly, to a method and apparatus for dynamically determining a flow transfer path according to flow characteristics based on an open flow technology.

Network technology has become part of a very important infrastructure for businesses, homes, and schools. However, from a developer's or researcher's point of view, such success has become an obstacle to the innovation of network technology.

In order to introduce a new service in the current network infrastructure, there are difficulties such as having to individually replace or upgrade different hardware and then pass a compatibility test, which made it difficult to innovate the network. In addition, it is very difficult for network users or researchers to develop and apply a new network protocol because each equipment manufacturer has different equipment operation methods and user interfaces. In order to overcome this problem, a switch or router technology having an open interface has been studied. However, network technologies providing such an open interface have difficulties in commercialization because they are expensive compared to their performance. Therefore, the open flow technology emerged to provide an open standard interface to users or developers while overcoming the high cost problem.

The OpenFlow technology separates the packet forwarding function and the control function of a network switch (or router) and provides a protocol for communication between these two functions. This enabled software driven by an external controller (server) to route packets within the switch regardless of the equipment vendor. This packet forwarding and separation of control domains enable more precise traffic management than ACLs or routing protocols used in existing network devices. Therefore, open flow technology has emerged as a future Internet technology that can develop new networking technology by changing the existing closed networking technology into an open networking technology.

On the other hand, the need to use this open flow technology is also emerging in mobile communication networks where user data traffic is increasing day by day, and in particular, a method of transferring data traffic between nodes of the network by reflecting the characteristics of data flow is requested.

The present specification proposes a method and apparatus for dynamically determining a data (or flow) transmission path according to data (or flow) characteristics based on open flow technology. In more detail, data (or flows) are classified according to the types of applications and services, and the degree of harm/harmlessness of the data (or flows), characteristics of the flow sender and receiver (eg, age group, gender, usage plan, current status, etc.) A method and apparatus for dynamically determining a data (or flow) transmission path according to 'data (or flow) characteristics' such as characteristics or service providers) are proposed.

According to an embodiment of the present specification, a network control apparatus is disclosed. The apparatus includes: a forwarding path request receiving unit for receiving a forwarding path request for data introduced into the network; a transmission path determining unit configured to determine a transmission path of the data according to characteristics of the received data; and a forwarding path providing unit that transfers the determined forwarding path to a switch in the network.

When a transmission path according to the characteristics of the data is not previously designated, the transmission path determining unit may determine a transmission path through the packet inspection device as the data transmission path.

The transmission path determining unit may determine a transmission path passing through the intrusion detection device as the data transmission path when the inflow amount of the data is greater than or equal to a preset standard.

The transmission path determining unit may analyze the received data to determine a customer type and service type of the data, and determine a data transmission path to correspond to the customer type and service type.

The forwarding path determining unit analyzes the incoming data to determine the user of the data and the type of rate plan subscribed to by the user, and when the amount of traffic used by the user exceeds a preset allowable amount of traffic according to the type of the rate plan, the traffic A transmission path through the control device may be determined as the transmission path of the data.

According to another embodiment of the present specification, a network control method is disclosed. The method includes the steps of: receiving a request for a forwarding path for incoming data into a network; determining a transmission path of the data according to characteristics of the received data; and transferring the determined transfer path to a switch in the network.

The determining of the transmission path may include determining a transmission path passing through the packet inspection apparatus as the data transmission path when a transmission path according to the characteristics of the data is not previously specified.

The determining of the transmission path may be a step of determining a transmission path passing through the intrusion detection device as the data transmission path when the amount of the data inflow is equal to or greater than a preset standard.

The determining of the forwarding path includes analyzing the incoming data to identify a user of the data and a rate plan type to which the user subscribes, and the amount of traffic used by the user exceeds a preset allowable amount of traffic according to the type of rate plan In one case, it may be a step of determining a transmission path through the traffic control device as the transmission path of the data.

The embodiments of the present specification have the effect of analyzing the characteristics of data (or flow) flowing into the network and dynamically controlling the data transmission path and processing method accordingly. In particular, there is an effect of performing dynamic data (or flow) control reflecting the characteristics of users and/or services.

1 is a diagram illustrating an example of an OpenFlow network to which an embodiment of the present specification can be applied.
2 is a diagram illustrating a data transfer control method according to an embodiment of the present specification.
3 is a block diagram of an apparatus for controlling a network according to an embodiment of the present specification.

It should be noted that the technical terms used herein are used only to describe specific embodiments, and are not intended to limit the present invention. In addition, the technical terms used in this specification should be interpreted as meanings generally understood by those of ordinary skill in the art to which the present invention belongs, unless otherwise specifically defined in this specification, and excessively inclusive It should not be construed in the meaning of a human being or in an excessively reduced meaning. In addition, when the technical terms used in the present specification are incorrect technical terms that do not accurately express the spirit of the present invention, they should be understood by being replaced with technical terms that can be correctly understood by those skilled in the art. In addition, the general terms used in the present invention should be interpreted according to the definition in the dictionary or according to the context before and after, and should not be interpreted in an excessively reduced meaning.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings, but the same or similar components are assigned the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. In addition, in the description of the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, it should be noted that the accompanying drawings are only for easy understanding of the spirit of the present invention, and should not be construed as limiting the spirit of the present invention by the accompanying drawings. The spirit of the present invention should be interpreted as extending to all changes, equivalents or substitutes other than the accompanying drawings.

1 is a diagram illustrating an example of an OpenFlow network to which an embodiment of the present specification can be applied.

Openflow technology provides openness to easily control heterogeneous switches and routers. In a broader category, open flow technology is called SDN (Software Defined Networking) technology. SDN is a technology that evolves the existing H/W-centered static/closed networking technology into S/W-centered technology that is easy to innovate and expand. It can be called a networking paradigm. In summary, SDN is a concept to centrally control/manage the network traffic forwarding operation after separating the control function from the current switch/router method in which the hardware-based data forwarding function and the software control function are closely connected. Open Flow is a technology that implements the interface between the controller server and the switch/router in SDN, and is defined by ONF (Open Networking Foundation). ONF created a functional model similar to that of a computer system in which a networking system consists of hardware, an operating system, and applications. In other words, the network is compared to a computer system, and OpenFlow is defined as an interface that connects hardware (switch) and Network OS. ONF introduced the concept of abstraction to create such a model and is trying to move the center of networking technology from hardware to software.

The open flow network of the present specification may be configured to include the open flow switches 10a to 10e and the controller 100 .

OpenFlow is a Software Defined Networking (SDN) technology that implements and/or controls the main network functions through a centralized controller instead of significantly reducing the functions of network nodes (switches, routers, etc.), providing a flexible and efficient network It has advantages such as management and rapid introduction of new network technologies.

The OpenFlow switches 10a to 10e have a flow table, and each entry of the flow table describes how the OpenFlow switch will process a flow that meets a specific rule. do. In addition, statistics on the flow of the corresponding condition may be stored together.

Here, the flow is the switch port (port), VLAN ID, sender MAC address, receiver MAC address, Ethernet Type, sender IP address, receiver IP address, IP protocol type, sender port (port), receiver port (port) It can be distinguished through a discriminator including the like. The network operator may define a rule for treating specific flows as the same flow or different flows by using the identifier.

In addition, the network operator uses a separate device (eg, a controller) to determine which service (or application) data the flow is, what type of customer flows, harmful/harmless flows, and which service providers transmit and receive data. It is also possible to determine high-level context information such as recognition.

The controller 100 may inject specific flow conditions and processing instructions (Rule/Action) into the OpenFlow switches 10a to 10e to control which path a specific flow is transmitted.

Examples of the flow conditions and processing guidelines (Rule/Action) are shown in Table 1 below.

Condition (Rule) Handling Instructions (Action) note One Flow to MAC address A forward to switch a Switching (Layer 2) 2 Flow to IP address B forwarded to switch b IP Routing (Layer 3) 3 TCP port 80 (http) Drop Firewall

When new data (or flow) is introduced into the network (①), the ingress switch 10a of the network requests a processing/delivery path for the data (or flow) to the network controller (or controller) ( ②). In this case, the ingress switch may transmit the request to the network controller 100 using the OpenFlow protocol, and the request includes a sender IP address and port, a receiver IP address and port of the corresponding data (or flow). (port) and information on a transport protocol may be included, and additional information may be further included if necessary.

The network controller 100 receiving the request for the transmission path determines the transmission path of the data according to the characteristics of the received data (or flow). In this case, the controller 100 may determine a transmission path for the incoming data by searching for a transmission path for each predefined data (or flow). The transmission path of data (or flow) may be determined as, for example, “incoming switch -> switch 2 -> switch 4” when the data is transmitted from Seoul to Busan.

On the other hand, when the data (or flow) is the first data to enter the network (that is, when a transmission path according to the characteristics of the data is not specified in advance), the data (or flow) is transmitted to the packet inspection device ( 200), it is possible to determine the delivery path of the flow so that the harmfulness check is performed (④). In this case, the intrusion detection device 200 may be a deep packet inspection (DPI).

In addition, the network controller 100 may analyze the incoming data (or flow) to determine the customer type and service type of the data, and determine the data transmission path to correspond to the customer type and service type. . For example, a user who has transmitted the corresponding data (or flow) may determine a different delivery path of the corresponding data according to a subscription plan. That is, data to be transmitted or received may be delivered to each user who subscribes to an unlimited data plan and a user who subscribes to a certain data usage plan through different paths. As an embodiment, when a user who transmits (or receives) the data subscribes to an unlimited data plan, the user may have a relatively large amount of data, so the data delivery path is set to the path with the least amount of traffic, It is possible to minimize the influence of the user's data use on other users.

As another embodiment, in the case of data (or flow) transmitted (or received) by a user subscribing to a specific data usage plan, the network controller 100 determines the amount of traffic used by the user according to the type of the plan. If the set traffic allowance is exceeded, the data transfer path is determined so that the data passes through a traffic conditioning unit (eg, a gating/shaping unit), so that the data transfer rate is changed (eg, reduced to 100 kbps or less) can This may be a means to warn the user of the occurrence of excessive charges. In this case, the traffic control device may be a gating/shaping unit.

In addition, in the case of a user subscribed to a specific rate plan, the controller 100 may determine a delivery path to transmit different QoS (bandwidth, delay, loss, etc.) for specific data (eg, mVoIP).

In addition, when the network load of a specific base station is heavy, the controller 100 performs a video optimization device (Video Trans-rating/Trans-coding) for specific data (eg, high-definition video traffic) of a user subscribed to a specific rate plan. The forwarding path can be modified to go through the traffic optimization device.

The controller 100 transmits the determined transfer path to all switches in the network.

The switches deliver the packets of the corresponding data to the destination according to the transmission path of the corresponding data (or flow). At this time, each switch may collect statistics (number of packets, traffic volume) on “Rule/Action” and report it to the network controller 100 . At this time, when the number of packets/traffic amount for a specific data (or flow) increases rapidly, the network control device 100 controls the transmission path so that the corresponding data (or flow) is subjected to a harmfulness check through the intrusion detection device 200 . It can be dynamically modified (④) In this case, the intrusion detection device 200 may be an Intrusion Detection System (IDS).

When it is determined that harmful traffic has been introduced as a result of the harmfulness check, the network controller 100 may block the corresponding traffic by injecting data (or flow) conditions and processing guidelines (Rule/Action) into the incoming switch.

Data (or flow) conditions and processing instructions (Rule/Action) input to the network controller 100 may be input on-demand by a network manager.

3 is a block diagram of an apparatus for controlling a network according to an embodiment of the present specification.

The network controller 100 controls a switch in a network, and may perform the methods described above with reference to FIGS. 1 and 2 . The network controller may be an open flow controller device, wherein the network includes an open flow network attribute.

The network control apparatus 100 may include a transmission path request receiving unit 101 , a transmission path determining unit 102 , and a transmission path providing unit 103 .

The delivery route request receiving unit 101 receives a delivery route request for data (or flow) introduced into the network. The forwarding path request may be transmitted from an ingress switch, and may include information on a sender IP address and port, a receiver IP address and port, and transmission protocol of the corresponding data.

The transmission path determining unit 102 determines a transmission path of the data according to the characteristics of the received data. In this case, the transfer path determining unit 102 may determine the transfer path for the incoming flow by searching for a predefined transfer path for each data. As an example, when the data is transmitted from Seoul to Busan, the data transmission path may be determined as “incoming switch -> switch 2 -> switch 4”.

On the other hand, when the data is the first data to enter the network (that is, when a transmission path according to the characteristics of the data is not specified in advance), the transmission path determining unit 102 determines that the data is harmful through a packet inspection device. A delivery path of the data may be determined so that the inspection is performed. In this case, the packet inspection apparatus may be a deep packet inspection (DPI).

In addition, the transmission path determining unit 102 may analyze the incoming data to determine the customer type and service type of the data, and determine the data transmission path to correspond to the customer type and service type. For example, a user who has transmitted the corresponding data may determine a different transmission path of the corresponding data according to a subscription plan. That is, data data to be transmitted or received may be delivered to each of a user who subscribes to an unlimited data plan and a user who subscribes to a certain data usage plan through different paths. In addition, in the case of a user subscribed to a specific rate plan, the delivery route determining unit 102 may determine the delivery route to transmit with different QoS (bandwidth, delay, loss, etc.) for specific data (eg, mVoIP). In addition, when the network load of a specific base station is heavy, the transmission path determining unit 102 performs a video trans-rating/trans-coding for specific data (eg, high-definition video traffic) of a user subscribed to a specific rate plan. Alternatively, the forwarding path may be modified to go through other traffic optimization devices.

When the number of packets/traffic amount for specific data rapidly increases, the transmission path determining unit 102 may dynamically modify the transmission path so that a harmfulness check is performed via an intrusion detection device for the corresponding data. In this case, the intrusion detection device may be an Intrusion Detection System (IDS).

When it is determined that harmful traffic has been introduced as a result of the harmfulness check, the forwarding path determining unit 102 may block the corresponding traffic by injecting data conditions and processing guidelines (Rule/Action) into the incoming switch.

The forwarding path providing unit 103 transfers the forwarding path determined by the forwarding path determining unit 102 to all switches in the network.

The network controller 100 may further include a manager interface unit, and may receive data conditions and processing instructions (Rule/Action) from the network manager through the manager interface unit.

As mentioned above, although embodiments of the present invention have been described, those of ordinary skill in the art may add, change, delete or add components within the scope that does not depart from the spirit of the present invention described in the claims. Various modifications and changes of the present invention will be possible by this, and this will also be included within the scope of the present invention.

10a to 10e: Open Flow Switch
100: network control device
200: packet inspection device/intrusion detection device

Claims (7)

a transmission path request receiving unit for receiving a transmission path request for data introduced into the network;
a transmission path determining unit for determining whether the inflow of the data is equal to or greater than a preset standard, and determining a transmission path through the intrusion detection device as the data transmission path if the amount is greater than or equal to the preset criterion;
and a forwarding path providing unit that transfers the determined forwarding path to a switch in the network. a transmission path request receiving unit for receiving a transmission path request for data introduced into the network;
a transmission path determining unit for identifying a customer type and service type of the data, and determining a transmission path of the data according to the identified customer type and service type;
and a forwarding path providing unit that transfers the determined forwarding path to a switch in the network. 3. The method of claim 1 or 2,
The forwarding path determining unit analyzes the incoming data to determine the user of the data and the type of rate plan subscribed to by the user, and when the amount of traffic used by the user exceeds a preset allowable amount of traffic according to the type of the rate plan, traffic A network control device, characterized in that determining a transmission path through the control device as the data transmission path. delete Receiving a forwarding path request for data coming into the network;
determining whether the amount of inflow of the data is equal to or greater than a preset standard, and if it is equal to or greater than the preset standard, determining a transfer path through an intrusion detection device as the data transfer path;
and transferring the determined forwarding path to a switch in the network. Receiving a forwarding path request for data coming into the network;
identifying a customer type and service type of the data, and determining a transmission path of the data according to the identified customer type and service type;
and transferring the determined forwarding path to a switch in the network. 7. The method of claim 6,
The determining of the forwarding path includes analyzing the incoming data to identify a user of the data and a rate plan type to which the user has subscribed, and the amount of traffic used by the user exceeds a preset allowable amount of traffic according to the type of rate plan In one case, the network control method comprising the step of determining a transmission path through a traffic control device as the transmission path of the data.

Images