WO2015136585A1

WO2015136585A1 - Control apparatus, control method and control program

Info

Publication number: WO2015136585A1
Application number: PCT/JP2014/006207
Authority: WO
Inventors: 暢彦伊藤; 淳西岡
Original assignee: 日本電気株式会社
Priority date: 2014-03-14
Filing date: 2014-12-12
Publication date: 2015-09-17
Also published as: JPWO2015136585A1

Abstract

Provided is a control apparatus for enabling reduction of the number of processing rules that are to be stored by a packet processing apparatus. A flow identification information creation means (91) creates flow identification information to be used for identifying a flow. A processing rule creation means (92) determines a processing method for packets of the flow and creates a processing rule including the flow identification information and the processing method. When the processing rule of the flow and the processing rule of another flow can be aggregated, the aggregation means (93) aggregates the processing rule of the flow and the processing rule of the other flow.

Description

Control device, control method, and control program

The present invention relates to a control device, a control method, and a control program for controlling a packet processing device that processes packets.

A technique called OpenFlow has been proposed (see Non-Patent Document 1). OpenFlow captures communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis. An OpenFlow switch that functions as a packet processing device includes a secure channel with an OpenFlow controller that is positioned as a path control device. The OpenFlow switch operates in accordance with a flow entry that is appropriately added or rewritten by the OpenFlow controller. The flow entry is information defining processing for a packet for each flow. A table in the OpenFlow switch that stores flow entries is called a flow table.

When the network scale increases, the number of flow entries in the flow table increases. However, the number of flow entries that the packet processing apparatus can hold is limited.

A set of identification information for identifying a flow and a processing method for a packet of a flow that matches the identification information is referred to as a processing rule. The flow entry in the open flow also corresponds to the processing rule.

An object of the present invention is to provide a control device, a control method, and a control program that can reduce the number of processing rules stored in a packet processing device.

A control device according to the present invention is a control device that controls a packet processing device that processes a packet, and defines flow identification information creating means for creating flow identification information for identifying a flow, and a processing method for a packet of the flow. When the processing rule creation means for creating the processing rule including the flow identification information and the processing method, the processing rule of the flow, and the processing rule of the other flow can be aggregated, the processing rule of the flow and the other flow And a notifying means for notifying the packet processing apparatus of the processing rule.

The control method according to the present invention is a control method for controlling a packet processing apparatus that processes a packet. The control method creates flow identification information for identifying a flow, defines a processing method for the packet of the flow, and sets the flow identification information. If the processing rule of the flow and the processing rule of the other flow can be aggregated, the processing rule of the flow and the processing rule of the other flow are aggregated and processed. The rule is notified to the packet processing device.

A control program according to the present invention is a control program installed in a computer that controls a packet processing apparatus that processes packets, and a flow identification information creation process for creating flow identification information for identifying a flow in the computer. If a processing rule creation process that defines a processing method for a flow packet and creates a processing rule including flow identification information and a processing method, and the processing rule of the flow and the processing rule of another flow can be aggregated, the flow And a notification processing for notifying the packet processing device of the processing rule.

According to the present invention, the number of processing rules stored in the packet processing device can be reduced.

It is a block diagram which shows the example of the control apparatus of this invention. It is a schematic diagram which shows a process rule. It is a schematic diagram which shows the example of a flow. It is a flowchart which shows the example of process progress of a control apparatus. It is a schematic diagram which shows the process rule registered into a management DB memory | storage part. It is a schematic diagram which shows the process rule registered into a management DB memory | storage part. It is a block diagram which shows the example of a packet processing apparatus. It is a schematic diagram which shows the example of the packet processing apparatus controlled by the control apparatus. It is a flowchart which shows the example of a process progress of the determination process whether the processing rule which aggregated the processing rule of several flows can be produced. It is explanatory drawing which shows the process rule registered into a management DB memory | storage part. It is explanatory drawing which shows the process rule registered into a management DB memory | storage part. It is explanatory drawing which shows the process rule registered into a management DB memory | storage part. It is a schematic diagram which shows the example of the packet processing apparatus controlled by the control apparatus. It is explanatory drawing which shows the process rule registered into a management DB memory | storage part. It is explanatory drawing which shows the process rule registered into a management DB memory | storage part. It is explanatory drawing which shows the process rule registered into a management DB memory | storage part. It is a block diagram which shows the outline | summary of the control apparatus of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. Each embodiment shown below is an illustration, and the present invention is not limited to each embodiment.

Embodiment 1. FIG.
FIG. 1 is a block diagram showing an example of a control device of the present invention. The control device 1 of the present invention includes a control unit 10, a processing rule granularity determination unit 11, and a management database (hereinafter simply referred to as DB) storage unit 12.

The control device 1 controls a packet processing device (not shown in FIG. 1) that processes packets. There are a plurality of packet processing devices, and a network is formed by the plurality of packet processing devices. The control device 1 controls the packet processing device by notifying the packet processing device of the processing rule.

FIG. 2 is a schematic diagram showing processing rules. As already described, the processing rule is a set of identification information for identifying a flow (hereinafter referred to as an identification rule) and a processing method for a packet of a flow that matches the identification rule (see FIG. 2). ). When receiving a packet, the packet processing device searches for a processing rule corresponding to the flow of the packet. If the processing rule cannot be searched, the packet processing device inquires of the control device 1 about the processing rule. Upon receiving this inquiry, the control device 1 notifies the processing rule to each packet processing device to which the packet is to be transferred. As a result, the packets are sequentially transferred by the packet processing device.

The protocol by which the control device 1 controls the packet processing device may be an open flow protocol. In that case, the processing rule corresponds to the flow entry in the open flow. Further, the protocol for controlling the packet processing device by the control device 1 may be other than the open flow protocol.

The control unit 10 receives a processing rule inquiry from the packet processing device.

The processing rule granularity determination unit 11 determines the granularity of the processing rule in response to the processing rule inquiry from the packet processing device, and notifies the packet processing device of the processing rule of the granularity. A control policy is input to the processing rule granularity determination unit 11. The control policy is information that defines a packet processing method for each flow in each packet processing device through which the flow passes. The processing rule granularity determination unit 11 determines a packet processing method in each packet processing device through which the flow passes according to the control policy. If one packet processing apparatus has the same processing method and processing rules corresponding to different flows, the processing rules corresponding to these flows are set to 1 corresponding to the plurality of flows. It aggregates into one processing rule (in other words, it summarizes). In this embodiment, the case where a control policy is input from the outside is described as an example. However, the control device 1 may hold the control policy inside.

The management DB storage unit 12 is a storage device that stores processing rules to be notified to the packet processing device. The processing rules stored in the management DB storage unit 12 can be updated when a new processing rule query is generated from the packet processing device.

The control unit 10 and the processing rule granularity determination unit 11 are realized by, for example, a CPU of a computer that operates according to a control program. In this case, the CPU is, for example, from a program recording medium such as a program storage device (not shown) of the computer. What is necessary is just to read a control program and operate | move as the control part 10 and the process rule granularity determination part 11 according to the control program. In addition, the control unit 10 and the processing rule granularity determination unit 11 may be realized by separate hardware.

FIG. 3 is a schematic diagram showing an example of a flow. Hereinafter, a case where there are three

packet processing apparatuses

2a, 2b, and 2c will be described as an example. When the

packet processing devices

2a, 2b, and 2c are not particularly distinguished, they are simply referred to as “packet processing device 2”. The number of packet processing devices 2 is not limited to three. FIG. 3 illustrates the case where the three flows A to C pass through the

packet processing devices

2a, 2b, and 2c, respectively. It is assumed that the same processing method is defined in the control policy as the processing method for the flow A packet and the processing method for the flow C packet. Hereinafter, this processing method is referred to as processing method (1). Further, it is assumed that the processing method (2) is defined in the control policy as a processing method for the packet of the flow B. In the example shown in FIG. 3, it is assumed that flows occur in the order of flow A, flow B, and flow C.

FIG. 4 is a flowchart showing an example of processing progress of the control device 1. When the packet processing device 2a receives the packet of the flow A, the packet processing device 2a searches for the processing rule corresponding to the flow A from the processing rules stored in the packet processing device 2a. When the processing rule corresponding to the flow A is not stored, the packet processing device 2a transmits a processing rule inquiry (in this example, a processing method inquiry for the packet of the flow A) to the control device 1. At this time, the packet processing device 2a also transmits the packet (in this example, the packet of the flow A) to the control device 1. The control unit 10 of the control device 1 receives the processing rule inquiry and the packet (step S51). Then, the processing rule granularity determination unit 11 creates an identification rule for identifying the flow A based on the packet (step S52). For example, the processing rule granularity determination unit 11 creates an identification rule by combining the header field information of the received packet.

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow A for each packet processing device through which the flow A passes based on the control policy. The processing rule for each packet processing device through which the flow A passes is determined by this processing method and the identification rule created in step SS52. Then, the processing rule granularity determination unit 11 determines whether it is possible to create a processing rule in which processing rules corresponding to this flow A and processing rules corresponding to other flows can be created (step S53). If the control policy of a plurality of flows is the same, the processing rule granularity determination unit 11 determines that a processing rule in which the processing rules of the plurality of flows are aggregated can be created. More specifically, the processing rule granularity determination unit 11 aggregates processing rules corresponding to a plurality of flows when the processing method is the same and there are processing rules corresponding to different flows. The processing rules corresponding to different flows are aggregated into one processing rule. The processing rule granularity determination unit 11 performs this determination for each packet processing device 2. In this example, since only the processing rule for the flow A is created, the processing rule granularity determination unit 11 determines that the processing rules corresponding to a plurality of flows cannot be aggregated into one processing rule.

After step S53, the processing rule granularity determination unit 11 registers the processing rule obtained in step S53 in the management DB storage unit 12 (step S54). In this example, the processing rule for the flow A obtained for each packet processing device through which the flow A passes is registered in the management DB storage unit 12.

Next, the processing rule granularity determination unit 11 determines each processing rule for each packet processing device 2 registered in step S54 (in this example, the processing rule for the flow A obtained for each packet processing device through which the flow A passes). And notifies the corresponding packet processing device 2 (step S55).

Next, it is assumed that the flow B occurs and the packet processing device 2a receives the flow B packet. Then, the packet processing device 2a does not store the processing rule corresponding to the flow B, and transmits a processing rule inquiry (in this example, a processing method inquiry for the packet of the flow B) to the control device 1. Shall. At this time, the packet processing device 2a also transmits the packet (in this example, the packet of the flow B) to the control device 1. The control device 1 receives this inquiry and performs the operation shown in FIG.

That is, the control unit 10 of the control device 1 receives the processing rule inquiry and the packet (step S51). Then, the processing rule granularity determination unit 11 creates an identification rule for identifying the flow B based on the packet (step S52).

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow B for each packet processing device through which the flow B passes based on the control policy. With this processing method and the identification rule created in step SS52, the processing rule for each packet processing device through which the flow B passes is determined. Then, the processing rule granularity determination unit 11 determines whether it is possible to create a processing rule in which the processing rules of this flow B and the processing rules of other flows are aggregated (step S53). At this time, the processing rule corresponding to the flow A is stored in the management DB storage unit 12, but the processing method (1) for the flow A packet is different from the processing method (2) for the flow B packet. Therefore, the processing rule granularity determination unit 11 determines that each processing rule corresponding to the plurality of flows A and B cannot be integrated into one processing rule in each packet processing device 2.

After step S53, the processing rule granularity determination unit 11 registers the processing rule obtained in step S53 in the management DB storage unit 12 (step S54). In this example, the processing rule for the flow B obtained for each packet processing device through which the flow B passes is registered in the management DB storage unit 12. FIG. 5 is a schematic diagram showing processing rules registered in the management DB storage unit 12 at this point. At this point, the processing rules corresponding to the flow A and the processing rules corresponding to the flow B are registered in the management DB storage unit 12 as the processing rules in each of the

packet processing devices

2a, 2b, and 2c. In the example shown in FIG. 5, “processing method (1)” and “processing method (2)” are shown, but the specific contents of processing method (1) are different for each packet processing device 2. May be. The same applies to the processing method (2).

Next, the processing rule granularity determination unit 11 determines each processing rule registered in step S54 for each packet processing device 2 (in this example, the processing rule for the flow B obtained for each packet processing device through which the flow B passes). And notifies the corresponding packet processing device 2 (step S55).

Next, it is assumed that the flow C occurs and the packet processing device 2a receives the packet of the flow C. The packet processing device 2a does not store the processing rule corresponding to the flow C, and transmits a processing rule inquiry (in this example, a processing method inquiry for the packet of the flow C) to the control device 1. Shall. At this time, the packet processing device 2 a also transmits the packet (in this example, the packet of the flow C) to the control device 1. The control device 1 receives this inquiry and performs the operation shown in FIG. As described above, the processing method for the flow A packet and the processing method for the flow C packet are the same.

The control unit 10 of the control device 1 receives the processing rule inquiry and the packet (step S51). Then, the processing rule granularity determination unit 11 creates an identification rule for identifying the flow C based on the packet (step S52).

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow C for each packet processing device through which the flow C passes based on the control policy. With this processing method and the identification rule created in step SS52, the processing rule for each packet processing device through which the flow C passes is determined. Then, the processing rule granularity determination unit 11 determines whether it is possible to create a processing rule in which the processing rules of the flow C and the processing rules of other flows are aggregated (step S53). If the processing method is the same and there are processing rules corresponding to different flows, the processing rule granularity determination unit 11 determines that the processing rules of the plurality of flows can be aggregated, and the different flows Are integrated into one processing rule. For example, in the processing rule corresponding to the flow C in the packet processing device 2a and the processing rule corresponding to the flow A in the packet processing device 2a, the processing method is the same as “processing method (1)”. Therefore, the processing rule granularity determination unit 11 determines that the processing rule corresponding to the flow C in the packet processing device 2a and the processing rule corresponding to the flow A in the packet processing device 2a can be integrated into one, and the two Combine processing rules into one. Specifically, the processing rule granularity determination unit 11 determines an identification rule (in other words, an identification rule that matches each of the plurality of flows) that includes a plurality of flows (in this example, flows A and C), and identifies them. A set of rules and the same processing method may be defined for the plurality of flows. Here, the packet processing device 2a has been described as an example, but the same applies to the other

packet processing devices

2b and 2c.

After step S53, the processing rule granularity determination unit 11 registers the processing rule obtained in step S53 in the management DB storage unit 12 (step S54). When a processing rule in which a plurality of processing rules are integrated into one is determined, the processing rule granularity determination unit 11 registers the processing rule in the management DB storage unit 12. In addition, the processing rule granularity determination unit 11 deletes the existing processing rule (in this example, the processing rule of the flow A) that is aggregated into one processing rule from the management DB storage unit 12.

FIG. 6 is a schematic diagram showing processing rules registered in the management DB storage unit 12 at this point. In the processing rules in each of the packet processing devices 2a to 2c, the processing rules corresponding to the flow A and the processing rules corresponding to the flow C are aggregated into one processing rule, and the processing rules corresponding to the existing flow A shown in FIG. Has been deleted.

Next, the processing rule granularity determination unit 11 notifies the corresponding packet processing device 2 of the processing rules for each packet processing device 2 registered in step S54 (in this example, processing rules corresponding to flows A and C). (Step S55). In addition, when the processing rule to be notified is an aggregation of processing rules corresponding to a plurality of flows, the processing rule granularity determination unit 11 deletes an existing processing rule corresponding to the aggregated flow. Is also transmitted to the packet processing apparatus 2. In this example, the processing rule granularity determination unit 11 also transmits a notification to delete the existing processing rule corresponding to the flow A in step S55.

As a result, the

packet processing devices

2a, 2b, and 2c do not need to store the processing rules corresponding to the flow A and the processing rules corresponding to the flow C separately, and store the processing rules corresponding to the flows A and C. To do. Therefore, the number of processing rules stored in the packet processing device 2 can be reduced.

FIG. 7 is a block diagram illustrating an example of the packet processing device 2. The packet processing device 2 includes a processing rule setting unit 20, a storage unit 21, and a packet processing unit 22.

The storage unit 21 is a storage device that stores processing rules.

The processing rule setting unit 20 stores the processing rule notified from the control device 1 in the storage unit 21. When the processing rule setting unit 20 receives an instruction to delete the processing rule from the control device 1, the processing rule setting unit 20 deletes the processing rule designated to be deleted by the control device 1 from the storage unit 21.

When the packet processing unit 22 receives the packet, the packet processing unit 22 searches the processing rule stored in the storage unit 21 for a processing rule having an identification rule corresponding to the received packet. When a processing rule having an identification rule corresponding to the received packet can be retrieved, the packet processing unit 22 processes the received packet according to the processing method defined by the processing rule. When the processing rule having the identification rule corresponding to the received packet cannot be retrieved (that is, when the processing rule is not stored in the storage unit 21), the packet processing unit 22 processes the received packet together with the received packet. Send a rule query. As a result, the control device 1 performs the operations after step S51 described above.

The processing rule setting unit 20 and the packet processing unit 22 are realized by, for example, a CPU of a computer that operates according to a packet processing device program. In this case, for example, the CPU may read the packet processing device program from a program recording medium such as a computer program storage device (not shown) and operate as the processing rule setting unit 20 and the packet processing unit 22 according to the program. . Further, the processing rule setting unit 20 and the packet processing unit 22 may be realized by separate hardware.

Next, the operation of the control device 1 will be described using a specific example. FIG. 8 is a schematic diagram illustrating an example of the packet processing device 2 controlled by the control device 1. Here, as in the case shown in FIG. 3, a case where there are three

packet processing devices

2a, 2b, 2c will be described as an example. In FIG. 8, the numbers indicated with the # symbol are port numbers.

In the example shown in FIG. 8,

terminals

8a, 8b, and 8c are connected to the packet processing device 2a. A terminal 8d is connected to the packet processing device 2c.

The IP (Internet Protocol) address of the terminal 8a is 172.20.1.1.1.

Assume that the IP address of the terminal 8b is 172.20.1.2.

It is assumed that the IP address of the terminal 8c is 172.20.1.3.

The IP address of the terminal 8d is assumed to be 172, 20.2.1.

Also, let the flow from the terminal 8a to the terminal 8d be flow 1. Let the flow from the terminal 8b to the terminal 8d be flow 2. Let the flow from the terminal 8c to the terminal 8d be flow 3. It is assumed that the processing method for the flow 1 packet and the processing method for the flow 3 packet are the same. Also, the processing method for the flow 2 packet is different from the processing method for the

flow

1 and 3 packets.

In the following description, it is assumed that no processing rule is stored in the storage unit 21 of each packet processing device 2 in the initial state.

First, it is assumed that the terminal 8a transmits a packet with the terminal 8d as a destination. The packet processing device 2a receives the packet. Since the processing rule corresponding to the received packet is not stored in the storage unit 21, the packet processing unit 22 of the packet processing device 2a transmits an inquiry about the processing rule for the flow (flow 1) of the packet to the control device 1. . At this time, the packet processing unit 22 of the packet processing device 2 a also transmits the packet to the control device 1.

Then, the control unit 10 of the control device 1 receives the processing rule inquiry and the packet from the packet processing device 2a (step S51). Next, the processing rule granularity determination unit 11 creates an identification rule for identifying the flow 1 based on the packet (step S52). In the present embodiment, a case where a combination of a source IP address and a destination IP address in an IP header of a packet is used as an identification rule will be described as an example. Therefore, the identification rule created in step S52 is represented by a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1”.

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow 1 for each packet processing device 2 through which the flow 1 passes, and sets a processing rule for each packet processing device 2 based on the control policy. Then, the processing rule granularity determination unit 11 determines whether it is possible to create a processing rule in which the flow 1 and other flows are aggregated (step S53).

The processing method defined for the packet processing device 2a is “transfer from port # 4”. That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1” for the packet processing device 2a. A processing rule including an identification rule and a processing method with the content “transfer from port # 4” is defined.

The processing method defined for the packet processing device 2b is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1” with respect to the packet processing device 2b. A processing rule including an identification rule and a processing method with the content “transfer from port # 2” is determined.

The processing method defined for the packet processing device 2c is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1” for the packet processing device 2c. A processing rule including an identification rule and a processing method with the content “transfer from port # 2” is determined.

In step S53, after setting the processing rule for each packet processing device 2 as described above, the processing rule granularity determination unit 11 can create a processing rule in which the processing rules of flow 1 and the processing rules of other flows are aggregated. It is determined whether or not.

FIG. 9 shows an example of the processing progress of the determination process of whether or not it is possible to create a processing rule in which processing rules for a plurality of flows are aggregated. The processing rule granularity determination unit 11 determines whether there is another identification rule having the same processing method as the processing rule created in step S53 as described above (step S531). In this example, an identification rule having the same processing method as the processing rule created in step S53 as described above is not stored in the management DB storage unit 12 (NO in step S531). In this case, the processing rule granularity determination unit 11 determines to register the processing rule including the identification rule obtained in step S52 (the processing rule created in step S53 as described above) (step S533).

When the identification rule having the same processing method as the processing rule created in step S53 as described above is stored in the management DB storage unit 12 (YES in step S531), the processing rule granularity determination unit 11 It is determined that a processing rule including the processing rule including the identification rule and the processing rule generated in step S53 as described above is created and the processing rule is registered (step S532). The case of executing step S532 will be described later.

In this example, the processing rule granularity determination unit 11 manages the processing rule including the identification rule obtained in step S52 (the processing rule created in step S53 as described above) according to the determination in step S533 in step S54. Register in the DB storage unit 12 (step S54). Processing rules registered in the management DB storage unit 12 at this time are shown in FIG.

Then, the processing rule granularity determining unit 11 notifies the corresponding packet processing device 2 of each processing rule registered in step S54 for each packet processing device 2 (step S55). Here, the processing rule granularity determination unit 11 notifies the packet processing device 2a of the processing rules of the packet processing device 2a shown in FIG. Similarly, the processing rule granularity determination unit 11 notifies the packet processing device 2b of the processing rules of the packet processing device 2b shown in FIG. Further, the processing rule granularity determining unit 11 notifies the packet processing device 2c of the processing rules of the packet processing device 2c shown in FIG.

The processing rule setting unit 20 (see FIG. 7) of each packet processing device 2 stores the notified processing rule in the storage unit 21. Then, the packet processing unit 22 processes the received packet according to the processing rule. As a result, the packets of flow 1 are sequentially transferred according to the processing rule corresponding to flow 1.

Next, it is assumed that the terminal 8b transmits a packet with the terminal 8d as a destination. The packet processing device 2a receives the packet. Since the processing rule corresponding to the received packet is not stored in the storage unit 21, the packet processing unit 22 (see FIG. 7) of the packet processing device 2a controls the processing rule inquiry for the flow (flow 2) of the packet. Transmit to device 1. At this time, the packet processing unit 22 of the packet processing device 2 a also transmits the packet to the control device 1.

Then, the control unit 10 of the control device 1 receives the processing rule inquiry and the packet from the packet processing device 2a (step S51). Next, the processing rule granularity determination unit 11 creates an identification rule for identifying the flow 2 based on the packet (step S52). Here, an identification rule represented by a combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1” is created.

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow 2 for each packet processing device 2 through which the flow 2 passes, and sets a processing rule for each packet processing device 2 based on the control policy. Then, the processing rule granularity determination unit 11 determines whether it is possible to create a processing rule in which the processing rules of the flow 2 and the processing rules of other flows are aggregated (step S53).

The processing method defined for the packet processing device 2a is “transfer from port # 5”. That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1” for the packet processing device 2a. A processing rule including an identification rule and a processing method with the content “transfer from port # 5” is defined.

The processing method defined for the packet processing device 2b is “transfer from port # 4”. That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1” with respect to the packet processing device 2b. A processing rule including an identification rule and a processing method with the content “transfer from port # 4” is defined.

The processing method defined for the packet processing device 2c is “transfer from port # 4”. That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1” for the packet processing device 2c. A processing rule including an identification rule and a processing method with the content “transfer from port # 4” is defined.

In step S53, after setting the processing rule for each packet processing device 2 as described above, can the processing rule granularity determination unit 11 create a processing rule that aggregates the processing rule of the flow 2 and the processing rule of another flow? Determine whether or not.

That is, the processing rule granularity determination unit 11 determines whether there is another identification rule having the same processing method as the processing rule created in step S53 as described above (see step S531, FIG. 9). In this example, the processing rules shown in FIG. 10 (processing rules corresponding to the flow 1) are stored in the management DB storage unit 12. However, the processing rule processing method shown in FIG. 10 is different from the processing rule processing method created in step S53 as described above. Therefore, an identification rule having the same processing method as the processing rule created in step S53 as described above is not stored in the management DB storage unit 12 (NO in step S531). Therefore, the processing rule granularity determination unit 11 determines to register the processing rule including the identification rule obtained in step S52 (the processing rule created in step S53 as described above) (see step S533, FIG. 9).

In step S54, the processing rule granularity determination unit 11 stores the processing rule including the identification rule obtained in step S52 (the processing rule created in step S53 as described above) in the management DB in accordance with the determination in step S533. Register in the unit 12 (step S54). The processing rules registered in the management DB storage unit 12 at this time are shown in FIG. A processing rule including an identification rule (see FIG. 11) represented by a combination of a source IP address “172.20.1.2” and a destination IP address “172.20.2.1” is newly registered. Processing rules.

Then, the processing rule granularity determining unit 11 notifies the corresponding packet processing device 2 of each processing rule registered in step S54 for each packet processing device 2 (step S55).

The operation of each packet processing device 2 that has received the processing rule notification is the same as the operation already described. As a result, the processing rules of the packet processing device 2a shown in FIG. 11 are stored in the packet processing device 2a. Further, the processing rules of the packet processing device 2b shown in FIG. 11 are stored in the packet processing device 2b. Further, the processing rules of the packet processing device 2c shown in FIG. 11 are stored in the packet processing device 2c. Then, the packet processing unit 22 processes the received packet according to the processing rule. As a result, the packet of flow 1 is sequentially transferred according to the processing rule corresponding to flow 1, and the packet of flow 2 is sequentially transferred according to the processing rule corresponding to flow 2.

Next, it is assumed that the terminal 8c transmits a packet with the terminal 8d as a destination. The packet processing device 2a receives the packet. Since the processing rule corresponding to the received packet is not stored in the storage unit 21, the packet processing unit 22 (see FIG. 7) of the packet processing device 2a controls the processing rule inquiry for the flow (flow 3) of the packet. Transmit to device 1. At this time, the packet processing unit 22 of the packet processing device 2 a also transmits the packet to the control device 1.

Then, the control unit 10 of the control device 1 receives the processing rule inquiry and the packet from the packet processing device 2a (step S51). Next, the processing rule granularity determination unit 11 creates an identification rule for identifying the flow 3 based on the packet (step S52). Here, an identification rule represented by a combination of the source IP address “172.20.1.3” and the destination IP address “172.20.2.1” is created.

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow 3 for each packet processing device 2 through which the flow 3 passes, and sets a processing rule for each packet processing device 2 based on the control policy. Then, the processing rule granularity determination unit 11 determines whether it is possible to create a processing rule in which the processing rules of the flow 3 and the processing rules of other flows are aggregated (step S53).

The processing method defined for the packet processing device 2a is “transfer from port # 4”. That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.3” and the destination IP address “172.20.2.1” for the packet processing device 2a. A processing rule including an identification rule and a processing method with the content “transfer from port # 4” is defined.

The processing method defined for the packet processing device 2b is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.3” and the destination IP address “172.20.2.1” for the packet processing device 2b. A processing rule including an identification rule and a processing method with the content “transfer from port # 2” is determined.

The processing method defined for the packet processing device 2c is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 is represented by a combination of the source IP address “172.20.1.3” and the destination IP address “172.20.2.1” for the packet processing device 2c. A processing rule including an identification rule and a processing method with the content “transfer from port # 2” is determined.

In step S53, after the processing rule is determined for each packet processing device 2 as described above, can the processing rule granularity determination unit 11 create a processing rule in which the processing rules of the flow 3 and the processing rules of other flows are aggregated? Determine whether or not.

That is, the processing rule granularity determination unit 11 determines whether there is another identification rule having the same processing method as the processing rule created in step S53 as described above (see step S531, FIG. 9). In this example, the processing rules shown in FIG. 11 (the processing rules corresponding to the flow 1 and the processing rules corresponding to the flow 2) are stored in the management DB storage unit 12. Here, the processing rule processing method corresponding to the flow 1 is the same as the processing rule processing method created in step S53 as described above. Therefore, an identification rule having the same processing method as the processing rule created in step S53 as described above is stored in the management DB storage unit 12 (YES in step S531). Therefore, the processing rule granularity determination unit 11 determines that the processing rule including the identification rule and the processing rule generated in step S53 as described above are aggregated and the processing rule is registered. (Step S532).

The processing rule granularity determination unit 11 determines an identification rule including the flow 3 and the flow 1 (in other words, an identification rule that matches each of the flow 3 and the flow 1). The processing rule granularity determination unit 11 uses, for example, a source IP address “172.20.1.0/30” and a destination IP address “172.20.2.1” as an identification rule that includes the flow 3 and the flow 1. Create an identification rule represented by a combination of. This identification rule matches each of flow 3 and flow 1. Then, the processing rule granularity determination unit 11 creates a set of processing methods that are the same in the processing rules of the flow 3 and the processing rules of the flow 1 and a set of the identification rules, thereby collecting a plurality of processing rules. Create a rule. For example, for the packet processing device 2a, the processing rule granularity determination unit 11 determines a set of the above-described identification rule and a processing method having a content “transfer from port # 4”. Here, the packet processing device 2a has been described as an example, but the processing rule granularity determination unit 11 performs the same processing on the other

packet processing devices

2b and 2c.

In step S54, the processing rule granularity determination unit 11 registers the processing rule newly created in step S532 in the management DB storage unit 12 in accordance with the determination in step S532 (step S54). Further, when the processing rule granularity determination unit 11 registers the processing rule newly created in step S532 in the management DB storage unit 12, the existing processing rule (in this example, the flow 1 of the flow 1) collected in the new processing rule. Processing rules (see FIGS. 10 and 11) are deleted from the management DB storage unit 12. Processing rules registered in the management DB storage unit 12 at this time are shown in FIG. A processing rule including an identification rule (see FIG. 12) represented by a combination of a source IP address “172.20.1.0/30” and a destination IP address “172.20.2.1” has been newly added. It is a registered processing rule. Further, the processing rule (see FIG. 11) including the identification rule represented by the combination of “172.20.1.1” and the destination IP address “172.20.2.1” has been deleted.

Then, the processing rule granularity determining unit 11 notifies the corresponding packet processing device 2 of each processing rule registered in step S54 for each packet processing device 2 (step S55). If the existing processing rule is deleted in step S54, the processing rule granularity determination unit 11 transmits to the packet processing device 2 in step S55, together with an instruction to delete the processing rule. To do. In this example, the processing rule granularity determination unit 11 also transmits a notification to delete the existing processing rule corresponding to the flow 1 in step S55.

The processing rule setting unit 20 (see FIG. 7) of each packet processing device 2 stores the notified processing rule in the storage unit 21. Further, the processing rule setting unit 20 deletes the processing rule specified by the control device 1 from the storage unit 21 in accordance with an instruction from the control device 1. As a result, the processing rules of the packet processing device 2a shown in FIG. 12 are stored in the packet processing device 2a. Further, the processing rules of the packet processing device 2b shown in FIG. 12 are stored in the packet processing device 2b. Further, the processing rules of the packet processing device 2c shown in FIG. 12 are stored in the packet processing device 2c. As a result, the packet of flow 1 and the packet of flow 3 are sequentially transferred according to the processing rule corresponding to

flows

1 and 3, and the packet of flow 2 is sequentially transferred according to the processing rule corresponding to flow 2.

According to this embodiment, when the processing method is the same in the processing rules corresponding to different flows, the processing rule granularity determination unit 11 aggregates the processing rules corresponding to the different flows. Therefore, the number of processing rules stored in the packet processing device 2 can be reduced.

In the present embodiment, the case where an IP address is used as an identification rule has been described as an example, but the aspect of the identification rule is not limited to the aspect using an IP address. For example, a tunnel identifier of a mobile system may be applied. The information used for the identification rule may be information that can be described as an identification rule including a plurality of flows.

Embodiment 2. FIG.
The control apparatus 1 of 2nd Embodiment is the structure (refer FIG. 1) similar to 1st Embodiment, and 2nd Embodiment is described with reference to FIG.

In the second embodiment, the processing rule granularity determination unit 11 determines a group identifier for identifying a flow group as an identification rule. However, the identification rule in the processing rule notified to the first-stage packet processing device 2 is the same as the identification rule in the first embodiment. In the following description, an example in which not only the first-stage packet processing device 2 but also the identification rule in the processing rule notified to the last-stage packet processing device 2 is the same as the identification rule in the first embodiment is taken as an example. I will explain. The first-stage packet processing device 2 is a packet processing device 2 that directly receives a packet from a terminal. The last stage packet processing apparatus 2 is a packet processing apparatus 2 that directly transfers a packet to a terminal.

Further, in the following description, a case where the packet processing device 2 is an L3 (Layer 3) switch will be described as an example. Since the L3 switch does not use a MAC (Media Access Control) address during packet transfer, rewriting the MAC address of the packet transferred by the L3 switch does not affect the transfer. Moreover, it is not necessary to return the rewritten MAC address to the original MAC address. Therefore, in the example shown below, a case where a MAC address is used as an identification rule for identifying a flow group and the MAC address is written as a source MAC address in a packet will be described as an example. This source MAC address is used to identify a group of flows.

Hereinafter, the operation of the control device 1 will be described using a specific example. FIG. 13 is a schematic diagram illustrating an example of the packet processing device 2 controlled by the control device 1. FIG. 13 illustrates a case where there are three

packet processing apparatuses

2a, 2b, and 2c. The numbers indicated with the # symbol are port numbers.

In the example shown in FIG. 13,

terminals

8a, 8b, and 8c are connected to the packet processing device 2a. A terminal 8d is connected to the packet processing device 2c. The IP addresses of the

terminals

8a, 8b, 8c, and 8d shown in FIG. 13 are the same as the IP addresses of the

terminals

8a, 8b, 8c, and 8d shown in FIG.

Suppose the flow from the terminal 8a to the terminal 8d is flow 1. Let the flow from the terminal 8b to the terminal 8d be flow 2. Let the flow from the terminal 8c to the terminal 8d be flow 3. It is assumed that the processing method for the flow 1 packet and the processing method for the flow 3 packet are the same. Also, the processing method for the flow 2 packet is different from the processing method for the

flow

1 and 3 packets.

Also, which flow belongs to which group is determined in advance. Information indicating to which group each flow belongs is held in advance by the processing rule granularity determination unit 11. Assume that X is predetermined as a group identifier for the groups of flow 1 and flow 3. Further, it is assumed that Y is predetermined as a group identifier for the group of flow 2. X and Y are each described as a MAC address.

Hereinafter, it is assumed that flows occur in the order of flow 1, flow 2, and flow 3. In the initial state, it is assumed that no processing rule is stored in the storage unit 21 of each packet processing device 2.

First, the terminal 8a transmits a packet with the terminal 8d as the destination. The packet processing device 2a receives the packet. Since the processing rule corresponding to the received packet is not stored in the storage unit 21, the packet processing unit 22 of the packet processing device 2a transmits an inquiry about the processing rule for the flow (flow 1) of the packet to the control device 1. . At this time, the packet processing unit 22 of the packet processing device 2 a also transmits the packet to the control device 1.

The control unit 10 of the control device 1 receives the processing rule inquiry and the packet from the packet processing device 2a.

Next, the processing rule granularity determination unit 11 determines an identification rule for identifying the flow 1. The processing rule granularity determination unit 11 determines the MAC address “X” as an identification rule for the flow 1. However, the identification rules in the processing rules notified to the first-stage packet processing device 2a and the last-stage packet processing device 2c are determined in the same manner as in the first embodiment. That is, the processing rule granularity determination unit 11 uses a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1” as the identification rule.

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow 1 for each packet processing device 2 through which the flow 1 passes, and sets a processing rule for each packet processing device 2 based on the control policy. However, when the flow 1 belongs to the same group as the flow for which the processing rule has already been created, the processing rule of the different flow is aggregated by using the processing rule as the processing rule of the flow 1. In this example, there is no flow for which a processing rule has already been created. Therefore, the processing rule granularity determination unit 11 creates a processing rule for the flow 1.

The processing method defined for the packet processing device 2a is “rewrite the source MAC address to X and transfer from port # 4”. In other words, the processing rule granularity determination unit 11 represents the first-stage packet processing device 2a as a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1”. And a processing rule including “a rewrite source MAC address to X and transfer from port # 4” is defined.

The processing method defined for the packet processing device 2b is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 determines a processing rule including an identification rule “X” and a processing method with the content “transfer from port # 2” for the packet processing device 2b.

The processing method defined for the packet processing device 2c is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 uses a combination of the source IP address “172.20.1.1” and the destination IP address “172.20.2.1” for the packet processing device 2c at the final stage. A processing rule including an identification rule to be expressed and a processing method with a content of “transfer from port # 2” is defined.

Next, the processing rule granularity determination unit 11 registers the processing rule determined as described above in the management DB storage unit 12. Processing rules registered in the management DB storage unit 12 at this time are shown in FIG.

Then, the processing rule granularity determination unit 11 notifies the corresponding packet processing device 2 of each processing rule determined as described above. Here, the processing rule granularity determination unit 11 notifies the packet processing device 2a of the processing rules of the packet processing device 2a shown in FIG. Similarly, the processing rule granularity determination unit 11 notifies the packet processing device 2b of the processing rules of the packet processing device 2b shown in FIG. Furthermore, the processing rule granularity determining unit 11 notifies the packet processing device 2c of the processing rules of the packet processing device 2c shown in FIG.

The processing rule setting unit 20 (see FIG. 7) of each packet processing device 2 stores the notified processing rule in the storage unit 21. Then, the packet processing unit 22 processes the received packet according to the processing rule. The packet processing device 2a rewrites the transmission source MAC address of the packet of flow 1 received from the terminal 8a to X, and outputs the packet from port # 4. The packet processing device 2b that has received the packet outputs the packet from the port # 2 in accordance with the notified processing rule. The packet processing device 2c that has received the packet outputs the packet from the port # 2 in accordance with the notified processing rule. As a result, the packet of flow 1 reaches the destination terminal 8d.

Next, the terminal 8b transmits a packet with the terminal 8d as a destination. The packet processing device 2a receives the packet. Since the processing rule corresponding to the received packet is not stored in the storage unit 21, the packet processing unit 22 of the packet processing device 2a transmits a processing inquiry for the flow of the packet (flow 2) to the control device 1. At this time, the packet processing unit 22 of the packet processing device 2 a also transmits the packet to the control device 1.

Next, the processing rule granularity determination unit 11 determines an identification rule for identifying the flow 2. The processing rule granularity determination unit 11 determines the MAC address “Y” as an identification rule for the flow 2. However, the identification rules in the processing rules notified to the first-stage packet processing device 2a and the last-stage packet processing device 2c are determined in the same manner as in the first embodiment. That is, the processing rule granularity determination unit 11 uses a combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1” as the identification rule.

Next, the processing rule granularity determination unit 11 determines a processing method corresponding to the flow 2 for each packet processing device 2 through which the flow 2 passes, and sets a processing rule for each packet processing device 2 based on the control policy. However, when the flow 2 is a flow belonging to the same group as the flow for which the processing rule has already been created, the processing rule of the different flow is aggregated by using the processing rule as the processing rule of the flow 2. In this example, the processing rule for flow 1 has already been created, but the group for flow 1 and the group for flow 2 are different. Accordingly, the processing rule granularity determination unit 11 creates a processing rule for the flow 2.

The processing method defined for the packet processing device 2a is “rewrite the source MAC address to Y and transfer from port # 4”. That is, the processing rule granularity determination unit 11 represents the first-stage packet processing device 2a as a combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1”. And a processing rule including “a rewrite source MAC address to Y and transfer from port # 4” is defined.

The processing method defined for the packet processing device 2b is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 determines a processing rule including an identification rule “Y” and a processing method with the content “transfer from port # 2” for the packet processing device 2b.

The processing method defined for the packet processing device 2c is “transfer from port # 2.” That is, the processing rule granularity determination unit 11 uses the combination of the source IP address “172.20.1.2” and the destination IP address “172.20.2.1” for the packet processing device 2c at the final stage. A processing rule including an identification rule to be expressed and a processing method with a content of “transfer from port # 2” is defined.

Then, the processing rule granularity determination unit 11 notifies the corresponding packet processing device 2 of each processing rule determined as described above.

The operation of each packet processing device 2 that has received the processing rule notification is the same as the operation already described. As a result, the processing rules of the packet processing device 2a shown in FIG. 15 are stored in the packet processing device 2a. Further, the processing rules of the packet processing device 2b shown in FIG. 15 are stored in the packet processing device 2b. Further, the processing rules of the packet processing device 2c shown in FIG. 15 are stored in the packet processing device 2c.

Then, the packet processing device 2a rewrites the transmission source MAC address of the packet of the flow 2 received from the terminal 8b to Y, and outputs the packet from the port # 4. The packet processing device 2b that has received the packet outputs the packet from the port # 2 in accordance with the notified processing rule. The packet processing device 2c that has received the packet outputs the packet from the port # 2 in accordance with the notified processing rule. As a result, the packet of the flow 2 reaches the destination terminal 8d.

Next, the terminal 8c transmits a packet with the terminal 8d as the destination. The packet processing device 2a receives the packet. Since the processing rule corresponding to the received packet is not stored in the storage unit 21, the packet processing unit 22 of the packet processing device 2a transmits a processing inquiry for the flow of the packet (flow 3) to the control device 1. At this time, the packet processing unit 22 of the packet processing device 2 a also transmits the packet to the control device 1.

Next, the processing rule granularity determination unit 11 determines an identification rule for identifying the flow 3. The processing rule granularity determination unit 11 determines the MAC address “X” as an identification rule for the flow 3. However, the identification rules in the processing rules notified to the first-stage packet processing device 2a and the last-stage packet processing device 2c are determined in the same manner as in the first embodiment. That is, the processing rule granularity determination unit 11 uses a combination of the source IP address “172.20.1.3” and the destination IP address “172.20.2.1” as the identification rule.

Here, the newly generated flow 3 is a flow belonging to the same group as the flow 1 in which the processing rule has already been created. Therefore, the processing rule granularity determination unit 11 aggregates the processing rules of the

different flows

1 and 3 by using the processing rule of the flow 1 as the processing rule of the flow 3.

The processing rule granularity determination unit 11 does not change the processing rules of the packet processing device 2b other than the first stage and the last stage. In addition, the processing rule granularity determination unit 11 changes the identification rule in the processing rule corresponding to the flow 1 of the first-stage packet processing device 2a and the last-stage packet processing device 2c to an identification

rule including flows

1 and 3. To do. Specifically, the identification rule in the processing rule corresponding to the flow 1 is represented by a combination of the source IP address “172.20.1.0/30” and the destination IP address “172.20.2.1”. Change to the identification rule.

The processing rule granularity determination unit 11 reflects the change of the processing rule (change of the identification rule) of the

packet processing devices

2a and 2c at the first stage and the final stage in the processing rule stored in the management DB storage unit 12. The processing rules registered in the management DB storage unit 12 at this time are shown in FIG.

Since the processing rule granularity determination unit 11 has not changed the processing rules of the packet processing device 2b other than the first and last stages, the processing rule need not be notified to the packet processing device 2b.

In addition, the processing rule granularity determination unit 11 notifies the first-stage packet processing device 2a and the final-stage packet processing device 2c of the processing rule whose identification rule has been changed and deletes the processing rule before the change. Send instructions.

The processing rule setting unit 20 of the

packet processing devices

2 a and 2 c stores the notified processing rule in the storage unit 21 and deletes the processing rule designated to be deleted from the storage unit 21. As a result, the processing rules of the packet processing device 2a shown in FIG. 16 are stored in the packet processing device 2a. Also, the processing rules of the packet processing device 2b shown in FIG. 16 are stored in the packet processing device 2b. Further, the processing rules of the packet processing device 2c shown in FIG. 16 are stored in the packet processing device 2c.

Then, the packet processing device 2a rewrites the transmission source MAC address of the packet of the flow 3 received from the terminal 8c to X, and outputs the packet from the port # 4. The packet processing device 2b that has received the packet outputs the packet from the port # 2 in accordance with the notified processing rule. The packet processing device 2c that has received the packet outputs the packet from the port # 2 in accordance with the notified processing rule. As a result, the packet of the flow 3 reaches the destination terminal 8d. The packet transfer mode of the flow 3 is the same as the packet transfer mode of the flow 1.

Also in the present embodiment, the processing rules of different flows are aggregated, so that the number of processing rules stored in the packet processing device 2 can be reduced.

Further, the first-stage packet processing device 2a that receives a packet whose source MAC address has not been rewritten has a processing rule including an identification rule similar to that of the first embodiment without using a group identifier as an identification rule. Be notified. Even with the same identification rule as in the first embodiment, an identification rule including a plurality of flows can be described, so that processing rules can be aggregated. Therefore, the number of processing rules to be stored can be reduced also in the first-stage packet processing device 2.

In the above example, the case where the source address of the packet is rewritten with the group identifier (“X”, “Y” in the above example) is illustrated. The mode of adding the group identifier to the packet is not limited to this example. For example, the processing rule granularity determination unit 11 may determine a processing method including the content of writing the group identifier in the vendor extension area in the packet.

In the above example, the case where the identification rule in the processing rule notified to the packet processing apparatus 2c at the final stage is the same as that in the first embodiment has been described as an example. The identification rule in the processing rule notified to the final stage packet processing device 2c may be represented by a group identifier.

Next, the outline of the present invention will be described. FIG. 17 is a block diagram showing an outline of the control device of the present invention. The control device of the present invention includes a flow identification information creating unit 91, a processing rule creating unit 92, an aggregation unit 93, and a notification unit 94.

The flow identification information creating unit 91 (for example, the processing rule granularity determining unit 11 that executes step S52) creates flow identification information (for example, an identification rule) for identifying a flow.

The processing rule creation means 92 (for example, the processing rule granularity determination unit 11 that executes step S53) determines a processing method for a flow packet, and creates a processing rule including flow identification information and a processing method.

When the aggregation unit 93 (for example, the processing rule granularity determination unit 11 that executes step S53) can aggregate the processing rule of the flow and the processing rule of the other flow, the processing rule of the flow and the other flow The processing rules are consolidated.

The notification means 94 (for example, the processing rule granularity determination unit 11 that executes Step S55) notifies the processing rule to the packet processing device.

Such a configuration can reduce the number of processing rules stored in the packet processing apparatus.

The configuration may be such that the aggregation means 93 determines that the processing rules of different flows can be aggregated when the processing methods included in the processing rules of different flows are the same.

The aggregation means 93 determines that the processing rules of the different flows can be aggregated when the processing methods included in the processing rules of the different flows are the same, determines flow identification information that matches each of the different flows, The configuration may be such that the processing rules are aggregated by creating a processing rule including the flow information and its processing method.

The flow identification information creating unit 91 determines flow identification information for identifying a group of flows,
When the newly created flow is a flow that belongs to the same group as the flow for which the processing rule has already been created, the aggregation means 93 uses the processing rule as the processing rule for the newly generated flow. The configuration may be such that the processing rules of different flows are aggregated.

The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above-described embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

This application claims priority based on Japanese Patent Application No. 2014-051330 filed on Mar. 14, 2014, the entire disclosure of which is incorporated herein.

Industrial applicability

The present invention is suitably applied to a control device that controls a packet processing device.

DESCRIPTION OF SYMBOLS 1 Control apparatus 2 Packet processing apparatus 10 Control part 11 Processing rule granularity determination part 12 Management DB memory | storage part

Claims

A control device that controls a packet processing device that processes packets,
Flow identification information creating means for creating flow identification information for identifying a flow;
A processing rule creating means for defining a processing method for the packet of the flow, and creating a processing rule including the flow identification information and the processing method;
An aggregating means for aggregating the processing rule of the flow and the processing rule of the other flow when the processing rule of the flow and the processing rule of the other flow can be aggregated;
A control device comprising: notification means for notifying a packet processing device of a processing rule.
Aggregation means
The control device according to claim 1, wherein when the processing methods included in the processing rules of different flows are the same, it is determined that the processing rules of the different flows can be aggregated.
Aggregation means
When the processing methods included in the processing rules of different flows are the same, it is determined that the processing rules of the different flows can be aggregated, flow identification information that matches each of the separate flows is determined, and the flow information The control device according to claim 1, wherein the processing rules are aggregated by creating a processing rule including the processing method.
The flow identification information creation means
Define flow identification information that identifies groups of flows,
Aggregation means
When a newly generated flow belongs to the same group as a flow for which a processing rule has already been created, the processing rule is also used as a processing rule for the newly generated flow, so that The control device according to claim 1, wherein processing rules are collected.
A control method for controlling a packet processing device for processing a packet,
Create flow identification information to identify the flow,
Define a processing method for the packet of the flow, create a processing rule including the flow identification information and the processing method,
When the processing rule of the flow and the processing rule of another flow can be aggregated, the processing rule of the flow and the processing rule of the other flow are aggregated,
A control method characterized by notifying a packet processing device of a processing rule.
A control program installed in a computer that controls a packet processing device that processes packets,
In the computer,
Flow identification information creation processing for creating flow identification information for identifying a flow,
A processing rule creation process for defining a processing method for the packet of the flow and creating a processing rule including the flow identification information and the processing method;
An aggregation process for aggregating the processing rule for the flow and the processing rule for the other flow when the processing rule for the flow and the processing rule for the other flow can be aggregated; and
A control program for executing notification processing for notifying packet processing devices of processing rules.