JP2003022139A - Method for introducing program module, system and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method for introducing a program module by which lowering of service performance due to introduction of the program module in a network device after starting service and wasting of resources can be prevented, and to provide a system and a program. SOLUTION: A program module introduction system characterized by automatically recognizing the network devices (111, 112, 113, 114, 121, 122) regarding the service from a user identifier, attribute information of a packet to be operated by the program module and attribute information of the service is used in introducing the program module to provide a service function.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a wide area network environment in which a plurality of users coexist, and particularly to a program module introduction method and system for dynamically providing new services and dynamically changing service contents. Regarding the program.

[0002]

2. Description of the Related Art Conventionally, in a wide area network environment in which a plurality of users coexist, new provision of services and
As a method to dynamically change the service content,
There was a technology called "active network".
In the method using the "active network", a program module for providing a service function is installed in a network device, and the program module operates on a packet passing through the network device. At this time, the program module collates the identifier information embedded in the packet header in order to determine the operation content (acquisition, duplication, discarding, etc.) of the packet.

The following techniques exist as a method of introducing this program module into a network device.

(1) As a method for a service user to specify and install a network device, (EricY.Chen and H
itoshi Fuji: "A Security Framework for Agent-Based
Active Networks ", Proceedings of M2USIC'200
0, Petaling Jaya, Malaysia, October 2000).

(2) Further, as a method of transferring a packet from an adjacent network device when the packet arrives at a network device, (David J. Wetherall, John Guttat, a
nd David L. Tennenhouse: "ANTS: A Toolkit for Buil
ding and Dynamically Deploying Network Protocols "
, Proceedings of IEEE OPENARCH'98 ', SanFrancisc
o, April 1998).

(3) When the packet arrives at the network device, the network device goes to the program module management server as (Dan Decaspe
r, Bernhard Plattner: "DAN: Distributed Code Cachi
ng for Active Networks ", IEEE Infocom Proceedings,
1998).

[0007]

However, in the above-mentioned conventional technique, the operation on the wide area network composed of the network devices accommodating a plurality of networks and forming a logical closed network for each user is performed. There are insufficient points.

That is, the conventional technique (1) has a problem that service performance is lowered or resources are wasted by introducing a program module into an inappropriate network device. Since the network device to be installed changes depending on the content of the service and the operating status of the network device, it is difficult to determine the installation location in a wide area network environment. It may occur that the service performance is deteriorated, or the resources are wasted by installing program modules in more network devices than necessary.

Further, in the prior arts (2) and (3), there is a problem that it takes time to install the program module and the service performance deteriorates. Since the program module is acquired when the packet arrives and is needed, the network device itself takes a long time to install the program module, which deteriorates the service performance. There should be no waste).

In a wide area network environment,
Since the number of network devices increases and the number of hops to which packets are transferred increases, the introduction time increases the possibility that service performance will be significantly reduced.

An object of the present invention is to provide a service by introducing a program module into a network device after the service is started when the program module is introduced into the network device in a wide area network environment in which many service users share the network device. (EN) Provided are a program module introduction method, a system, and a program that can prevent performance deterioration and waste of resources.

[0012]

A program module introduction method, system and program according to the present invention are a wide area network environment comprising a plurality of networks and a network device which constitutes a logical closed network for each user. In dynamically installing a program module that provides a service function, a network device related to the service is automatically recognized from the user identifier, the attribute information of the packet operated by the program module, and the attribute information of the service It is characterized by

Further, the user identifier is a value for a service provider to uniquely identify the user.

The operation packet attribute information is address information of a packet to be operated.

Further, the service range attribute is "EDG
"E", "ALLINPATH", "ALLINVPN", "ANYINPATH", "ANYINVP"
It is characterized by being any one of N ".

Further, before the program module is installed, the operating state of the network device in the service area and the usage charge information are inspected.

Further, the service area is characterized in that a network device related to a service is extracted from the user identifier, the operation packet attribute information and the service range attribute information.

Before the program module is installed, the operating status of the network device in the service area and the usage charge information are shown to the representative user of the service, and an inquiry is made to determine the installation device. Characterize.

Further, the present invention is characterized by having a server which stores the program module and has a function to be introduced into the network device before the start of the service.

[0020] Further, it is characterized by having a terminal having a function of judging the introduction position of the program module.

Also, the program module system is characterized in that it is possible to recognize an appropriate service area according to the routing information at the time of the service introduction request.

When a program module that provides a service function is dynamically installed in a wide area network environment that includes network devices that accommodate a plurality of networks and configure a logical closed network for each user, A program module installation method comprising means for automatically recognizing a network device related to a service from a user identifier, attribute information of a packet operated by the program module, and attribute information of a service.

When a program module that provides a service function is dynamically installed in a wide area network environment that includes network devices that accommodate a plurality of networks and configure a logical closed network for each user, A program for causing a computer to execute, which has a process of automatically recognizing a network device related to a service from a user identifier, attribute information of a packet operated by a program module, and attribute information of a service. .

[0024]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows a network configuration of the present invention. As shown in FIG. 1, the service network 101 is owned by a network service provider (not shown). In addition, the boundary network device 1
Reference numerals 11, 112, 113 and 114 denote network devices that directly accommodate a network that uses a service in the service network 101. further,
Core network devices 121 and 122 indicate network devices (service areas) that connect boundary networks in the service network 101 and transfer packets from a plurality of service using networks at high speed.

Next, the module server 131 manages program modules that provide service functions.
In addition, the service utilization networks 141, 142, 14
Reference numeral 3 indicates a network managed by the same user identifier. Normally, networks with the same network management guidelines of the same organization or the same company are managed by the network service provider with the same user identifier, and the network service user and the network service provider make a contract for each user identifier. It is assumed that Then, the service use networks 151, 15
Reference numerals 2 and 153 denote networks managed by different user identifiers. In addition, the service representative use terminal 161
Is a service-usage-responsible terminal that exists for each service, and serves as a notification destination when a failure occurs while determining the installation position of the program module, the survival time, and the like.

Then, service utilization terminals 171, 172
Indicates a terminal that uses a service for which the service representative using terminal 161 is responsible.

Now, the service area will be described. The service area is a service area obtained by extracting a network device related to a service from the information of the user identifier, the operation packet attribute, and the service range attribute. The service range attribute is "EDGE"
In the case of designation, the service area is a set of boundary network devices (accommodation boundary network devices) that accommodate the network indicated by the user identifier and the operation packet attribute. Also, the service range attribute is "ALLINPATH"
When specified or "ANYINPATH" is specified, the service area is a set of accommodation boundary network devices and a set of core network devices (transfer core network devices) through which packets transmitted and received between service using networks pass, The sum of Further, when the service range attribute is "ALLINVPN" or "ANYINVPN", the service area is a set of all boundary network devices accommodating networks having the same user identifier, and the user. It is the sum of the set of core network devices that can transfer packets with an identifier.

By determining the service area from the service range attribute, it is possible to support the extraction of an appropriate network device into which the program module should be installed, and prevent the program module from being installed in the network device that is unnecessary for the service. It is possible to prevent waste of resources.

After determining the service area, "inquiry about device status" is sent to all network devices in the service area.
Then, the information about the state of each network device and the usage charge information are acquired. Network devices that cannot provide a service are excluded from the device status information, and network devices that do not satisfy the usage cost information in the service request message are excluded from the usage charge information.

Next, FIG. 2 shows a form of service introduction request information created in the module server 131 when a service is newly introduced or changed in the network form of FIG.

The module server 131 is a terminal having a function of storing a program module for packet operation and introducing it into the network device. The module server 131 introduces the program module into the network device before starting the service. This prevents the service performance from deteriorating due to the time taken to install the program module in the network device. In addition, a terminal having a function of making a notification destination when a failure occurs by deciding the installation position of the program module, the survival time, etc. is named a "service representative using terminal".

As shown in FIG. 2, from the "service introduction request message" from the representative user of the service and the attribute information of the service registered in advance, the module server 1
31 creates. The column 201 shows the user identifier of the service representative using terminal. And column 202 has 20
The authentication information corresponding to the user identifier shown by 1 is shown. The column 203 shows a service identifier that uniquely identifies the requested service. Then, the column 204 shows the lifetime of availability of the requested service. Also, column 205
Shows address information of a packet to be operated by the program module corresponding to the requested service in the transferred packets in each network device. Only the packet whose address specified here matches the source address or the destination address can be operated by the program module. A column 206 shows the operation content that the module server permits the program module. Then, one or more of acquisition, copy, discard, and transmission are designated. Next, the column 207 shows the position of the network device into which the program module is to be installed, which is designated according to the characteristics of the service. At this time, EDGE, ALLIN
Specify one of PATH, ALLINVPN, ANYINPATH, ANYINVPN. Then, the column 208 shows the usage cost of the service.

Next, in FIG. 3, the user database 107 (see FIG. 7) of the module server is in possession, and FIG.
3 shows a form of service contract information used to authenticate the service introduction request information of FIG. First, the column 301 shows the user identifier of the contracted service representative using terminal.
The column 302 shows the authentication information corresponding to the user identifier indicated by 301. Further, a column 303 shows contracted and available service identifiers. And row 30
4 indicates the time when each service of the contracted 303 is available. A column 305 shows address information of a packet which can be operated by the program module corresponding to the requested service among the transferred packets in each contracted network device. Only the packet whose address specified here matches the source address or the destination address can be operated by the program module. A column 306 shows the operation content permitted to each program module corresponding to each service 303. Then, one or more of acquisition, copy, discard, and transmission are designated.

4 and 5, the module server 131 in the network configuration of FIG. 1 described above recognizes the service area after receiving the "service introduction request message" and sets the program module to the network device. 8 shows a processing flow of the module introduction determination unit 108 (see FIG. 7) until the module is introduced (see also FIG. 7). First, when the module introduction determination unit 108 receives the "service introduction request message" from the service representative using terminal (S401), the service introduction request information is extracted from the content and attribute information of the service registered in the service module database 103 in advance. Is created (S40
2).

Then, "user identifier", "authentication information", "service identifier", "lifetime", "operation packet attribute", and "packet processing content" of the service introduction request information,
"User identifier", "Authentication information", "Allowed service identifier", "Contract time", "Contract address", "of service contract information
The service introduction request information is authenticated by comparing with the "permission packet processing content" (S403). When the service introduction request information authentication fails, a "service introduction failure message (authentication failure)" is returned to the service representative user terminal. Shi (S
491), the process ends. On the other hand, when the authentication of the service introduction request information is successful, the module introduction judging unit 207 recognizes the service area in order to recognize the service area.
The value of (see FIG. 2) is inspected (S404).

If the service range attribute is "EDGE", the service area is a set of boundary network devices (accommodating boundary network devices) that accommodate the network indicated by the "operation packet attribute" (S411). Also, the service range attribute is specified as "ALLINPATH" or "AN
When "YINPATH" is designated, the module server sets the initial value of the service area to a set of accommodation boundary network devices (S421). "Area acquisition request message" is transmitted (S422). Then, each accommodating boundary network device sends a "PATH search message" to all accommodating boundary network devices other than itself, and the core network device that transfers this message transmits its own device information to the PATH search message. Append.

The accommodation boundary network device that finally received the PATH search message transmits the core network device information added to the PATH search message as a "service area acquisition response message", and when the module server receives this, the service is received. Area acquisition succeeds (S
423). Then, the module introduction determination unit adds the core network device information included in the “service area acquisition response message” to the service area (S42).
4). If the "service area acquisition response message" cannot be received, a "service introduction failure message (service area acquisition failure)" is returned to the service representative using terminal (S492), and this processing ends.

When the service range attribute is designated as "ALLINVPN" or "ANYINVPN", the service area is defined by all boundary network devices accommodating networks having the same user identifier as the service representative user terminal. The sum of the set and the set of core network devices capable of transferring the packet having the user identifier is set (S4).
31). After recognizing the service area, the module introduction determination unit transmits a "device status inquiry request message" to all network devices in the service area (S44).
1). When the "device status inquiry response message" is received from each network device (S442), the service range attribute is inspected (S443). And, the service range attribute specifies a fixed range (EDGE, ALLINPATH, or A
In the case of LLINVPN, all network devices in the service area are determined as module introduction devices (S45).
1).

Next, when the service range attribute is an arbitrary range designation (ANYINPATH or ANYINVPN), the service representative terminal is inquired to determine the module installation position (S461). Also, "Device status inquiry response message"
If the message cannot be received, a "service introduction failure message (device status inquiry failure)" is transmitted to the service representative using terminal (S493), and this processing ends.

Further, when the installation position of the program module is determined, the module installation determination unit "device status inquiry response message" regarding the network device at the installation position.
It is checked whether the service can be provided from the value of, the device usage cost is calculated from the number of network devices to be installed, and it is checked whether the usage cost specified in the service introduction request information is satisfied (S471). ), If the service can be provided and the service introduction request information is satisfied,
A "program module introduction request message" is transmitted to the network device at the introduction position using the service module injector 105 (S472). On the other hand, if the service cannot be provided or the service request is not satisfied, a "service introduction failure message (service introduction impossible)" is transmitted to the service representative using terminal (S494),
This process ends.

When a "program module introduction response message" is returned from each network device (S
473), the program module has been successfully installed, and the service area information is displayed in the service manager 106.
After registering the introduction position information of the program module, this processing ends.

If the "program module introduction response message" cannot be received, the "service introduction failure message (program module introduction failure)" is transmitted to the service representative using terminal (S495), and this processing ends.

Next, FIG. 6 shows that the service range attribute is "ALLIN" when a service request is made in the network form of FIG.
When "PATH" is specified or "ANYINPATH" is specified,
6 shows an embodiment of a sequence for the module server to specify a service area, which corresponds to S421 to S424 in FIGS.

First, the module server sets the accommodation boundary network devices 1, 3, and 4 as initial service areas (S501). Next, the module server transmits a "service area acquisition request message" to each accommodation boundary network device (S502, S503, S50).
4). Then, each accommodation perimeter network device is destined for all accommodation perimeter network devices other than itself,
Send "PATH search message" (S505, S50
8, S509, S510, S512, S514), the core network device that transfers this message for the first time in the same service adds its own device information to the PATH search message (S506, S507). And finally PA
The accommodating perimeter network device that receives the TH search message sends a PA message as a "service area acquisition response message".
The core network device information added to the TH search message is transmitted to the module server (S511, S51).
3, S515). The module server adds the core network device included in the service area acquisition response to the service area (S516). As described above, by using the embodiment of the present invention, even in a wide area network service environment in which many service users share a network and a logical closed network is configured for each user, the network device necessary for the service is appropriate. It is possible to install a program module that provides a service function prior to the start of the service, and various network services can be quickly implemented by using appropriate resources without degrading service performance. become.

[0046]

As described above, according to the present invention,
By selecting the network device from the service area by the service representative user, it is possible to further prevent the program module from being introduced into the network device that is unnecessary for the service, and prevent waste of resources.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a network according to an embodiment of the present invention.

FIG. 2 is a diagram showing a form of service introduction request information created by a module server when a service is newly introduced or changed in the network configuration of FIG. 1 according to the embodiment of the present invention.

FIG. 3 is a diagram showing a form of service contract information possessed by a user database of a module server according to an embodiment of the present invention and used for authenticating the service introduction request information of FIG.

FIG. 4 is a diagram illustrating a network configuration of FIG. 1 according to an embodiment of the present invention, in which a module server recognizes a service area after receiving a “service introduction request message” and introduces a program module into a network device. FIG. 6 is a diagram showing a processing flow of the module introduction determination unit of FIG.

FIG. 5 is a diagram showing a network configuration of FIG. 1 according to an embodiment of the present invention, in which a module server recognizes a service area after receiving a “service introduction request message” and introduces a program module into a network device. FIG. 6 is a diagram showing a processing flow of the module introduction determination unit of FIG.

FIG. 6 is a diagram illustrating a service range attribute of “A” when a service is requested in the network configuration of FIG. 1 according to the embodiment of the present invention.
FIG. 6 is a diagram showing a sequence for the module server to specify a service area, corresponding to S421 to S424 in FIGS. 4 and 5, in the case of specifying “LLINPATH” or “ANYINPATH”.

FIG. 7 is a diagram showing a configuration of a module server according to the embodiment of the present invention.

[Explanation of symbols]

101 ... Service network 103 ... Service module database 105 ... Service module injector 106 ... Service Manager 107 ... User database 108 ... Module introduction determination unit 111, 112 ... Border network device 121, 122 ... Core network device 131 ... Module server 141, 142 ... Service use network 151, 152 ... Service use network 161 ... Service representative use terminal 171, 172 ... Service using terminals

Claims (12)

[Claims] 1. When dynamically introducing a program module that provides a service function in a wide area network environment configured by a network device that accommodates a plurality of networks and comprises a logical closed network for each user,
A program module introduction system characterized by automatically recognizing a network device related to a service from a user identifier, attribute information of a packet operated by the program module, and attribute information of a service. 2. The program module introduction system according to claim 1, wherein the user identifier is a value for a service provider to uniquely identify the user. 3. The program module introduction system according to claim 1, wherein the operation packet attribute information is address information of a packet to be operated. 4. The service range attribute is “EDGE” or “ALL
The program module introduction system according to claim 1, wherein the program module introduction system is one of INPATH "," ALLINVPN "," ANYINPATH ", and" ANYINVPN ". 5. Before the introduction of the program module,
5. The operating status of the network device in the service area and the usage charge information are inspected.
A program module system according to any one of 1. 6. The service area according to claim 1, wherein a network device related to a service is extracted from the user identifier, the operation packet attribute information, and the service range attribute information. The program module system according to any one of claims. 7. Before the introduction of the program module,
7. The introduction device is determined by inquiring about the operating status of the network device in the service area and the usage charge information to the representative user of the service and then making an inquiry. The program module system described in. 8. The program module system according to claim 1, further comprising a server that stores the program module and has a function of introducing the program module into a network device before starting a service. 9. The program module system according to claim 1, further comprising a terminal having a function of determining an introduction position of the program module. 10. The program module system according to claim 1, wherein an appropriate service area can be recognized according to the routing information at the time of the service introduction request. 11. When dynamically introducing a program module that provides a service function in a wide area network environment configured by network devices that accommodate a plurality of networks and configure a logical closed network for each user, A program module installation method comprising means for automatically recognizing a network device associated with a service from a user identifier, attribute information of a packet operated by the program module, and attribute information of a service. 12. When dynamically introducing a program module that provides a service function in a wide area network environment that includes a plurality of networks and that comprises network devices that constitute a logical closed network for each user, A program for causing a computer to execute, which has a process of automatically recognizing a network device related to a service from a user identifier, attribute information of a packet operated by a program module, and attribute information of a service.