JP2011048504A - Method, apparatus, and program for load distribution between authentication servers - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable dynamic load distribution to an authentication server depending on the number of authentication requests and to enable unified management of a series of sequences by an authentication server. <P>SOLUTION: A load distribution apparatus receives authentication processing information on authentication processing that an authentication server has performed for an authentication request, totals the number of pieces of authentication processing information of all authentication servers, averages total values of the authentication processing information, sorts out the number of authentication requests to each authentication server so that the number of pieces of authentication processing information becomes an average value or approximate the average value based on an averaged value, decides an authentication server that an edge node should select based on the sorted value, associates the decided authentication server with the edge node, and notifies the authentication server of the result as an authentication request averaging result. The authentication server transmits the authentication request averaging result to the edge node, and the edge node changes an authentication server of a connection destination based on the authentication request averaging result. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a load balancing method, apparatus, and program between authentication servers, and more particularly, in an IP network, based on authentication request information from a user, by transmitting and receiving signals between edge nodes arranged in the network and the authentication server. The present invention relates to a load distribution method, apparatus, and program between authentication servers in a large-scale network for realizing authentication processing.

  Conventionally, there is a RADIUS (Remote Access Dial In User Service) protocol for notifying user authentication and what the user can access to authentication request information from the user (for example, Non-Patent Document 1). reference).

“RADIUS User Authentication Security Protocol” by Jonathan Hassell, Ohm, pp. 1-7, December 18, 2003

  However, the load distribution system between authentication servers using the conventional authentication method has the following problems. FIG. 15 is a diagram for explaining the problem.

  -In a large-scale network, a large amount of authentication request processing occurs from edge nodes, so it is necessary to distribute the load to multiple servers.

  ・ The number of user subscribers to each edge node varies depending on the base and region.

  -Since the number of authentication requests from each edge node to each authentication server differs in the number of accommodated users and the connection frequency for each user, the load on each authentication server is biased.

  -Service quality may deteriorate due to insufficient processing capacity of multiple servers due to load imbalance on some authentication servers and processing delay due to authentication server congestion.

  The present invention has been made in view of the above points, and enables dynamic load distribution to authentication servers according to the number of authentication requests, and between authentication servers capable of centrally managing a series of authentication sequences in the authentication server. It is an object of the present invention to provide a load balancing method, apparatus, and program.

  FIG. 1 is a diagram for explaining the principle of the present invention.

According to the present invention (Claim 1), in the IP network, when the authentication request information from the user terminal is realized by the signal transmission / reception between the edge node arranged in the network and the authentication server, the authentication server An authentication server load distribution method for distributing the load,
The load balancer that performs control to distribute the load of the authentication server
The authentication server receives authentication processing information that has been subjected to authentication processing for the authentication request (step 1), totals the number of authentication processing information of all authentication servers, and averages the total value of the authentication processing information (step 2) An averaging step;
Based on the average value, the number of authentication processing information is distributed so that the number of authentication processing information is the average value or approximate to the average value, and the authentication server to be selected by the edge node based on the distributed value An authentication server determining step (step 3) for associating the determined authentication server with the edge node and storing the authentication request in the storage means as an authentication request averaging result;
An authentication request averaging result notifying step (step 4) for notifying the authentication server stored in the storage means of the authentication request averaging result;
And
The authentication server
A transfer step (step 5) of transmitting the authentication request averaging result received from the load balancer to the edge node
Edge nodes are
Based on the authentication request averaging result received from the authentication server, a connection destination changing step (step 6) for changing the connection destination authentication server is performed.

Further, according to the present invention (Claim 2), in the aggregation / averaging step of the load balancer,
The received authentication processing information is stored in the authentication processing information storage means, and the authentication processing information for a certain period is read from the authentication processing information storage means, and summed and averaged.

Further, the present invention (Claim 3) is the authentication server,
The authentication processing information is stored in the authentication processing information storage means, and the authentication processing information is read at a predetermined period and transmitted to the load balancer.

  FIG. 2 is a principle configuration diagram of the present invention.

The present invention (Claim 4) has an edge node 300 and an authentication server 200 in an IP network, and sends and receives authentication request information from a user terminal between the edge node 300 and the authentication server 200 arranged in the network. The authentication server load distribution system distributes the load of the authentication server 200 when the authentication process is realized by:
A totaling / averaging means 130 for receiving the authentication processing information for which the authentication server 200 has performed the authentication processing for the authentication request, counting the number of authentication processing information of all the authentication servers 200, and averaging the total value of the authentication processing information;
Based on the average value, the authentication request number of each authentication server is distributed so that the number of pieces of authentication processing information is the average value or approximate to the average value, and the authentication that the edge node 300 should select based on the distributed value An authentication server determination unit 150 that determines a server, associates the determined authentication server with an edge node, and stores the result in the storage unit as an authentication request averaging result;
An authentication request averaging result notifying unit 110 for notifying the authentication server stored in the storage unit of the authentication request averaging result;
The authentication server 200
Transfer means 250 for transmitting the authentication request averaging result received from the load balancer 100 to the edge node 300;
The edge node 300 is
Based on the authentication request averaging result received from the authentication server 200, connection destination changing means 320 for changing the connection destination authentication server is provided.

Further, the aggregation / average means 130 of the load balancer of the present invention (Claim 5)
The received authentication processing information is stored in the authentication processing information storage means, and the authentication processing information for a certain period is read from the authentication processing information storage means, and includes aggregation and averaging.

The authentication server 200 of the present invention (Claim 6)
The authentication processing information is stored in the authentication processing information storage means, and the authentication processing information is read out at a predetermined period and transmitted to the load distribution apparatus 100.

According to the present invention (Claim 7), in the IP network, when the authentication request information from the user terminal is realized by the signal transmission / reception between the edge node arranged in the network and the authentication server, the authentication server A load balancer that distributes load,
Receiving means for receiving authentication processing information for which the authentication server has performed authentication processing in response to the authentication request, and storing it in the authentication processing information storage means;
Read out the authentication processing information for a certain period from the authentication information storage means, totalize the number of authentication processing information of all authentication servers, and average / average means for averaging the total values of the authentication processing information;
Based on the average value, the number of authentication processing information is distributed so that the number of authentication processing information is the average value or approximate to the average value, and the authentication server to be selected by the edge node based on the distributed value Authentication server determining means for associating the determined authentication server with the edge node and storing the authentication request in the storage means as an authentication request averaging result;
A result notifying means for changing the authentication server connected to the edge node by notifying the edge node of the authentication request averaging result via the authentication server stored in the storage means;

  The present invention (Claim 8) is a load distribution program for causing a computer to function as each means constituting the load distribution apparatus according to Claim 7.

  As described above, according to the present invention, dynamic load distribution to the authentication server according to the number of daily authentication requests can be realized.

  Further, according to the present invention, new setting and development of an authentication request aggregation / averaging server and development of an edge node are involved, but data transmission / reception between devices can be realized by utilizing an existing protocol.

  In addition, since a series of authentication sequences can be centrally managed by the authentication server, it is possible to promptly respond to a defect report from a user.

It is a principle block diagram of this invention. It is a figure for demonstrating the principle of this invention. 1 is a system configuration diagram according to an embodiment of the present invention. It is a block diagram of the authentication server in one embodiment of this invention. It is an example of the authentication process information storage part of the authentication server in one embodiment of this invention. It is an example of the selection authentication server information storage part of the authentication server in one embodiment of this invention. It is a block diagram of the authentication request condition / averaging server in one embodiment of the present invention. It is an example of the authentication process information storage part of the authentication request totaling / averaging server in one embodiment of this invention. 6 is an example of an authentication request condition / average server selection authentication server information storage unit according to an embodiment of the present invention. It is a block diagram of the edge node in one embodiment of this invention. It is an example of the authentication destination authentication server memory | storage part in one embodiment of this invention. It is a figure for demonstrating the process in one embodiment of this invention. It is a sequence chart of processing in one embodiment of the present invention. It is a figure which shows the flow of the data in one embodiment of this invention. It is a figure for demonstrating a subject.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 3 shows a system configuration according to an embodiment of the present invention.

  The system shown in FIG. 1 includes one authentication request aggregation / averaging server 100, a plurality of authentication servers 200, a plurality of edge nodes 300, and a plurality of user terminals 400 on the IP network. Hereinafter, the “load distribution device” described in the claims will be described as the authentication request condition / averaging server 100.

  The authentication server 200 is connected to the plurality of edge routers 300 and the authentication request condition / averaging server 100, acquires authentication request information transmitted from the user terminal 400 via the edge router 300, performs authentication processing, and performs authentication processing. This is a server that transmits information to the authentication request aggregation / averaging server 100.

  FIG. 4 shows the configuration of the authentication server in one embodiment of the present invention.

  The authentication server 200 includes a transmission / reception unit 210 that transmits / receives data to / from the authentication request aggregation / averaging server 100 and the edge node 300, and an authentication request storage unit that temporarily stores an authentication request received from the user terminal 400 via the edge node 300. 220, an authentication processing unit 230 that performs authentication processing, an authentication processing information storage unit 240 that stores authentication processing information that has undergone authentication processing, and selective authentication that stores connection destination authentication server information acquired from the authentication request aggregation / averaging server 100 The server information storage unit 260 and the transfer control unit 250 that performs control for transferring information in the selective authentication server information storage unit 260 to the edge node 300 are configured.

  FIG. 5 shows an example of the authentication processing information storage unit of the authentication server in one embodiment of the present invention.

  The authentication processing information storage unit 240 shown in FIG. 4 stores the time when the authentication processing is performed for each edge node 300 connected to the authentication server 200 and the authentication result (“OK” or “NG”). .

  FIG. 6 shows an example of the selective authentication server information storage unit of the authentication server in one embodiment of the present invention.

  The selected authentication server information storage unit 260 shown in FIG. 6 stores information on the authentication server (selected authentication server information) to be connected at each edge node 300 determined by the authentication request aggregation / averaging server 100.

  The authentication request totaling / averaging server 100 is connected to a plurality of authentication servers 200, totals and averages the number of pieces of authentication processing information subjected to authentication processing by all the authentication servers 200, and the information is edged via the authentication server 200. The server 300 is notified.

  FIG. 7 shows the configuration of an authentication request aggregation / averaging server in one embodiment of the present invention.

  The authentication request aggregation / averaging server 100 includes a transmission / reception unit 110 that transmits / receives data to / from the authentication server 200, an authentication processing information storage unit 120 that stores authentication processing information received from the authentication server 200, and an authentication processing information storage unit 120. The authentication processing information is read at a period of the period, the number of authentication processing information for each authentication server is totaled, and the aggregation / averaging unit 130 for obtaining the average, and the aggregation value and the average value obtained by the aggregation / averaging unit 130 are stored. Which authentication server should be selected by each edge node 300 from the information stored in the total value storage unit 140 and the total value storage unit 140, and the result is sent to the authentication server 200 via the transmission / reception unit 210 as connection destination authentication server information. It is comprised from the server selection part 150 to notify.

  FIG. 8 shows an example of the authentication processing information storage unit of the authentication request aggregation / averaging server in one embodiment of the present invention.

  The authentication processing information storage unit 120 accumulates the authentication information acquired from the plurality of authentication servers 200 connected to the authentication request aggregation / averaging server 100 for each authentication server. In the example of the figure, authentication information of authentication servers A, B, and C is stored.

  FIG. 9 shows an example of the selected authentication server information storage unit of the authentication request aggregation / averaging server in one embodiment of the present invention.

  The selected authentication server information storage unit 160 shown in the figure stores an edge node and an identifier of the authentication server to be selected for each authentication server 200 selected by the server selection unit 150.

  The edge node 300 acquires an authentication server selection setting request from the authentication server 200, and sends an authentication request to the authentication server indicated in the request.

  FIG. 10 shows the configuration of an edge node in an embodiment of the present invention.

  The edge node 300 includes a transmission / reception unit 310 that performs communication between the authentication server 200 and the user terminal 400, and an authentication destination authentication server storage unit 320 that stores an authentication server selection setting request acquired from the authentication server 200. .

  FIG. 11 shows an example of the authentication destination authentication server storage unit according to the embodiment of the present invention.

  The authentication destination authentication server storage unit 320 stores authentication server identifiers in the priority order in which authentication requests are made.

  The storage unit of each component described above is a storage medium such as a memory or a hard disk.

  Next, processing in the above configuration will be described.

  FIG. 12 is a diagram for explaining processing in one embodiment of the present invention, and FIG. 13 is a sequence chart of processing in one embodiment of the present invention. FIG. 14 is a diagram showing a data flow in one embodiment of the present invention. The step numbers shown in FIGS. 12 and 14 correspond to the step numbers in the sequence chart of FIG.

  Step 101) The authentication server 200 receives the authentication request received from the edge node 300 and stores it in the authentication request storage unit 220 in order, and the authentication processing unit 230 reads the authentication request from the authentication request storage unit 220 and performs authentication. Processing is performed, and the result is stored in the authentication processing information storage unit 240. The transmission / reception unit 210 reads out the authentication result from the authentication processing information storage unit 240 at a predetermined cycle and transmits it to the authentication request aggregation / averaging server 100.

  Step 102) In the authentication request aggregation / averaging server 100, the transmission / reception unit 110 receives the authentication result from the authentication server 200, and stores it in the authentication processing information storage unit 120 in association with the identifier of each authentication server as shown in FIG. To do. The aggregation / averaging unit 130 reads out the authentication results from the authentication processing information storage unit 120 in a period of a certain period, totals the number of authentication results for each authentication server, obtains the average value of the values, The value is stored in the total value storage unit 140. Next, the server selection unit 150 distributes the load of the authentication server 200 based on the average value of the total value storage unit 140.

For example, when there is an authentication request shown in FIG. 12B, the total value of the authentication server A is 100 + 50 + 10 = 160, which is the most loaded. Further, the total value of the authentication server B is 30 + 40 + 30 = 100, and the total value of the authentication server C is 5 + 20 + 15 = 40. When these are averaged, the average value of the number of authentication requests of the authentication servers A, B, and C is 100. Thus, in order to distribute the load, the server selection unit 150 selects “A” → “C” as the authentication server to be selected by the edge node b, and “A” → “C” as the authentication server to be selected by the edge node c. Change as follows. As a result, the number of new total authentication requests of each authentication server 200 is as shown in FIG.
Authentication server A: 100
Authentication server B: 100
Authentication server C: 100
And the load is evenly distributed. In this way, the newly selected authentication server is associated with each edge node and stored in the selected authentication information storage unit 160. In the example of FIG. 12B, the authentication server to be selected by the edge nodes 300b and 300c is changed from “A” to “C”.

  Step 103) The transmission / reception unit 110 of the authentication request aggregation / averaging server 100 notifies the authentication server 200 of the combination of the edge node and the authentication server read from the selected authentication information storage unit 160 as an authentication request number average value result.

  Step 104) When the authentication server 200 obtains the authentication request average value result from the authentication request totaling / averaging server 100, the selected authentication server information storage unit 260, as shown in FIG. Stores the identifier. The transfer control unit 250 acquires the identifier of the authentication server corresponding to the distribution-destination edge node 400, and notifies the edge node 400 from the transmission / reception unit 210 as an authentication server selection setting request.

  Step 105) The edge server 400 receives the authentication server selection setting request from the authentication server 200, and stores it in the authentication destination authentication server storage unit 320. Thereby, an authentication request is sent to the authentication server stored in the authentication destination authentication server storage unit 320 from the next time.

  The operation of each component of the authentication request condition / averaging server 100, authentication server 200, and edge router 300 shown in FIGS. 7, 4, and 10 is constructed as a program, and these authentication request conditions / averaging are performed. It can be installed and executed on a computer used as a server, an authentication server, or an edge router, or distributed via a network.

  Further, the constructed program can be stored in a portable storage medium such as a hard disk, a flexible disk, or a CD-ROM, and can be installed or distributed in a computer.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

  The present invention is applicable to a network that can add the method of the present invention to a general load balancing method.

100 authentication request condition / averaging server 110 authentication request averaging result notifying unit, transmission / reception unit 120 authentication processing information storage unit 130 tabulation / averaging unit, tabulation / averaging unit 140 tabulation value storage unit 150 server selection unit 160 selection authentication server Information storage unit 200 Authentication server 210 Transmission / reception unit 220 Authentication request storage unit 230 Authentication processing unit 240 Authentication processing information storage unit 250 Transfer means, transfer control unit 260 Selected authentication server information storage unit 300 Edge router, edge node 310 Transmission / reception unit 320 Destination Change means, authentication destination authentication server storage unit

Claims (8)

In an IP network, when authentication processing is performed by transmitting / receiving authentication request information from a user terminal by signal transmission / reception between an edge node and an authentication server arranged in the network, the load of the authentication server is distributed. A method,
A load distribution device that performs control to distribute the load of the authentication server,
The authentication server receives authentication processing information for which authentication processing has been performed in response to an authentication request, totals the number of authentication processing information of all the authentication servers, and a totaling / averaging step of averaging the total value of the authentication processing information;
Based on the average value, the number of authentication processing information is allocated so that the number of pieces of authentication processing information is the average value or approximates the average value, and the authentication to be selected by the edge node based on the distributed value An authentication server determination step of determining a server, associating the determined authentication server with an edge node, and storing the authentication request in a storage unit as an authentication request averaging result;
An authentication request averaging result notifying step of notifying the authentication request averaging result to the authentication server stored in the storage means;
And
The authentication server is
Performing a transfer step of transmitting the authentication request averaging result received from the load balancer to an edge node;
The edge node is
A load distribution method for authentication servers, comprising: performing a connection destination change step of changing a connection destination authentication server based on the authentication request averaging result received from the authentication server. The aggregation / averaging step in the load balancer is:
The load distribution of the authentication server according to claim 1, wherein the received authentication processing information is stored in an authentication processing information storage unit, the authentication processing information for a certain period is read from the authentication processing information storage unit, and aggregation and averaging are performed. Method. In the authentication server,
2. The load distribution method for an authentication server according to claim 1, wherein the authentication process information is stored in an authentication process information storage unit, and the authentication process information is read at a predetermined period and transmitted to the load balancer. An IP network has an edge node and an authentication server, and when authentication processing is realized by transmitting and receiving authentication request information from a user terminal by signal transmission / reception between the edge node and the authentication server arranged in the network. An authentication server load distribution system for distributing a load,
A totaling / averaging means for receiving the authentication processing information for which the authentication server has performed the authentication processing for the authentication request, totaling the number of authentication processing information of all the authentication servers, and averaging the total value of the authentication processing information;
Based on the average value, the number of authentication processing information is allocated so that the number of pieces of authentication processing information is the average value or approximates the average value, and the authentication to be selected by the edge node based on the distributed value An authentication server determination unit that determines a server, associates the determined authentication server with an edge node, and stores the authentication request in the storage unit as an authentication request averaging result;
An authentication request averaged result notifying unit for notifying the authentication request averaged result to the authentication server stored in the storage unit;
The authentication server is
Transfer means for transmitting the authentication request averaging result received from the load balancer to an edge node;
The edge node is
A load distribution system for an authentication server, comprising: a connection destination changing unit that changes a connection destination authentication server based on the authentication request averaging result received from the authentication server. The aggregation / averaging means of the load balancer is:
5. The authentication server according to claim 4, further comprising means for storing the received authentication processing information in authentication processing information storage means, reading out the authentication processing information for a predetermined period from the authentication processing information storage means, and summing up and averaging the information. Load balancing system. The authentication server is
5. The load distribution system for an authentication server according to claim 4, further comprising means for storing the authentication process information in an authentication process information storage unit, reading the authentication process information at a predetermined period, and transmitting the information to the load distribution apparatus. . In an IP network, a load distribution device that distributes the load of an authentication server when authentication processing is performed by transmitting and receiving authentication request information from a user terminal by transmitting and receiving signals between an edge node arranged in the network and the authentication server. And
Receiving means for receiving authentication processing information for which the authentication server has performed authentication processing in response to an authentication request, and storing the received information in authentication processing information storage means;
Reading out the authentication processing information for a certain period from the authentication information storage means, totaling the number of authentication processing information of all authentication servers, and a totaling / averaging means for averaging the total value of the authentication processing information;
Based on the average value, the number of authentication processing information is allocated so that the number of pieces of authentication processing information is the average value or approximates the average value, and the authentication to be selected by the edge node based on the distributed value An authentication server determination unit that determines a server, associates the determined authentication server with an edge node, and stores the authentication request in the storage unit as an authentication request averaging result;
Result notifying means for changing the authentication server connected to the edge node by notifying the edge node of the authentication request averaging result via the authentication server stored in the storage means;
A load balancer comprising:   The load distribution program for functioning a computer as each means which comprises the load distribution apparatus of Claim 7.

Images