JP2012034259A - Tunnel termination system, tunnel termination method, tunnel termination controller, tunnel termination control method and program therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique capable of scale-out of a tunnel termination device without stopping communication.SOLUTION: A center side tunnel termination system 10a includes: a first processor 11 for transmitting and receiving packets including call control signals for establishing a tunnel using IPsec to/from a terminal 20A through a third processor 13, and generating tunnel termination information for terminating the tunnel; a second processor 12 for executing the termination processing of the packets received from the terminal 20A through the third processor 13 on the basis of the tunnel termination information received from the first processor 11; and the third processor 13 for transferring the packets including the call control signals to the first processor 11 and transferring the packets passing through the tunnel to the second processor 12, on the basis of header information of the packets received from the terminal 20A by flow control.

Description

  The present invention relates to a tunnel termination technique using IPsec (Security Architecture for Internet Protocol).

  The tunnel termination device can encapsulate data using a tunneling protocol as a communication protocol, thereby establishing a tunnel with the opposing tunnel termination device and transparently connecting the tunnel termination devices. For example, as shown in FIG. 6, there is a form in which a number of terminals (tunnel termination devices) connected to the access network are simultaneously connected to the center side tunnel termination device (tunnel termination device deployed at the center site) (non- Patent Document 1). This connection form is referred to as a Hub-Spoke type connection. In this Hub-Spoke connection, each terminal establishes a tunnel with the center-side tunnel termination device according to the IPsec protocol before communicating with the center-side network. Each terminal can pass through the access network using a tunnel and connect to the center side network.

  In IPsec, data can be prevented from being falsified or concealed in units of IP (Internet Protocol) packets using encryption technology. IPsec is composed of three protocols: integrity guarantee and authentication by AH (Authentication Header), data encryption by ESP (Encapsulated Security Payload), and key exchange by IKE (Internet Key Exchange) and the like. IKE includes IKEv1 defined in RFC (Request for Comments) 2409 and IKEv2 in which the vulnerability of IKEv1 is improved (see Non-Patent Document 2).

  In IPsec, in order to establish a tunnel, an agreement is first made on a data exchange method and a protection method using IKE (for example, IKEv2). This procedure is executed by the exchange (request / response) of IKE_SA_INIT, and the agreed agreement is referred to as IKE SA (Security Association). IKEv2 includes parameter negotiations such as algorithms for encryption and message authentication, generation of encryption keys / authentication keys using the Diffie-Hellman mechanism, user authentication using ID passwords, etc. Features are included. Next, establishment of CHILD SA for protecting data to be transmitted and authentication of the other party are performed by exchange (request / response) of IKE_AUTH. Thereafter, data is transmitted / received through the established tunnel while data to be transmitted is protected using ESP or AH using the established CHILD SA. These SAs (IKE SA and CHILD SA) are held in both the center-side tunnel terminating device and the terminal that transmit and receive data until the tunnel is deleted.

Takeo Okuyama, “Practice Internet VPN construction”, [online], February 8, 2010, [Search July 5, 2010], Internet <URL: http://ascii.jp/elem/000 / 000/495/495978 / ＞ C. Kaufman, “Internet Key Exchange (IKEv2) Protocol”, IETF, RFC4306

  In the Hub-Spoke connection, there is a problem that the traffic processed by the center-side tunnel terminator increases and the transfer capability of the center-side tunnel terminator becomes insufficient. In this case, it is conceivable to solve the shortage of transfer capability by adding another center-side tunnel termination device and distributing the load with the existing center-side tunnel termination device.

  However, when IPsec is used, the added center-side tunnel termination device must generate a new SA with the terminal. That is, there is a problem that a new tunnel needs to be established between the added center-side tunnel termination device and the terminal, and communication is temporarily interrupted at that time.

  Therefore, the present invention provides a technique that enables the scale-out of a tunnel termination device (increasing the number of devices or components having the same function for load distribution) without interrupting communication. Is an issue.

  The present invention provides a tunnel termination system that establishes a tunnel for each of the terminals using IPsec with a terminal that transmits and receives a packet, and performs termination processing for terminating the tunnel, in order to establish the tunnel In order to establish a SA with the terminal and execute a termination process based on the SA by transmitting / receiving a packet including the call control signal to / from the terminal via the third processing device. Generating tunnel termination information to be used, storing the tunnel termination information in a storage unit, acquiring the tunnel termination information replicated by the first processing device and the first processing device, and replicating the tunnel termination information; A second processing device for performing termination processing of the packet received from the terminal via the third processing device based on the tunnel termination information; and the terminal The third processing device transfers the packet including the call control signal to the first processing device and transfers the packet passing through the tunnel to the second processing device based on the header information of the packet received from And.

  The present invention also relates to a tunnel termination method used in a tunnel termination system that establishes a tunnel for each terminal using IPsec and performs termination processing to terminate the tunnel with a terminal that transmits and receives packets. Then, the tunnel termination system transmits a packet including a call control signal for establishing the tunnel to the first processing step based on the header information of the packet received from the terminal, and has passed through the tunnel. A third processing step for transmitting a packet to the second processing step; and a packet including the call control signal is transmitted to and received from the terminal via the third processing step, and an SA is transmitted to the terminal. And generates tunnel termination information used to execute termination processing based on the SA, and the tunnel termination information is A first processing step of storing in the storage unit and replicating the tunnel termination information; acquiring the tunnel termination information replicated by the first processing step; and the third processing step based on the tunnel termination information And a second processing step of executing termination processing of the packet received from the terminal via the terminal.

  According to such a configuration, the tunnel termination system can execute termination processing for terminating the tunnel in the second processing device based on the tunnel termination information generated by the first processing device. That is, conventionally, the tunnel termination information of the tunnel established between the first processing device and the terminal cannot be applied to devices other than the first processing device, for example, the second processing device. However, in the present invention, the second processing device acquires the tunnel termination information duplicated by the first processing device, and receives the packet that has passed through the tunnel terminated by the tunnel termination information via the third processing device. Therefore, termination processing for terminating the tunnel can be executed. That is, this tunnel termination system can terminate the tunnel by a second processing device different from the first processing device that established the tunnel. Therefore, since it is not necessary for the second processing device to newly establish a tunnel with the terminal using IPsec, it is possible to scale out the second processing device without interrupting communication.

  The present invention provides a tunnel termination system that establishes a tunnel for each of the terminals using IPsec with a terminal that transmits and receives a packet, and performs termination processing for terminating the tunnel, in order to establish the tunnel In order to establish a SA with the terminal and execute a termination process based on the SA by transmitting / receiving a packet including the call control signal to / from the terminal via the third processing device. First processing apparatus that generates tunnel termination information to be used, stores the tunnel termination information in a storage unit, duplicates the tunnel termination information, and transmits instruction information indicating a transfer destination of a packet that has passed through the tunnel And acquiring the tunnel termination information duplicated by the first processing device, and based on the tunnel termination information, passing through the third processing device and the end Based on header information of the packet received from the terminal, the packet including the call control signal is transferred to the first processing device based on two or more second processing devices that perform termination processing on the packet received from the terminal. And a third processing device for transferring a packet that has passed through the tunnel to the second processing device based on the instruction information received from the first processing device, wherein the first processing device includes the tunnel The second processing device that replicates termination information to any one of two or more of the second processing devices, and duplicates the tunnel termination information as the transfer destination of the packet to be terminated based on the tunnel termination information. The instruction information indicating that is transmitted to the third processing device.

  According to such a configuration, the tunnel termination system executes packet termination processing based on the tunnel termination information generated in the first processing device, with the second processing device considered to be the most concentrated load as an independent function. It has a configuration. That is, the second processing device acquires the tunnel termination information copied by the first processing device, and receives the packet that has passed through the tunnel terminated by the tunnel termination information via the third processing device. Termination processing for terminating the tunnel can be executed. That is, this tunnel termination system can terminate the tunnel by a second processing device different from the first processing device that has established the tunnel. Therefore, since it is not necessary for the second processing device to newly establish a tunnel with the terminal using IPsec, the tunnel termination system includes two or more second processing devices in parallel (scaled out), By replicating the tunnel termination information to any of the second processing devices and taking charge of termination processing, the tunnel termination system can be scaled out without interrupting communication.

  The present invention transmits / receives a packet including a call control signal for establishing a tunnel to / from a terminal that transmits / receives a packet via the third processing device for each terminal using IPsec. The tunnel termination information established with the terminal and used to execute termination processing based on the SA is generated, the tunnel termination information is stored in a storage unit, and the tunnel termination information is duplicated, A tunnel termination control device that transmits instruction information that instructs a transfer destination of a packet that has passed through a tunnel; and the tunnel termination control device that is replicated by the tunnel termination control device, acquires the tunnel termination information based on the tunnel termination information, and Two or more second processing devices for performing termination processing of the packet received from the terminal via three processing devices, and before receiving from the terminal Based on the header information of the packet, the packet including the call control signal is transferred to the tunnel termination control device, and the packet that has passed through the tunnel based on the instruction information received from the tunnel termination control device is A tunnel termination control device used in a tunnel termination system configured by the third processing device to be transferred to a processing device, wherein the packet including the call control signal is routed through the third processing device. A call processing unit for transmitting / receiving data to / from a terminal, generating tunnel termination information used for terminating the tunnel, and storing the tunnel termination information in a storage unit; and two or more second processes A load monitoring unit that acquires each processing load value from the apparatus and a processing load value acquired from the second processing apparatus are compared with each other. An allocating unit that determines the second processing device having the minimum processing load value, and a tunnel termination information duplicating unit that replicates the tunnel termination information in the storage unit to the second processing device determined by the allocating unit. And a flow for transmitting the instruction information indicating that the transfer destination of the packet to be terminated based on the tunnel termination information is the second processing device copied with the tunnel termination information to the third processing device A control instruction unit.

  In addition, the present invention transmits / receives a packet including a call control signal for establishing a tunnel to / from a terminal that transmits / receives a packet via the third processing device for each terminal using IPsec, An SA is established with the terminal, tunnel termination information used to execute termination processing based on the SA is generated, the tunnel termination information is stored in a storage unit, and the tunnel termination information is replicated. A tunnel termination control device that transmits instruction information indicating a transfer destination of a packet that has passed through the tunnel, and the tunnel termination information copied by the tunnel termination control device is acquired, based on the tunnel termination information, Two or more second processing devices that perform termination processing of the packet received from the terminal via the third processing device, and received from the terminal Based on the header information of the packet, the packet including the call control signal is transferred to the tunnel termination control device, and the packet that has passed through the tunnel based on the instruction information received from the tunnel termination control device is A tunnel termination control method of the tunnel termination control device used in a tunnel termination system configured by a third processing device transferred to a second processing device, wherein the tunnel termination control device includes the call control signal A call that transmits / receives a packet to / from the terminal via the third processing device, generates tunnel termination information used to perform termination processing on the packet, and stores the tunnel termination information in a storage unit A processing step and a load monitoring step of acquiring a value of each processing load from two or more second processing devices An allocation step of comparing the processing load values acquired from the second processing device to determine the second processing device having the minimum processing load value; and the second processing device determined by the allocation step A tunnel termination information duplicating step for duplicating the tunnel termination information in the storage unit; and a transfer destination of a packet to be terminated based on the tunnel termination information, and the second processing device in which the tunnel termination information is duplicated. And a flow control instruction step for transmitting the instruction information indicating that the instruction information is to be transmitted to the third processing apparatus.

  According to such a configuration, the tunnel termination control device constituting the tunnel termination system obtains the processing load value of the second processing device, and terminates the second processing device having the minimum processing load value. Control can be performed. That is, load distribution of the second processing apparatus can be achieved. Therefore, the tunnel termination system including such a tunnel termination control device enables the tunnel termination system to be scaled out without interrupting communication.

  In the present invention, the tunnel termination control device further includes the storage unit storing the threshold value of the processing load, and the allocation unit acquires the processing load value acquired from the second processing device as the threshold value. If it is determined whether the processing load value exceeds the threshold, the second processing device having the minimum processing load value is determined as a change destination, and the tunnel termination point is determined. The information duplicating unit, for a part of the tunnel established by the second processing apparatus that has been determined that the value of the processing load exceeds the threshold, changes the tunnel termination information of the part of the tunnel to the change destination And the flow control instruction unit sets the instruction information as the second processing device that replicates the tunnel termination information as a transfer destination of a packet to be terminated based on the replicated tunnel termination information. And transmits to the third processing unit.

  Further, according to the present invention, the tunnel termination control device further includes the storage unit that stores a threshold value of the processing load. In the assignment step, the value of the processing load acquired from the second processing device is It is determined whether or not a threshold value is exceeded, and when it is determined that the processing load value exceeds the threshold value, the second processing device having the minimum processing load value is determined as a change destination, In the tunnel termination information duplicating step, for a part of the tunnel established by the second processing apparatus determined that the value of the processing load exceeds the threshold, the tunnel termination information of the part of the tunnel is stored in the tunnel termination information replication step. In the flow control instruction step, the transfer destination of the packet to be terminated based on the copied tunnel termination information is changed to the second process in which the tunnel termination information is duplicated. The instruction information for the device and transmits to the third processing unit.

  According to such a configuration, the tunnel termination control device acquires the processing load value of the second processing device, determines whether or not the acquired processing load value exceeds a threshold, and acquires the acquired processing load. When the value of exceeds the threshold value, a part of the termination process can be changed to another second processing apparatus. That is, load distribution of the second processing apparatus can be achieved. Therefore, the tunnel termination system including such a tunnel termination control device enables the tunnel termination system to be scaled out without interrupting communication.

  In the present invention, the tunnel termination control method is a program for causing the tunnel termination control device, which is a computer, to execute. A computer in which such a program is installed can realize functions based on this program.

  ADVANTAGE OF THE INVENTION According to this invention, the technique which enables the scale-out of a tunnel termination apparatus can be provided, without interrupting communication.

It is a figure which shows the structural example of the center side tunnel termination | terminus system in this embodiment. It is a figure which shows the structural example at the time of performing scale out of a 2nd processing apparatus. It is a figure which shows the function example of each apparatus which comprises a center side tunnel termination | terminus system. It is a figure which shows the example of a sequence which establishes a tunnel in this embodiment. It is a figure which shows the accommodation change sequence example of the tunnel in this embodiment. It is a figure which shows the conventional Hub-Spoke type connection.

  A mode for carrying out the present invention (hereinafter referred to as “the present embodiment”) will be described in detail with reference to the drawings as appropriate. In the present embodiment, a case of establishing a tunnel using IKEv2 in IPsec will be described by taking an example of a Hub-Spoke type connection.

First, in order to realize the scale-out of the center side tunnel termination system (tunnel termination system), the center side tunnel termination system (corresponding to the center side tunnel termination device shown in FIG. 6) has the following configuration. An example of the configuration will be described with reference to FIG.
As shown in FIG. 1, terminals (tunnel termination devices) 20 (20A, 20B, 20C) connected to the access network 30 send and receive call control signals to and from the center side tunnel termination system 10 to establish a tunnel. The main signal (data passing through the tunnel) is transmitted to the center side network 31 through the tunnel. Here, the case where the terminal 20A transmits / receives a packet to / from the center side tunnel termination system 10 among any of the terminals 20 will be described.

First, the terminal 20A establishes a tunnel by exchanging call control signals with the center-side tunnel termination system 10, that is, exchanging IKE_SA_INIT and IKE_AUTH. Then, the terminal 20A transmits the main signal to the center side network 31 through the established tunnel.
At this time, among the processes of the center side tunnel termination system 10, the processes with the highest load are the process of encapsulating or decapsulating the main signal with the ESP header, and the encryption or decryption of the payload of the packet. It can be considered as a process for performing the conversion, that is, a termination process. Therefore, it is possible to scale out the apparatus that executes the termination processing.

That is, the center side tunnel termination system 10 is composed of the following three devices.
The first device is the first processing device 11. The first processing device 11 transmits / receives a packet including a call control signal for establishing a tunnel to / from the terminal 20A via the third processing device 13, and executes a termination process for terminating the tunnel. Generate tunnel termination information to be used. And the 1st processing apparatus 11 memorize | stores tunnel termination | terminus information in a memory | storage part (after-mentioned), and performs establishment, maintenance, and cancellation | release of a tunnel. The tunnel termination information is a shared secret key determined by SA, SPI (Security Parameters Index), or the like. Then, the first processing device 11 replicates the generated tunnel termination information to the second processing device 12 (described later) that has designated the accommodation of the tunnel. Further, the first processing device 11 instructs the third processing device 13 (described later) to transfer the main signal passing through the tunnel to the second processing device 12.

  The second device is the second processing device 12. The second processing device 12 acquires the tunnel termination information copied by the first processing device 11, and performs termination processing on the main signal received via the third processing device 13 based on the tunnel termination information. Execute. And the processing capacity of termination processing can be increased by adding the second processing device 12.

  The third device is the third processing device 13. The third processing device 13 identifies the IP header, protocol number, IP address, port number, etc., transfers the call control signal to the first processing device 11, and transfers the main signal to the second processing device 12. The third processing device 13 performs a transfer process using OpenFlow. OpenFlow is a type of flow control, and defines a series of communications determined by a combination of a MAC address, an IP address, a port number, and the like as a “flow”, and realizes path control in units of flows.

Note that the same IP address is set in both the first processing device 11 and the second processing device 12 of the center side tunnel termination system 10. This is because the tunnel termination information generated by the first processing device 11 can be replicated in the second processing device 12 and operated. In addition, even if the same IP address is set in both the first processing device 11 and the second processing device 12, the third processing device 13 distributes the packet transfer destination. The associated network problems do not occur. However, since the MAC addresses of the physical interfaces of the first processing device 11 and the second processing device 12 are different, the third processing device 13 executes processing for rewriting the destination MAC address of the packet.
In this way, the center-side tunnel termination system 10 is composed of three devices.

Next, the configuration when the second processing device 12 that is considered to be the most concentrated in processing is scaled out will be described with reference to FIG. In addition, in the same case as FIG. 1, the same code | symbol is attached | subjected and description is abbreviate | omitted.
In the center-side tunnel termination system 10a of FIG. 2, the difference from FIG. 1 is that there are two second processing devices 12 (12A, 12B), and the third processing devices 13, 14 are on the access network 30 side (terminal side) and This is provided on the center side network 31 side (center side). This is because the first processing device 11 and the second processing device 12 of the center side tunnel termination system 10a are not distinguished from each other when viewed from the center side network 31. Also, the first processing device 11 determines which of the second processing devices 12 (12A, 12B) to establish the tunnel, and based on the determination, the first processing device 11 sends a tunnel termination to the second processing device 12 (12A, 12B). Duplicate information. In addition, the first processing device 11 transmits instruction information (hereinafter also referred to as flow control instruction information) for transferring a packet passing through a tunnel terminated by the tunnel termination information to the second processing device 12 that duplicates the tunnel termination information. ) Is transmitted to the third processing devices 13 and 14.
In FIG. 2, only two second processing devices 12 are illustrated, but the number is not limited to two, and the number may be changed according to the state of the processing load.

In the configuration shown in FIG. 2, the first processing device 11 receives information on each processing load (for example, CPU (Central Processing Unit) usage rate and interface usage rate) from each second processing device 12 (12A, 12B). get. Then, the first processing device 11 determines whether or not the acquired processing load value exceeds a preset threshold value. For example, it is assumed that the first processing device 11 determines that the value of the processing load acquired from the second processing device 12A exceeds the threshold value. In this case, the first processing device 11 selects a predetermined percentage of the number of tunnels among the tunnels established (accommodated) by the second processing device 12A, and the tunnel termination for the selected tunnel. The information is copied to the second processing device 12B. That is, the first processing device 11 changes the accommodation of the tunnel from the second processing device 12A to the second processing device 12B. However, the ratio of the number of tunnels to be changed to the number of tunnels already accommodated in the second processing apparatus 12A may be increased as the value of the processing load increases.
The first processing device 11 stores the tunnel termination information in association with the second processing device 12 that is the replication destination of the tunnel termination information in a tunnel termination information DB 116 described later. When the accommodation of the tunnel is changed from the second processing device 12A to the second processing device 12B, the tunnel termination information of the tunnel is deleted from the second processing device 12A. In addition, with the deletion, the first processing device 11 releases the association between the tunnel termination information and the second processing device 12 that is the replication destination of the tunnel termination information.
Then, the first processing device 11 transmits the flow control instruction information to the third processing devices 13 and 14 based on the tunnel accommodation change, and changes the main signal to pass through the second processing device 12B.

Here, each function of the 1st processing apparatus 11, the 2nd processing apparatus 12, and the 3rd processing apparatus 13 is demonstrated using FIG. 3 (refer FIG. 2 suitably).
As illustrated in FIG. 3, the first processing device 11 includes a call processing unit 111, a load monitoring unit 112, an allocation unit 113, a tunnel termination information replication unit 114, and a flow control instruction unit 115. The first processing device 11 includes a processing unit including a CPU and a main memory (not shown) and a storage unit that stores application programs and the like. The processing unit develops the application program stored in the storage unit in the main memory, and includes a call processing unit 111, a load monitoring unit 112, an allocation unit 113, a tunnel termination information replication unit 114, and a flow control instruction unit 115. To embody. The tunnel termination information DB 116 and the load threshold 117 are stored in the storage unit.

The call processing unit 111 transmits / receives a call control signal to / from the terminal 20, generates tunnel termination information, stores it in the tunnel termination information DB 116 of the storage unit, and executes call processing related to tunnel establishment, maintenance, and release. The tunnel termination information DB 116 stores the tunnel termination information and the second processing device 12 that is a copy destination of the tunnel termination information in association with each other.
The load monitoring unit 112 acquires the processing load state (processing load value) from each second processing device 12 periodically or in accordance with an instruction from the administrator.
The allocating unit 113 acquires the value of the processing load of each second processing device 12 from the load monitoring unit 112. Then, the assigning unit 113 compares the processing load values acquired from the second processing devices, and assigns (determines) tunnel accommodation to the second processing device 12 having the smallest processing load value.
When the tunnel accommodation is changed, the allocating unit 113 determines whether or not the acquired processing load value exceeds the load threshold 117. Then, the allocating unit 113, for the second processing device 12 that has determined that the processing load value exceeds the load threshold 117, from among the tunnels accommodated by the second processing device 12, For the predetermined percentage of the number of tunnels, another second processing device 12 with the lowest load is assigned (determined) as the change destination.

The tunnel termination information duplication unit 114 duplicates the tunnel termination information of the tunnel to be changed to the second processing device 12 assigned as the change destination by the assignment unit 113.
The flow control instruction unit 115 transmits the flow control instruction information to the third processing device 13 so that the main signal passes through the tunnel accommodated by the assignment. Specifically, the flow control instruction unit 115 indicates flow control instruction information indicating that a transfer destination of a packet to be terminated based on the replicated tunnel termination information is the second processing device that has replicated the tunnel termination information. (Instruction information) is transmitted to the third processing apparatus.

The second processing device 12 includes a processing unit including a CPU and a main memory (not shown) and a storage unit that stores application programs and the like. The processing unit implements the termination processing unit 121 that executes the termination processing for terminating the tunnel by developing the application program stored in the storage unit in the main memory.
The termination processing unit 121 of the second processing device 12 acquires the tunnel termination information copied by the first processing device 11, and executes termination processing based on the tunnel termination information. Specifically, a process of adding an ESP header to the main signal and encapsulating, or a process of deleting the ESP header and decapsulating is executed. Further, the second processing device 12 executes encryption and decryption of data stored in the packet payload based on the shared secret key included in the tunnel termination information.

The third processing device 13 receives flow control instruction information from the first processing device 11. Then, the flow control unit 131 (described later) of the third processing device 13 identifies the IP header, the protocol number, the IP address, the port number, etc. (packet header information) and performs the first processing on the packet including the call processing signal. The main signal is transferred to the second processing device 12 to which accommodation of the tunnel is assigned by the first processing device 11 based on the flow control instruction information.
Specifically, the third processing device 13 includes a flow control unit 131 including a flow switch (not shown) that transmits and receives packets and a control unit (not shown) that controls the flow switch. The control unit is configured by a processing unit including a CPU and a main memory (not shown) and a storage unit that stores application programs and the like. The processing unit develops the application program stored in the storage unit in the main memory and realizes its function. The flow switch includes a flow table that holds a flow entry notified from the control unit. In the flow entry, information on layers 2 to 4 for identifying the received packet and a process for a packet matching this information are described. Based on the flow entry, the flow switch executes processing such as transmitting the received packet from the designated physical port and rewriting the MAC address.

  Next, a sequence example for establishing a tunnel in the present embodiment will be described with reference to FIG. 4 (see FIGS. 2 and 3 as appropriate). In FIG. 4, a series of steps represented by S1 to S11 represents a sequence example for establishing a tunnel between the terminal 20A and the second processing device 12A. A series of steps represented by S21 to S31 represents a sequence example for establishing a tunnel between the terminal 20B and the second processing device 12B.

  First, the terminal 20A makes a tunnel establishment request in order to transmit the main signal to the center side network 31 (S1). Specifically, the terminal 20A transmits / receives an IKE_SA_INIT request and an IKE_SA_INIT response to / from the call processing unit 111 of the first processing device 11 via the flow control unit 131 of the third processing device (terminal side) 13. (S2, S3). Next, the terminal 20A transmits / receives an IKE_AUTH request and an IKE_AUTH response to / from the call processing unit 111 of the first processing device 11 via the flow control unit 131 of the third processing device (terminal side) 13 (S4). , S5). Then, the terminal 20A and the call processing unit 111 of the first processing device 11 respectively generate tunnel termination information (S6, S7; termination information generation).

  The load monitoring unit 112 of the first processing device 11 acquires information on the state of the processing load from each second processing device 12, and the tunnel processing is accommodated in the second processing device 12A in which the allocation unit 113 has the minimum processing load. Is assigned (S8). Next, the tunnel termination information replicating unit 114 of the first processing device 11 replicates the tunnel termination information to the second processing device 12A to which tunnel accommodation is assigned (S9). Further, the flow control instruction unit 115 of the first processing device 11 transmits the flow control instruction information to each of the third processing devices 13 and 14 (S10, S11; flow control instruction). Then, a tunnel is established between the terminal 20A and the second processing device 12A, and a packet (ESP packet) obtained by encapsulating the main signal with the ESP header is transmitted / received (S12).

  Next, the terminal 20B makes a tunnel establishment request in order to transmit the main signal to the center side network 31 (S21). Specifically, the terminal 20B transmits / receives an IKE_SA_INIT request and an IKE_SA_INIT response to / from the call processing unit 111 of the first processing device 11 via the flow control unit 131 of the third processing device (terminal side) 13. (S22, S23). Next, the terminal 20B transmits / receives an IKE_AUTH request and an IKE_AUTH response to / from the call processing unit 111 of the first processing device 11 via the flow control unit 131 of the third processing device (terminal side) 13 (S24). , S25). Then, the terminal 20B and the call processing unit 111 of the first processing device 11 respectively generate tunnel termination information (S26, S27; termination information generation).

  The load monitoring unit 112 of the first processing device 11 acquires information on the state of the processing load from each of the second processing devices 12, and the allocation unit 113 accommodates the tunnel in the second processing device 12B having the minimum processing load. Is assigned (S28). Next, the tunnel termination information replicating unit 114 of the first processing device 11 replicates the tunnel termination information to the second processing device 12B to which the accommodation of the tunnel is assigned (S29). Further, the flow control instruction unit 115 of the first processing device 11 transmits the flow control instruction information to each of the third processing devices 13 and 14 (S30, S31; flow control instruction). Then, a tunnel is established between the terminal 20B and the second processing device 12B, and a packet (ESP packet) obtained by encapsulating the main signal with the ESP header is transmitted / received (S32).

FIG. 5 shows a sequence example in which the tunnel between the terminal 20A and the second processing device 12A is accommodated and changed between the terminal 20A and the second processing device 12B.
A tunnel is established between the terminal 20A and the second processing device 12A, and a main signal (ESP packet) is transmitted and received (S41). The load monitoring unit 112 of the first processing device 11 acquires load information (processing load value) from the second processing device 12A (S42; load monitoring). Next, the allocating unit 113 of the first processing device 11 compares the acquired processing load value of the second processing device 12A with the load threshold value 117 and determines that the processing load value exceeds the threshold value. (S43; detection of excess of threshold). The allocation unit 113 of the first processing device 11 determines to change the accommodation of the tunnel between the terminal 20A accommodated in the second processing device 12A to the second processing device 12B having the smallest processing load. (S44).

  Next, the tunnel termination information replication unit 114 of the first processing device 11 replicates the tunnel termination information to the second processing device 12B to which the accommodation of the tunnel is assigned (S45). Further, the flow control instruction unit 115 of the first processing device 11 transmits the flow control instruction information to each of the third processing devices 13 and 14 (S46, S47; flow control instruction). The call processing unit 111 of the first processing device 11 deletes the tunnel termination information determined to change accommodation from the second processing device 12A (S48). Then, a tunnel is established between the terminal 20A and the second processing device 12B, and a packet (ESP packet) obtained by encapsulating the main signal with the ESP header is transmitted / received (S49).

As described above, the center-side tunnel termination system 10a described in the present embodiment includes the first processing device 11, the second processing device 12, and the third processing device 13. The first processing device 11 generates tunnel termination information. In addition, the first processing device 11 duplicates the tunnel termination information to the second processing device 12 and transmits the flow control instruction information to the third processing device 13. The second processing device 12 establishes a tunnel based on the tunnel termination information copied by the first processing device 11. The third processing device 13 identifies the header of the received packet, transfers the packet including the call processing signal to the first processing device 11, and the second processing device to which tunnel accommodation is assigned by the first processing device 11. 12 transmits the main signal. Conventionally, tunnel termination information of a tunnel established between the first processing device 11 and the terminal 20 cannot be applied to a device other than the first processing device 11, for example, the second processing device 12. However, in the present embodiment, the second processing device 12 acquires the tunnel termination information duplicated by the first processing device 11, and transmits the packet that has passed through the tunnel terminated by the tunnel termination information to the third processing device 13. Therefore, termination processing for terminating the tunnel can be executed. That is, the center side tunnel termination system 10a can terminate the tunnel by the second processing device 12 different from the first processing device 11 that has established the tunnel. Therefore, it is not necessary for the second processing device 12 to newly establish a tunnel with the terminal using IPsec.
With such a configuration, the center-side tunnel termination system 10a can scale out the second processing device 12 without interrupting communication in order to newly establish a tunnel.

  Also, since the center side tunnel termination system 10a can dynamically change the accommodation of the tunnel by the first processing device 11, the second processing device 12 can be changed to the N + m method (current N / spare m method; for example, m <N). Therefore, the center-side tunnel termination system 10a can be realized at a lower cost compared to the case where the center-side tunnel termination apparatus is configured by a plurality of units (for example, N units) in the 1 + 1 system (current 1 / standby 1 system).

  Further, the center side tunnel termination system 10a is separated from the first processing device 11 that processes the call control signal and the second processing device 12 and the third processing device 13 that process the main signal. It is possible to add functions and reboot the first processing device 11 without affecting transmission / reception of the main signal of a completed tunnel.

  Further, the first processing device 11 described in the present embodiment can be realized by causing a general computer to execute a program for each processing described above. The program can be provided via a communication line, or can be written and distributed on a recording medium such as a CD-ROM (Compact Disc-Read Only Memory).

10, 10a Center side tunnel termination system (tunnel termination system)
11 First processing device (tunnel end control device)
12 Second processing device 13 Third processing device 20 Terminal 30 Access network 31 Center side network 111 Call processing unit 112 Load monitoring unit 113 Allocation unit 114 Tunnel termination information replication unit 115 Flow control instruction unit 116 Tunnel termination information DB
117 Load threshold (processing load threshold)

Claims (8)

A tunnel termination system that establishes a tunnel for each terminal using IPsec (Security Architecture for Internet Protocol) with a terminal that transmits and receives packets, and executes termination processing to terminate the tunnel,
A packet including a call control signal for establishing the tunnel is transmitted / received to / from the terminal via a third processing device, and an SA (Security Association) is established with the terminal, and the SA Generating a tunnel termination information to be used for executing termination processing based on the first processing device, storing the tunnel termination information in a storage unit, and replicating the tunnel termination information;
A second process for acquiring the tunnel termination information copied by the first processing device and executing termination processing of the packet received from the terminal via the third processing device based on the tunnel termination information; Equipment,
Based on the header information of the packet received from the terminal, the packet including the call control signal is transferred to the first processing device, and the packet that has passed through the tunnel is transferred to the second processing device. A processing device;
A tunnel termination system comprising: A tunnel termination system that establishes a tunnel for each of the terminals using IPsec with a terminal that transmits and receives packets, and executes termination processing to terminate the tunnel,
A packet including a call control signal for establishing the tunnel is transmitted / received to / from the terminal via a third processing device, an SA is established with the terminal, and termination is performed based on the SA. Generate tunnel termination information used to execute processing, store the tunnel termination information in a storage unit, duplicate the tunnel termination information, and indicate instruction information that indicates a transfer destination of a packet that has passed through the tunnel. A first processing device to transmit;
The tunnel termination information duplicated by the first processing device is acquired, and based on the tunnel termination information, the termination processing of the packet received from the terminal via the third processing device is executed. A second processing device;
Based on the header information of the packet received from the terminal, the packet including the call control signal is transferred to the first processing device, and passes through the tunnel based on the instruction information received from the first processing device. The third processing device for transferring the received packet to the second processing device;
With
The first processing device copies the tunnel termination information to any one of the two or more second processing devices, and sets the transfer destination of a packet to be terminated based on the tunnel termination information as the tunnel termination information. A tunnel termination system, wherein the instruction information indicating that the second processing apparatus has copied information is transmitted to the third processing apparatus. A tunnel termination method used in a tunnel termination system for performing a termination process for terminating a tunnel by establishing a tunnel for each terminal using IPsec with a terminal that transmits and receives a packet,
The tunnel termination system is:
Based on the header information of the packet received from the terminal, a packet including a call control signal for establishing the tunnel is transmitted to the first processing step, and a packet passing through the tunnel is transmitted to the second processing step. A third processing step,
A packet including the call control signal is transmitted / received to / from the terminal via the third processing step, an SA is established with the terminal, and termination processing is performed based on the SA. A first processing step of generating tunnel termination information to be used for storing the tunnel termination information in a storage unit and replicating the tunnel termination information;
A second process for acquiring the tunnel termination information copied in the first processing step and executing the termination process of the packet received from the terminal via the third processing step based on the tunnel termination information; Steps,
The tunnel termination method characterized by performing. A packet including a call control signal for establishing a tunnel is transmitted / received to / from a terminal that transmits / receives a packet via a third processing device for each terminal using IPsec. The tunnel termination information that is established in between and used to execute termination processing based on the SA is generated, the tunnel termination information is stored in the storage unit, and the tunnel termination information is duplicated and passed through the tunnel. A tunnel termination control device that transmits instruction information for instructing a transfer destination of the received packet, and the tunnel termination information replicated by the tunnel termination control device. The third processing device is configured to acquire the tunnel termination information based on the tunnel termination information. Two or more second processing devices for performing termination processing of the packet received from the terminal via the terminal, and the packet received from the terminal Based on the header information, the packet including the call control signal is transferred to the tunnel termination control device, and the packet that has passed through the tunnel based on the instruction information received from the tunnel termination control device is transmitted to the second processing device. A tunnel termination control device used in a tunnel termination system comprising:
A packet including the call control signal is transmitted / received to / from the terminal via the third processing device, and tunnel termination information used to perform termination processing for terminating the tunnel is generated, and the tunnel termination is performed. A call processing unit for storing information in the storage unit;
A load monitoring unit that acquires the value of each processing load from two or more second processing devices;
An assigning unit that compares the processing load values acquired from the second processing device and determines the second processing device having the minimum processing load value;
A tunnel termination information replication unit that replicates the tunnel termination information of the storage unit to the second processing device determined by the allocation unit;
A flow control instruction for transmitting the instruction information indicating that the transfer destination of the packet to be terminated based on the tunnel termination information is the second processing device copied with the tunnel termination information to the third processing device And
A tunnel termination control device comprising: The tunnel termination control device further includes:
The storage unit storing a threshold value of the processing load;
The allocating unit determines whether or not the value of the processing load acquired from the second processing apparatus exceeds the threshold, and determines that the value of the processing load exceeds the threshold, the minimum Determining the second processing device having a processing load value as a change destination;
The tunnel termination information duplicating unit, for a part of the tunnel established by the second processing apparatus determined that the value of the processing load exceeds the threshold value, transmits tunnel termination information of the part of the tunnel. Duplicate to the change destination,
The flow control instruction unit transmits the instruction information to the third processing device, with the transfer destination of the packet to be terminated based on the duplicated tunnel termination information as the second processing device that duplicates the tunnel termination information. The tunnel termination control device according to claim 4, wherein: A packet including a call control signal for establishing a tunnel is transmitted / received to / from a terminal that transmits / receives a packet via a third processing device for each terminal using IPsec. The tunnel termination information that is established in between and used to execute termination processing based on the SA is generated, the tunnel termination information is stored in the storage unit, and the tunnel termination information is duplicated and passed through the tunnel. A tunnel termination control device that transmits instruction information for instructing a transfer destination of the received packet, and the tunnel termination information replicated by the tunnel termination control device. The third processing device is configured to acquire the tunnel termination information based on the tunnel termination information. Two or more second processing devices for performing termination processing of the packet received from the terminal via the terminal, and the packet received from the terminal Based on the header information, the packet including the call control signal is transferred to the tunnel termination control device, and the packet that has passed through the tunnel based on the instruction information received from the tunnel termination control device is transmitted to the second processing device. A tunnel termination control method of the tunnel termination control device used in a tunnel termination system configured by a third processing device that transfers to
The tunnel termination control device is:
A packet including the call control signal is transmitted / received to / from the terminal via the third processing device, tunnel termination information used to perform termination processing on the packet is generated, and the tunnel termination information is A call processing step stored in a storage unit;
A load monitoring step of acquiring values of respective processing loads from two or more second processing devices;
An allocation step of comparing the processing load values acquired from the second processing device and determining the second processing device having the minimum processing load value;
A tunnel termination information duplication step of duplicating the tunnel termination information of the storage unit to the second processing device determined by the allocation step;
A flow control instruction for transmitting the instruction information indicating that the transfer destination of the packet to be terminated based on the tunnel termination information is the second processing device copied with the tunnel termination information to the third processing device Steps,
The tunnel termination control method characterized by performing this. The tunnel termination control device further includes:
The storage unit storing a threshold value of the processing load;
In the allocating step, it is determined whether or not the value of the processing load acquired from the second processing device exceeds the threshold value. When it is determined that the value of the processing load exceeds the threshold value, Determining the second processing device having a processing load value as a change destination;
In the tunnel termination information replication step, the tunnel termination information of a part of the tunnels is established for a part of the tunnels established by the second processing device that is determined that the value of the processing load exceeds the threshold value. Duplicate to the change destination,
In the flow control instruction step, the instruction information is transmitted to the third processing device, where the transfer destination of the packet to be terminated based on the copied tunnel termination information is the second processing device that duplicates the tunnel termination information. The tunnel termination control method according to claim 6, wherein:   A program for causing the tunnel termination control device, which is a computer, to execute the tunnel termination control method according to claim 6 or 7.

Images