JP2013201478A - Network system, switch and communication delay reduction method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce a communication delay at proxy TCP connection which is performed by a switch in a network of a CD separation type, such as an open flow network.SOLUTION: A controller sets a flow entry, in which a rule and an action to control uniformly packets as a flow are defined, to each of a plurality of switches. On receipt of a SYN packet from a transmission source host, each switch requests the controller to calculate a route. Each switch, if it is a head switch on a communication route obtained as a result of the route calculation, performs proxy TCP connection to a transmission destination host. If the switch is not a head switch on the communication route, the switch transfers the SYN packet to perform proxy TCP connection between the head switch and the transmission destination host.

Description

  The present invention relates to a network system, and more particularly to a communication delay reduction method in a network system.

  A conventional network device is a black box, and cannot perform flexible control such as load distribution and offset from the outside. For this reason, when the scale of the network becomes large, it becomes difficult to understand and improve the behavior of the system, and there has been a problem that design and configuration changes are accompanied by a great cost.

  As a technique for solving such a problem, a technique for separating the packet transfer function and the path control function of a network device is considered. For example, the network device is in charge of the packet transfer function, and the control device in charge of the path control function outside the network device is in charge, thereby making it easy to control and building a flexible network. .

[Description of CD-separated network]
A CD (C: control plane / D: data plane) separation type network that controls a data plane side node device from a control plane side control device has been proposed as one of the networks having separated functions.

  As an example of the CD separation type network, there is an open flow network using an open flow technology that controls a switch from a controller to control a route of the network. The details of the open flow technique are described in Non-Patent Document 1. The OpenFlow network is only an example.

[Explanation of OpenFlow network]
In the OpenFlow network, an OpenFlow controller (OFC: OpenFlow Controller) corresponding to a control device operates a flow table related to path control of an OpenFlow switch (OFS: OpenFlow Switch) corresponding to a node device, thereby opening the OpenFlow switch. Control the behavior of (OFS).

  Hereinafter, for simplification of description, the OpenFlow controller (OFC) is referred to as “controller (OFC)”, and the OpenFlow switch (OFS) is referred to as “switch (OFS)”.

  The controller (OFC) and the switch (OFS) are connected by a “secure channel” (Secure Channel) that is a communication path protected by a dedicated line, SSL (Secure Socket Layer), or the like. The controller (OFC) and the switch (OFS) transmit and receive an OpenFlow message (OpenFlow Message) that conforms to the OpenFlow Protocol via the secure channel.

  The switches (OFS) in the OpenFlow network are edge switches and core switches that form an OpenFlow network and are under the control of the controller (OFC). A series of packet flows from reception (inflow) of a packet at the input side edge switch (Ingress) to transmission (outflow) at the output side edge switch (Egress) in the OpenFlow network is called a flow. .

  The packet may be read as a frame. The difference between a packet and a frame is only a difference in data units (PDU: Protocol Data Unit) handled by the protocol. The packet is a PDU of “TCP / IP” (Transmission Control Protocol / Internet Protocol). On the other hand, the frame is a PDU of “Ethernet (registered trademark)”.

  A flow table is a set of determination conditions (rules) for identifying packets handled as a flow, statistical information indicating the number of times a packet matches (matches) a rule, and processing contents (actions) to be performed on the packet. Is a set of flow entries.

  The rule of the flow entry is defined by various combinations using any or all of the information of each protocol layer included in the header area (field) of the packet and can be distinguished. As an example of information of each protocol layer, a transmission destination address (Destination Address), a transmission source address (Source Address), a transmission destination port (Destination Port), a transmission source port (Source Port), and the like can be considered. Note that the above addresses include a MAC address (Media Access Control Address) and an IP address (Internet Protocol Address). In addition to the above, information on the ingress port (Ingress Port) can also be used as a rule for the flow entry. In addition, as a rule of the flow entry, a part (or all) of a header area value of a packet handled as a flow can be set by a regular expression, a wild card “*”, or the like.

  The action of the flow entry indicates operations such as “output / transfer the packet to a specific port”, “discard / discard (delete) the packet”, and “rewrite the packet header”. For example, if the switch (OFS) shows output port identification information (output port number, etc.) in the action of the flow entry, the switch (OFS) outputs a packet to the corresponding port, and the output port identification information is shown. If not, discard the packet. Alternatively, if the header information is indicated in the action of the flow entry, the switch (OFS) rewrites the header of the packet based on the header information.

  The switch (OFS) executes a flow entry action on a packet group (packet series) that conforms to the rules of the flow entry. Specifically, when receiving the packet, the switch (OFS) searches the flow table for a flow entry having a rule that matches the header information of the received packet. As a result of the search, when a flow entry having a rule that matches the header information of the received packet is found, the flow entry statistical information is updated, and the operation specified as the action of the flow entry is performed on the received packet. carry out. On the other hand, if a flow entry having a rule that matches the header information of the received packet is not found as a result of the search, the received packet is determined to be the first packet (first packet), and in the OpenFlow network via the control channel. Transfers the received packet (or a copy thereof) to the controller (OFC), requests packet route calculation based on the source / destination (destination) of the received packet, etc., and sets a flow entry message as a response Is received and the flow table is updated.

  In the flow table, a default entry having a rule matching the header information of all packets with a low priority is registered. If no other flow entry that matches the received packet is found, the received packet matches this default entry. The action of the default entry is “transmission of inquiry information of the received packet to the controller (OFC)”.

[Security support for OpenFlow networks]
In recent years, the increase in network management costs accompanying the increase in network devices and the low flexibility of network configuration changes have been regarded as problems, and OpenFlow technology has been created as a technology to solve this problem.

  By concentrating the process of calculating and setting the packet route on the controller (OFC) by the OpenFlow technology, it is possible to configure an OpenFlow network that reduces management and configuration change costs compared to the existing network.

  However, in this open flow network, currently, a response to a DoS attack (Denial of Service attack) called a “SYN Flood” attack is not considered.

  The “SYN Flood” attack, which is one of the general attacks of the Dos attack, is an attack that exhausts server resources by stopping the TCP connection procedure in a halfway state. To establish a TCP connection between a client and a server, the client sends a “SYN packet” to the server, the server sends an “ACK packet” back to the client, and finally the client sends back an ACK packet. Step on. Until the last ACK packet arrives, the server side waits in a “waiting for response” state, and resources such as a memory area prepared for the connection cannot be released. If a malicious attacker sends a large number of SYN packets and intentionally leaves them without sending an ACK packet, the number of “response waiting” connections on the server side will exceed the limit and new connections will not be accepted. Become.

  When replacing an existing network with an OpenFlow network, it is necessary to cope with the “SYN Flood” attack, but it is difficult to apply an existing defense technique in the existing network as it is to the OpenFlow network. The reason will be described in detail below.

[Existing defense methods]
First, an existing defense technique against the “SYN Flood” attack will be described.

  There are roughly two types of defense methods. One is a defense method on the server side that is targeted for attack. The other is a defense technique on the network device side that forwards attack packets.

(1) Server-side defense methods As server-side defense methods, “SYN cookies”, “SYN cache”, and the like exist as conventional technologies.

(2) Network device side defense method Network device side defense method is based on the contents of the packet, such as a router (Router) or a load balancer (Load Balancer) that determines the forwarding destination of the received packet. As a conventional technique, a TCP connection (proxy TCP connection) with a packet transmission source host is performed instead of the target server, and an illegal connection or packet is detected and protected.

  However, when these defense techniques are applied to the OpenFlow network, new problems arise as follows in both the defense technique on the server side and the defense technique on the network device side.

(1) When using server-side defense methods In an OpenFlow network, the switch (OFS) corresponding to the network device itself does not match the flow entry that is the route information for deciding the packet forwarding destination. When the packet is received, the packet is transferred to the controller (OFC) in order to request the controller (OFC) for route calculation and setting. Therefore, when a switch (OFS) that performs packet forwarding processing receives a large amount of attack packets, a large amount of attack packets are forwarded to the controller (OFC), so the load on the controller (OFC) increases and packets are appropriately sent. It may become impossible to process.

(2) When the defense method on the network device side is used In the OpenFlow network, the switch (OFS) corresponding to the network device acts as a proxy for the packet destination host (server) as well as the existing defense method. It is necessary to perform proxy TCP connection with the transmission source host and also perform proxy TCP connection with the transmission destination host. However, when there are a plurality of switches (OFS) on the communication path, each switch (OFS) transfers the received packet after the proxy TCP connection is already established with each of the transmission source host and the transmission destination host. Cannot determine whether the packet is a bad packet. Accordingly, each switch (OFS) must individually make a proxy TCP connection with each of the transmission source host and the transmission destination host. Therefore, the problem that “the communication delay increases due to the standby time until all the proxy TCP connections of each switch (OFS) are established” occurs.

  However, when using a defense method on the network device side, the switch (OFS) itself can detect and protect against unauthorized connections and packets, so the “controller (OFC) The attack packet is forwarded to “) does not occur.

“OpenFlow Switch Specification, Version 1.1.0 Implemented”, [online], February 28, 2011, Internet (URL: http://www.openflowswitch.org/documents-openpf.1-1.0. )

  When considering the security of the controller (OFC) in charge of the control function in a network composed of network devices in which the packet transfer function and the path control function are separated as in the OpenFlow network, the “SYN” Considering the “Flood” attack countermeasure, it is conceivable to adopt a defense method by proxy TCP connection in the switch (OFS) in charge of the packet transfer function.

  However, it is difficult to apply the existing network defense method in which the switch performs proxy TCP connection with the source host instead of the server to the OpenFlow network as it is. For example, if there are multiple switches (OFS) on the packet communication path, the switch (OFS) transfers the received SYN packet after the proxy TCP connection has already been established with the source host or destination host. It is not possible to determine whether it is a received packet. Therefore, each switch (OFS) must individually make a proxy TCP connection with the transmission source host and the transmission destination host, and when waiting until the establishment of the proxy TCP connection of all the switches (OFS) is completed, a communication delay occurs. There has been a problem of increasing.

  The network system according to the present invention includes a plurality of switches and a controller that sets each of the plurality of switches with a flow entry in which rules and actions for uniformly controlling packets as flows are defined. When each switch receives a SYN packet from the source host, it requests the controller to calculate the route. When it is the first switch on the communication route obtained as a result of the route calculation, each switch acts as a proxy with the destination host. If the TCP connection is made and it is not the head switch on the communication path, a SYN packet for proxy TCP connection between the head switch and the destination host is transferred.

  When the switch according to the present invention receives a SYN packet from a transmission source host and a functional unit that processes a received packet according to a flow entry in which rules and actions for uniformly controlling the packet as a flow are defined A function unit that requests the path calculation to the controller that sets the flow entry, and a function unit that performs proxy TCP connection with the destination host in the case of the top switch on the communication path obtained as a result of the path calculation; If it is not the head switch on the communication path, a function unit is provided that transfers a SYN packet for proxy TCP connection between the head switch and the destination host.

  The communication delay reduction method according to the present invention is a communication delay reduction method implemented in a network system. In this communication delay shortening method, each of a plurality of switches processes received packets according to a flow entry in which rules and actions for uniformly controlling packets as flows are defined. Of the plurality of switches, the switch that receives the SYN packet from the transmission source host requests a route calculation to the controller that sets the flow entry. Of the plurality of switches, the head switch on the communication path obtained as a result of the path calculation makes a proxy TCP connection with the destination host. Of the plurality of switches, a switch other than the head switch on the communication path transfers a SYN packet for proxy TCP connection between the head switch and the destination host.

  The program according to the present invention includes (1) a step of processing a received packet in accordance with a flow entry in which rules and actions for uniformly controlling a packet as a flow are defined, and (2) a SYN from the transmission source host. When a packet is received, a step of requesting a route calculation to the controller that sets the flow entry, and (3) if it is the first switch on the communication route obtained as a result of the route calculation, a proxy with the destination host A step of performing TCP connection and (4) a step of transferring a SYN packet for proxy TCP connection between the head switch and the destination host when not the head switch on the communication path are used as switches. This is a program for causing a computer to execute. The program according to the present invention can be stored in a storage device or a storage medium.

  In a CD separation type network such as an OpenFlow network, the communication delay at the time of proxy TCP connection by a switch is reduced.

It is a figure which shows the structural example of the open flow network system which concerns on this invention. It is a figure for demonstrating the specification of the flow entry which concerns on this invention. It is a figure which shows the structural example of a controller (OFC). It is a figure which shows the structural example of a switch (OFS). It is a figure for demonstrating the outline | summary of the process in the case of receiving a "SYN Flood" attack. It is a figure for demonstrating the outline | summary of the process in the case of performing normal TCP communication. It is a figure which shows the field of the TCP header of a packet. It is the first half of the flowchart which shows the flow of the process at the time of packet reception. It is the latter half of the flowchart which shows the flow of the process at the time of packet reception. It is a flowchart which shows the flow of a process at the time of packet reception other than a SYN packet of a switch (OFS). It is a figure for demonstrating the outline | summary of the process in the case of transferring a SYN packet to a controller (OFC) immediately after reception of a SYN packet.

  The present invention is directed to a CD separation type network. Here, an OpenFlow network, which is one of CD separation type networks, will be described as an example. However, actually, it is not limited to the OpenFlow network.

  In the present invention, when the existing defense method on the network device side is applied to the OpenFlow network, the problem that the communication delay increases due to the waiting time until all the proxy TCP connections of each switch (OFS) are established is The problem is solved by reducing the number of TCP connections.

  In the OpenFlow network, when the switch (OFS) performs proxy TCP connection with the host, (1) between the “packet source host” and the “switch closest to the source host (OFS)”, and ( 2) It may be performed at two locations between the “switch closest to the transmission source host (OFS)” and the “transmission destination server”.

  However, each switch (OFS) cannot determine whether or not the received packet is a packet that has been transferred after a proxy TCP connection has already been made to the transmission source host. It was necessary to perform proxy TCP connection with (OFS).

  In the present invention, the following processing is performed on the communication path from the packet transmission source host to the packet transmission destination server.

  The switch (OFS) is information indicating whether or not it is the switch (OFS) closest to the transmission source host when the switch (OFS) is closest to the transmission source host among the switches (OFS) on the communication path. “Communication path head identifier” is received from the controller (OFC). Here, it is assumed that the value of the communication path head identifier is a value indicating that it is a head switch (OFS). The head switch (OFS) is a switch (OFS) closest to the transmission source host on the communication path.

  When the switch (OFS) receives the communication path head identifier, the switch (OFS) adds the communication path head identifier to the path information managed by the switch (OFS). Here, when the switch (OFS) receives the communication path head identifier, the value of the communication path head identifier in the path information is changed to a value indicating the head switch (OFS) based on the communication path head identifier. Update.

  The switch (OFS) performs proxy TCP connection with the host only when the value of the communication path head identifier is a value indicating the head switch (OFS). That is, the head switch (OFS) performs proxy TCP connection with the host, but switches (OFS) other than the head switch (OFS) do not perform proxy TCP connection with the host.

  As a result, unnecessary proxy TCP connections that have been made so far can be eliminated, and the time required for establishing a proxy TCP connection that has caused a communication delay can be reduced.

  In the OpenFlow network, a method for solving the problem of communication delay that occurs when the defense method on the network device side is used to prevent a “SYN Flood” attack by reducing the number of proxy TCP connections is described in detail below. explain.

<First Embodiment>
Hereinafter, a first embodiment of the present invention will be described with reference to the accompanying drawings.

[System configuration]
With reference to FIG. 1, a configuration example of an OpenFlow network system according to the present invention will be described.

  The OpenFlow network system according to the present invention includes a controller (OFC) 10, a switch (OFS) 20, and a host 30.

  A plurality of controllers (OFC) 10, switches (OFS) 20, and hosts 30 may be provided. For example, each of the plurality of switches (OFS) 20 is represented as a switch (OFS) 20-1, a switch (OFS) 20-2,. FIG. 1 illustrates the controller (OFC) 10, the switch (OFS) 20-1, the switch (OFS) 20-2, the host 30-1, and the host 30-2.

  The controller (OFC) 10 manages the switch (OFS) 20.

  The switch (OFS) 20 constitutes a network.

  The host 30 is connected to the switch (OFS) 20 and performs network communication via the switch (OFS) 20. The host 30 is not limited to a client or a server, and may be a network device that does not support OpenFlow.

  The controller (OFC) 10 and the switch (OFS) 20 are connected by a “secure channel” that is a communication path protected by a dedicated line, SSL (Secure Socket Layer), or the like. The controller (OFC) 10 and the switch (OFS) 20 perform communication according to the OpenFlow protocol via the secure channel.

  The controller (OFC) 10 controls how the switch (OFS) 20 processes a packet arriving at the switch (OFS) 20 by manipulating a flow entry that is route information corresponding to each packet.

  The controller (OFC) 10 registers a large number of flow entries in the switch (OFS) 20. A set of flow entries is managed in a table format called “flow table”.

  Each switch (OFS) 20 holds at least one flow table. The controller (OFC) 10 holds all the flow tables having the same contents as the flow tables of the subordinate switches (OFS) 20. That is, the controller (OFC) 10 holds a master table of the flow table of each switch (OFS) 20.

  Note that “holding a flow table” means that the flow table is managed. As long as the flow table can be managed via a network or the like, the flow table may not actually exist within itself. That is, the storage location of the flow table is not limited to the inside of the device that manages the flow table, but may be the outside. For example, the controller (OFC) 10 and the switch (OFS) 20 may share the same flow table on the network.

[Flow entry specifications]
With reference to FIG. 2, the specification of the flow entry according to the present invention will be described.

  The switch (OFS) 20 holds a flow entry 200 as route information corresponding to each packet, as shown in FIG.

  The flow entry 200 includes a flow header 201, an action 202, a flow counter 203, and a communication path head identifier 204.

  The flow header 201 is an area (field) for designating a rule of the flow entry. In the flow header 201, information (attribute values) from L1 (layer 1: physical layer) to L4 (layer 4: transport layer) of the OSI reference model may be specified as a flow entry rule in any combination. it can. In the flow header 201, a broadcast address or a multicast address can be designated. In addition, wild cards such as “*” and “?” Can be used.

  The action 202 is an area for designating the action of the flow entry. In the action 202, operations such as “output to a specific port”, “discard”, and “rewrite header” can be designated.

  The flow counter 203 is an area for recording the number of times the received packet information matches the rule of the flow entry. Here, the flow counter 203 records the number of times the received packet information matches the flow header 201 of the flow entry 200.

  The communication path head identifier 204 is an area for designating information indicating whether the switch (OFS) is closest to the transmission source host. That is, it is an area for recording a value indicating that it is the head switch (OFS). The switch (OFS) 20 refers to the value specified in the communication path head identifier 204 and confirms whether it is the head switch (OFS) on the communication path of the received packet. The communication path head identifier 204 is an area newly added to the flow entry in the present invention.

[Configuration of controller (OFC)]
A configuration example of the controller (OFC) 10 will be described with reference to FIG.

  The controller (OFC) 10 includes a network management unit 11, a route calculation unit 12, and a packet transmission / reception unit 13.

  The network management unit 11 collects and manages topology information (network topology) of a network configured by the switch (OFS) 20. The network management unit 11 holds and manages a set of flow entries 200 set in the switch (OFS) 20.

  The route calculation unit 12 calculates the communication route of the packet received from the switch (OFS) 20 based on the topology information.

  The packet transmitting / receiving unit 13 transmits and receives packets. Further, the packet transmitting / receiving unit 13 creates the flow entry 200 based on the communication path obtained as a result of the calculation, and creates an open flow message for setting the flow entry 200 in the switch (OFS) 20. Alternatively, an open flow message related to the change of the flow entry 200 is received from the switch (OFS) 20, and the network management unit 11 is requested to change the flow entry 200 held and managed. The packet transmission / reception unit 13 transmits / receives an OpenFlow message to / from the switch (OFS) 20 via a secure channel.

[Configuration of switch (OFS)]
A configuration example of the switch (OFS) 20 will be described with reference to FIG.

  The switch (OFS) 20 includes a flow table 21, a flow table management unit 22, a packet reception unit 23, a packet transmission unit 24, a packet discard unit 25, a communication path head analysis unit 26, and a proxy TCP connection unit 27. Is provided.

  The flow table 21 is a set of flow entries 200. For example, the flow table 21 is a database for storing route information.

  The flow table management unit 22 manages (adds / updates / deletes) the flow entry 200 included in the flow table 21.

  The packet receiving unit 23 receives packets from the controller (OFC) 10, the adjacent switch (OFS) 20, the host 30, and the like. Note that the packet receiver 23 receives an OpenFlow message from the controller (OFC) 10 via a secure channel. When the OpenFlow message is received, the OpenFlow message is analyzed, and processing corresponding to the type and content of the OpenFlow message is performed. For example, if it is an open flow message for setting the flow entry 200 in the flow table 21, the flow table management unit 22 is requested to set the flow entry 200 in the flow table 21. The packet receiver 23 receives a packet from an adjacent switch (OFS) 20 or host 30 via a network such as a LAN. When a packet is received, it is confirmed whether or not the flow entry 200 that matches the received packet is set. When the flow entry 200 that matches the received packet is set, the packet is processed according to the action 202 of the flow entry 200. Process. For example, when the operation specified in the action 202 of the flow entry 200 that matches the received packet is “packet transmission / transfer”, or when the flow entry 200 that matches the received packet is not set, the packet The transmission unit 24 is requested to transmit / transfer the packet. If the operation specified in the action 202 of the flow entry 200 is “discard packet”, the packet discard unit 25 is requested to discard the packet.

  The packet transmission unit 24 transmits / transfers a packet to the controller (OFC) 10, the adjacent switch (OFS) 20, the host 30, and the like. If the flow entry 200 that matches the received packet is not set, the packet transmission unit 24 transfers the packet to the controller (OFC) 10 via the secure channel, and calculates and sets the route of the packet. Request. For example, the packet transmitter 24 creates an OpenFlow message for requesting route calculation and setting of the packet, stores the packet in the data area of the OpenFlow message, and sends the OpenFlow message to the controller (OFC). 10 to send. In addition, when the operation designated in the action 202 of the flow entry 200 that matches the received packet is “packet transmission / transfer”, the packet transmission unit 24 uses the adjacent switch (OFS) via a network such as a LAN. ) Transmit / transfer the packet to 20 or the host 30 or the like. At this time, the packet transmission unit 24 transfers the packet to the output port corresponding to the transmission destination / transfer destination, and sends the packet from the output port. Further, when the operation designated in the action 202 of the flow entry 200 that matches the received packet is “transmission / transfer of packet to the controller (OFC)”, the packet is sent to the controller (OFC) 10 via the secure channel. May be transmitted / transferred. Actually, the packet transmitter 24 may be linked / integrated with the packet receiver 23.

  The packet discard unit 25 discards the packet. The packet discard unit 25 discards the packet when a packet discard request is received from the packet receiver 23 or when the packet becomes unnecessary for some reason. In addition, when discarding a packet, the packet discard unit 25 does not discard the packet immediately / immediately, but when a certain time has elapsed from the time of packet reception / discard request or when a predetermined condition is satisfied, Can also be discarded. Actually, the packet discarding unit 25 may be linked / integrated with the packet receiving unit 23.

  The communication path head analysis unit 26 analyzes whether the switch (OFS) 20 is a head switch (OFS) on the packet communication path. Specifically, the communication path head analysis unit 26 analyzes the value of the communication path head identifier 204 of the flow entry 200, and indicates that the value of the communication path head identifier 204 of the flow entry 200 is the head switch (OFS). Check if it is the indicated value. The communication path head analysis unit 26 is a component newly added to the switch (OFS) 20 in the present invention. Actually, the communication path head analysis unit 26 may be linked / integrated with the packet reception unit 23.

  The proxy TCP connection unit 27 performs proxy TCP connection with the host 30 when the value of the communication path head identifier 204 of the flow entry 200 is a value indicating that it is a head switch (OFS). That is, when the switch (OFS) 20 is the head switch (OFS) on the packet communication path, the switch (OFS) 20 performs proxy TCP connection with the host 30 as a representative of a plurality of switches (OFS) on the communication path. At this time, the proxy TCP connection unit 27 creates a SYN packet or an ACK packet for performing a proxy TCP connection with the host 30, and transmits / transfers the packet to / from the host 30. If the proxy TCP connection with the packet source host fails, the packet discard unit 25 is requested to discard the packet from the source host. The proxy TCP connection unit 27 is a component newly added to the switch (OFS) 20 in the present invention. Actually, the proxy TCP connection unit 27 may be linked / integrated with the packet reception unit 23, the packet transmission unit 24, and the packet discard unit 25.

  The packet transmission unit 24, the packet discard unit 25, the communication path head analysis unit 26, and the proxy TCP connection unit 27 are integrated (integrated) is referred to as a “packet processing unit”.

[Process overview]
An outline of processing when the present invention is applied will be described separately in the following cases.

  In the OpenFlow network, a case where a “SYN Flood” attack is received is referred to as “illegal connection”.

  A case where normal TCP communication is performed in the OpenFlow network is referred to as “normal connection”.

[Unauthorized connection]
With reference to FIG. 5, an outline of processing in the case of receiving a “SYN Flood” attack in the OpenFlow network will be described in order.

(1) Reception of SYN packet The switch (OFS) 20-1 receives a SYN packet from the host 30-1.

(2) Trial of Proxy TCP Connection The switch (OFS) 20-1 attempts a proxy TCP connection with the host 30-1. For example, the switch (OFS) 20-1 transmits an ACK packet to the host 30-1, and waits for the host 30-1 to send back the ACK packet. In the case of a “SYN Flood” attack from the host 30-1, since the host 30-1 does not send back an ACK packet, the proxy TCP connection with the host 30-1 always fails.

(3) Determination of “SYN Flood” Attack When the proxy TCP connection with the host 30-1 fails, the switch (OFS) 20-1 determines that the packet received from the host 30-1 is SYN as a “SYN Flood” attack. It is determined that there is a high possibility of being a packet, and the received SYN packet is discarded without transferring the packet to the controller (OFC) 10, and the process is terminated.

  As a result, the switch (OFS) 20-1 can defend against the “SYN Flood” attack.

[Normal connection]
With reference to FIG. 6, an outline of processing in the case of performing normal TCP communication in the OpenFlow network will be described in order.

(1) Reception of SYN packet The switch (OFS) 20-1 receives a SYN packet from the host 30-1.

(2) Trial of proxy TCP connection with transmission source Switch (OFS) 20-1 tries proxy TCP connection with host 30-1. In the case of normal TCP communication, the proxy TCP connection with the host 30-1 is successful. Thereby, a communication path between the switch (OFS) 20-1 and the host 30-1 is established.

(3) Route calculation and setting request When the proxy TCP connection with the host 30-1 is successful, the switch (OFS) 20-1 transfers the packet to the controller (OFC) 10 and receives it from the host 30-1. Requests route calculation and setting of the received packet. Here, the transmission source of the packet is the host 30-1, and the transmission destination of the packet is the host 30-2. For example, it is assumed that the host 30-1 is a client and the host 30-2 is a server.

(4) Route Calculation The controller (OFC) 10 performs route calculation in response to a request from the switch (OFS) 20-1, and creates a flow entry 200 based on the communication route obtained as a result of the calculation. Here, the switch (OFS) closest to the transmission source host 30-1 on the communication path is the request source switch (OFS) 20-1.

  The controller (OFC) 10 sets flow entries in order from the switch (OFS) closest to the destination host 30-2 on the communication path. The reason is that when the flow entries are set in order from the switch (OFS) closest to the transmission source host 30-1 on the communication path, the setting of the flow entries to all the switches (OFS) on the communication path is completed. This is because packet transfer or the like is started.

(5) Setting other than the head switch The controller (OFC) 10 designates a value indicating that it is not the head switch (OFS) in the communication path head identifier 204 of the flow entry 200 set in the switch (OFS) 20-2. The flow entry 200 is set in the switch (OFS) 20-2.

(6) Setting of head switch The controller (OFC) 10 designates a value indicating that it is the head switch (OFS) in the communication path head identifier 204 of the flow entry 200 set in the switch (OFS) 20-1. The flow entry 200 is set in the switch (OFS) 20-1.

(7) Proxy TCP connection trial with transmission destination The switch (OFS) 20-1 analyzes the communication path head identifier 204 of the set flow entry 200, and the value of the communication path head identifier 204 of the flow entry 200 is Since it is a value indicating that it is the head switch (OFS), proxy TCP connection with the host 30-2 is performed.

  Here, the switch (OFS) 20-1 transmits the proxy TCP connection SYN packet to the switch (OFS) 20-2 in accordance with the action 202 of its own flow entry 200.

  When the switch (OFS) 20-2 receives the proxy TCP connection SYN packet, the switch (OFS) 20-2 analyzes the value of the communication path head identifier 204 of the set flow entry 200, and the value of the communication path head identifier 204 is Since it is not a value indicating that it is the head switch (OFS), proxy TCP connection is not performed, and the received SYN packet is transferred to the host 30-2 according to the action 202 of its own flow entry 200.

  Normally, since the switch (OFS) 20-1 performs normal TCP communication, the proxy TCP connection between the switch (OFS) 20-1 and the host 30-2 is successful. For example, when the host 30-2 receives the proxy TCP connection SYN packet, the host 30-2 transmits an ACK packet to the switch (OFS) 20-1, and the switch (OFS) 20-1 returns the ACK packet. wait. The switch (OFS) 20-1 sends an ACK packet back to the host 30-2. Thereby, a communication path between the switch (OFS) 20-1 and the host 30-2 is established.

  When the communication path between the switch (OFS) 20-1 and the host 30-2 is established, the switch (OFS) 20-1 makes a TCP connection with the host 30-1 and the host 30-2 individually. It ’s just that. At this time, the field value of the packet in the proxy TCP connection between the switch (OFS) 20-1 and the host 30-1 is the proxy TCP connection between the switch (OFS) 20-1 and the host 30-2. Is different from the packet field value in. The different field values are “acknowledgment number” and “sequence number” of the TCP header shown in FIG.

  The switch (OFS) 20-1 is a communication packet between the host 30-1 and the host 30-2 in order to make the host 30-1 and the host 30-2 appear to be directly TCP-connected (impersonated). When receiving this, it is necessary to change (convert) the field value of the communication packet. This change (conversion) process is a process necessary for proxy TCP connection.

(8) Setting of Conversion Flow Entry The switch (OFS) 20-1 sets the flow entry 200 for changing (converting) the field value of the communication packet between the host 30-1 and the host 30-2. Do. For example, the switch (OFS) 20-1 changes the flow entry 200 set by the controller (OFC) 10, and communication between the host 30-1 and the host 30-2 is performed in the action 202 of the flow entry 200. An operation for changing (converting) the field value of the packet is additionally specified, and the change of the flow entry 200 is notified to the controller (OFC) 10. Alternatively, the switch (OFS) 20-1 sets a new flow entry 200 that specifies an operation for changing (converting) the field value of the communication packet, and sets the new flow entry 200 to the controller (OFC) 10. Notice. For this new flow entry 200, it is preferable to set a higher priority than the existing flow entry 200.

(9) Reception of communication packet The switch (OFS) 20-1 receives a communication packet from the host 30-1.

(10) Conversion of field value of communication packet When receiving a communication packet between the host 30-1 and the host 30-2, the switch (OFS) 20-1 performs communication packet according to the action 202 of its own flow entry 200. Change (convert) the field value of. Here, the switch (OFS) 20-1 changes (converts) the “acknowledgment number” and “sequence number” of the TCP header among the field values of the communication packet. As a result, a communication path between the host 30-1 and the host 30-2 is established. The host 30-1 and the host 30-2 can communicate with each other without being aware that the switch (OFS) 20-1 is TCP-connected on behalf of the host.

(11) Reception of communication packet The switch (OFS) 20-1 transfers the communication packet to the host 30-2.

  Here, a case where a communication packet is transmitted from the host 30-1 to the host 30-2 has been described, but a similar conversion process is also performed when a communication packet is transmitted from the host 30-2 to the host 30-1. . In this case, in each process from (9) communication packet reception to (11) communication packet reception, “host 30-1” and “host 30-2” are interchanged.

  As described above, in the present invention, when normal TCP communication is performed, the number of unnecessary proxy TCP connections can be reduced by performing proxy TCP connection on behalf of the head switch (OFS) on the path.

  Further, in the present invention, even when there are a plurality of switches (OFS) 20 on the packet communication path in the OpenFlow network, it is possible to reduce the communication delay while preventing the “SYN Flood” attack. .

[When normal connection ends]
Furthermore, processing when normal TCP communication is completed will be described.

  When the proxy TCP connection with at least one of the host 30-1 or the host 30-2 is terminated (disconnected), the switch (OFS) 20-1 deletes the flow entry 200 related to the proxy TCP connection from the flow table 21.

  At this time, the switch (OFS) 20-1 creates a deletion open flow message for deleting the flow entry 200.

  For example, the switch (OFS) 20-1 notifies the controller (OFC) 10 of a deletion open flow message. The controller (OFC) 10 deletes the flow entry 200 from each switch (OFS) 20 on the communication path in response to the deletion open flow message. The controller (OFC) 10 may transfer the deletion open flow message to each switch (OFS) 20 on the communication path.

  Alternatively, the switch (OFS) 20-1 transmits a deletion open flow message to each switch (OFS) 20 on the communication path according to the action 202 of the flow entry 200. Simultaneously with / after transmission, the flow entry 200 is deleted, and the controller (OFC) 10 is notified of the deletion of the flow entry 200.

  Each switch (OFS) 20 on the communication path, when receiving the deletion OpenFlow message, transfers the deletion OpenFlow message to the adjacent switch (OFS) 20 according to the action 202 of its own flow entry 200. Anyway. Simultaneously with / after the transfer, the own flow entry 200 is deleted, and the deletion of the own flow entry 200 is notified to the controller (OFC) 10. If there is no adjacent switch (OFS) 20, the deletion open flow message is discarded.

[Process when receiving packets]
With reference to FIGS. 8A and 8B, the flow of processing when the switch (OFS) 20-1 receives a SYN packet will be described.

  Here, a case where a packet is transmitted from the host 30-1 to the host 30-2 will be described. For example, when making a proxy TCP connection with the host 30-2, the host 30-1 transmits a SYN packet to the host 30-2. In addition, when a communication path is established with the host 30-2, the host 30-1 transmits a normal packet to the host 30-2.

(1) Step S101
The switch (OFS) 20-1 receives a packet from the host 30-1.

(2) Step S102
The switch (OFS) 20-1 checks whether or not the flow entry 200 that matches the received packet exists in the flow table 21 managed by the switch (OFS) 20-1. For example, the switch (OFS) 20-1 confirms whether the header information of the received packet matches the information of the flow header 201 of the flow entry 200 in the flow table 21 managed by the switch (OFS) 20-1.

(3) Step S103
When there is no flow entry 200 that matches the received packet in the flow table 21 managed by the switch (OFS) 20-1 (No in step S102), the switch (OFS) 20-1 checks whether the received packet is a SYN packet. .

(4) Step S104
When the received packet is a SYN packet (Yes in step S103), the switch (OFS) 20-1 attempts a proxy TCP connection with the host 30-1 that is the transmission source of the SYN packet.

(5) Step S105
The switch (OFS) 20-1 checks whether the proxy TCP connection with the host 30-1 is successful. In the case of a “SYN Flood” attack from the host 30-1 (No in step S105), the proxy TCP connection between the switch (OFS) 20-1 and the host 30-1 always fails. When the proxy TCP connection with the host 30-1 fails, the switch (OFS) 20-1 determines that the packet received from the host 30-1 is highly likely to be a SYN packet as a “SYN Flood” attack. The received packet is discarded without transferring the packet to the controller (OFC) 10 that manages itself, and the process ends.

(6) Step S106
When the proxy TCP connection with the host 30-1 is successful (Yes in step S105), the switch (OFS) 20-1 transfers the received packet to the controller (OFC) 10, and calculates the path of the received packet. Request settings.
(7) Step S107
The controller (OFC) 10 performs path calculation in response to a request from the switch (OFS) 20-1, and based on the communication path obtained as a result of the calculation, each controller (OFS) 20 on the communication path A flow entry 200 is set. Each switch (OFS) 20 registers the flow entry 200 set from the controller (OFC) 10 in the flow table 21.

(8) Step S108
The switch (OFS) 20-1 confirms whether it is the head switch (OFS). Here, the switch (OFS) 20-1 analyzes the communication path head identifier 204 of the flow entry 200 set from the controller (OFC) 10, and the value of the communication path head identifier 204 of the flow entry 200 is changed to the head switch ( It is confirmed whether the value indicates that it is OFS).

(9) Step S109
When the switch (OFS) 20-1 is the first switch (OFS) (Yes in step S108), the switch (OFS) 20-1 attempts a proxy TCP connection with the host 30-2. For example, the switch (OFS) 20-1 transmits a SYN packet for proxy TCP connection with the host 30-2 to the host 30-2 in accordance with the action 202 of its own flow entry 200.

(10) Step S110
The switch (OFS) 20-1 checks whether the proxy TCP connection with the host 30-2 is successful. Normally, since the switch (OFS) 20-1 performs normal TCP communication, the proxy TCP connection between the switch (OFS) 20-1 and the host 30-2 is successful. If the proxy TCP connection between the switch (OFS) 20-1 and the host 30-2 fails for some reason (No in step S110), the process ends. Alternatively, the proxy TCP connection with the host 30-2 may be retried after a certain period of time / periodically, and the processing may be terminated if a certain number of proxy TCP connection retries have failed. At this time, the switch (OFS) 20-1 may notify the controller (OFC) 10 and the host 30-1 that the proxy TCP connection with the host 30-2 has failed.

(11) Step S111
When the proxy TCP connection with the host 30-2 is successful (Yes in step S110), the switch (OFS) 20-1 changes the field value of the communication packet between the host 30-1 and the host 30-2 ( In order to perform conversion, the flow entry 200 is updated, and the action 202 of the flow entry 200 is designated with an operation for changing (converting) the field value of the communication packet between the host 30-1 and the host 30-2. In practice, a new flow entry 200 may be set. Thereafter, the process ends. For example, it waits for the arrival of a communication packet or the like from the host 30-1 (returns to step S101).

(12) Step S112
If the flow entry 200 that matches the received packet does not exist and the received packet is not a SYN packet (No in step S103), the switch (OFS) 20-1 determines that the packet is a “first packet” (First packet), and processing is performed in the same manner as a normal OpenFlow network. That is, the switch (OFS) 20-1 forwards the received packet to the controller (OFC) 10 and requests route calculation and setting of the received packet.

(13) Step S113
The controller (OFC) 10 performs path calculation in response to a request from the switch (OFS) 20-1, and based on the communication path obtained as a result of the calculation, each controller (OFS) 20 on the communication path The flow entry 200 for the first packet is set. As the specification of the flow entry 200, the specification of a normal flow entry that does not include the communication path head identifier 204 is sufficient. Each switch (OFS) 20 registers the flow entry 200 set from the controller (OFC) 10 in the flow table 21.

(14) Step S114
The switch (OFS) 20-1 has a flow entry 200 that matches the received packet (Yes in step S102), or is not the first switch (OFS) (No in step S108), or When the flow entry 200 for the first packet is set by the controller (OFC) 10 (after step S113), the received packet is processed according to the action 202 of its own flow entry 200. Note that the switch (OFS) 20 other than the switch (OFS) 20-1 also processes the received packet in accordance with the action 202 of its own flow entry 200, like the switch (OFS) 20-1.

  Thereby, when the “SYN Flood” attack is performed in the OpenFlow network, the delay of the communication time due to the proxy TCP connection can be reduced while avoiding the attack.

Second Embodiment
The second embodiment of the present invention will be described below.

  As shown in FIG. 9, the present invention is established even when there are a plurality of controllers (OFC) 10 and switches (OFS) 20 on the network. Furthermore, the present invention is established regardless of how the plurality of switches (OFS) on the network are connected.

[System configuration]
With reference to FIG. 9, a configuration example of the OpenFlow network system according to the present embodiment will be described.

  The OpenFlow network system according to the present embodiment includes a controller (OFC) 10 (10-i, i = 1 to X: X is arbitrary) and a switch (OFS) 20 (20-j, j = 1 to Y: Y). And host 30 (30-k, k = 1 to Z: Z is optional).

  The controller (OFC) 10 (10-i, i = 1 to X), the switch (OFS) 20 (20-j, j = 1 to Y), and the host 30 (30-k, k = 1 to Z) Each corresponds to the controller (OFC) 10, the switch (OFS) 20, and the host 30 described in the first embodiment.

  For example, in the OpenFlow network system as shown in FIG. 9, when a communication packet is transmitted from the host 30-1 to the host 30-Z, the switch (OFS) 20-1, the switch (OFS) 20-4, the switch (OFS) ) 20-8,..., Switch (OFS) 20-Y, and switch (OFS) 20- (Y-1) are switches (OFS) on the communication path.

  At this time, the switch (OFS) 20-1 becomes the leading switch (OFS). In addition, each of the switch (OFS) 20-4, the switch (OFS) 20-8,..., The switch (OFS) 20-Y, and the switch (OFS) 20- (Y-1) is a leading switch (OFS). ) Other than the switch (OFS).

  The controller (OFC) 10 to which the switch (OFS) 20-1 transfers a packet is any one of the controller (OFC) 10-1, the controller (OFC) 10-2,..., And the controller (OFC) 10-X. It is.

<Third Embodiment>
The third embodiment of the present invention will be described below.

  The present invention is established even when a SYN packet is transferred to the controller (OFC) immediately after “(1) SYN packet reception” of “illegal connection” shown in FIG. 5 or “normal connection” shown in FIG.

[System configuration]
The configuration example of the OpenFlow network system according to the present embodiment is the same as the configuration example (first embodiment) shown in FIG.

[Process overview]
With reference to FIG. 10, an outline of processing in the present embodiment will be described below.

(1) Reception of SYN packet The switch (OFS) 20-1 receives a SYN packet from the host 30-1.

(2) Transfer of SYN packet The switch (OFS) 20-1 transfers the received SYN packet to the controller (OFC) 10. When receiving the SYN packet from the switch (OFS) 20-1, the controller (OFC) 10 waits for a request from the switch (OFS) 20-1 without performing route calculation.

(3) Proxy TCP connection attempt The switch (OFS) 20-1 attempts a proxy TCP connection with the host 30-1.

(4) Discard request upon failure When the proxy TCP connection with the host 30-1 fails, the switch (OFS) 20-1 discards the packet (SYN packet) transferred earlier to the controller (OFC) 10. Request and end processing. In response to the request from the switch (OFS) 20-1, the controller (OFC) 10 discards the SYN packet and ends the process.

(5) Calculation request at the time of success When the proxy TCP connection with the host 30-1 is successful, the switch (OFS) 20-1 calculates the path of the packet (SYN packet) transferred to the controller (OFC) 10 earlier. And request settings.

  The subsequent processing is the same as the processing from “(4) route calculation” to “(11) reception of communication packet” of “normal connection” shown in FIG.

(6) Route Calculation The controller (OFC) 10 performs route calculation in response to a request from the switch (OFS) 20-1, and creates a flow entry 200 based on the communication route obtained as a result of the calculation. Here, the switch (OFS) closest to the transmission source host 30-1 on the communication path is the request source switch (OFS) 20-1.

(7) Setting other than head switch The controller (OFC) 10 designates a value indicating that it is not the head switch (OFS) in the communication path head identifier 204 of the flow entry 200 set in the switch (OFS) 20-2. The flow entry 200 is set in the switch (OFS) 20-2.

(8) Setting of head switch The controller (OFC) 10 designates a value indicating that it is the head switch (OFS) in the communication path head identifier 204 of the flow entry 200 set in the switch (OFS) 20-1. The flow entry 200 is set in the switch (OFS) 20-1.

(9) Proxy TCP connection trial with transmission destination The switch (OFS) 20-1 analyzes the communication path head identifier 204 of the set flow entry 200, and the value of the communication path head identifier 204 of the flow entry 200 is Since it is a value indicating that it is the head switch (OFS), proxy TCP connection with the host 30-2 is performed.

(10) Setting of Conversion Flow Entry When the communication path between the switch (OFS) 20-1 and the host 30-2 is established, the switch (OFS) 20-1 establishes the host 30-1 and the host 30-2. The flow entry 200 is set to change (convert) the field value of the communication packet between and.

(11) Reception of communication packet The switch (OFS) 20-1 receives a communication packet from the host 30-1.

(12) Conversion of field value of communication packet When receiving a communication packet between the host 30-1 and the host 30-2, the switch (OFS) 20-1 communicates with the communication packet according to the action 202 of its own flow entry 200. Change (convert) the field value of.

(13) Reception of communication packet The switch (OFS) 20-1 transfers the communication packet to the host 30-2.

<Fourth embodiment>
The fourth embodiment of the present invention will be described below.

  In the present invention, when the leading switch (OFS) fails in proxy TCP connection with the packet transmission source host, the number of reception of the packet from the transmission source host is counted. When the number of receptions reaches a preset threshold value, it is determined that the packet from the transmission source host is likely to be a SYN packet as a “SYN Flood” attack, and the proxy TCP connection with the transmission source host of the packet is performed for a certain period of time. Try to refuse.

  By rejecting the proxy TCP connection for a certain period of time, if the leading switch (OFS) fails to connect to the packet source host, it will try to connect to the proxy unconditionally when it receives the SYN packet again. Can be prevented.

  Also, by using the packet reception count as a criterion, it is not a “SYN Flood” attack, but if for some reason the head switch (OFS) fails to proxy TCP connection with the packet source host, It can be prevented that the “SYN Flood” attack is immediately determined.

  For example, the packet reception unit 23 of the switch (OFS) 20 shown in FIG. 4 counts the number of receptions of packets from the host 30, and when the number of receptions reaches a preset threshold, the packet from the host 30 is “SYN Flood”. It is determined that there is a high possibility that the packet is a SYN packet as an attack.

  In this case, the packet receiving unit 23 of the switch (OFS) 20 shown in FIG. 4 rejects reception of the packet from the host 30 for a certain period of time. Alternatively, the packet transmission unit 24 of the switch (OFS) 20 illustrated in FIG. 4 rejects a proxy TCP connection attempt (transmission of an ACK packet) with the host 30 for a certain period of time. Alternatively, the packet discard unit 25 of the switch (OFS) 20 shown in FIG. 4 discards the packet from the host 30 for a certain time.

<Relationship between each embodiment>
Note that the above embodiments can be implemented in combination.

<Example of hardware>
Hereinafter, specific examples of hardware for realizing the network system according to the present invention will be described.

  As examples of the controller (OFC) and the host, a computer such as a PC (personal computer), an appliance, a thin client server, a workstation, a mainframe, and a supercomputer is assumed. Other examples of hosts include IP phones, mobile phones, smart phones, smart books, car navigation systems (car navigation systems), portable game consoles, home game consoles, portable music players, handy terminals, gadgets (electronic devices). An interactive television, a digital tuner, a digital recorder, an information home appliance, an office automation (OA) device, an over-the-counter terminal / high-function copy machine, a digital signage (digital signage), and the like are also conceivable. The controller (OFC) and host are not limited to terminals and servers, but may be relay devices or peripheral devices. Further, the controller (OFC) and the host may be an expansion board mounted on a computer or the like, or a virtual machine (VM: Virtual Machine) constructed on a physical machine.

  Examples of the switch (OFS) include a network switch, a router, a proxy, a gateway, a firewall, a load balancer, a bandwidth control device (load balancer) packet shaper, security supervisory control and data acquisition (SCADA), gatekeeper, base station, access point (AP), communication satellite (CS), uncommunication satellite (CS) A computer with multiple communication ports is considered. . Further, a virtual switch realized by a virtual machine (VM) constructed on a physical machine may be used.

  The controller (OFC), the switch (OFS), and the host may be mounted on a moving body such as a vehicle, a ship, or an aircraft.

  Although not shown, each of the controller (OFC), the switch (OFS), and the host communicates with a processor that drives based on a program and executes predetermined processing, a memory that stores the program and various data, and a network It is realized by the interface used for

  Examples of the processor include a CPU (Central Processing Unit), a network processor (NP), a microprocessor, a microcontroller (microcontroller), or a semiconductor integrated circuit (LSI: Large Scale) having a dedicated function. Integration) or the like.

  Examples of the memory include semiconductor storage devices such as a RAM (Random Access Memory), a ROM (Read Only Memory), an EEPROM (Electrically Erasable and Programmable Read Only Memory), a flash memory, and an HDD (Hold SMD). An auxiliary storage device such as State Drive), a removable disk such as a DVD (Digital Versatile Disk), a storage medium such as an SD memory card (Secure Digital memory card), or the like is conceivable. Further, a buffer, a register, or the like may be used. Alternatively, DAS (Direct Attached Storage), FC-SAN (Fibre Channel-Storage Area Network), NAS (Network Attached Storage), IP-SAN (IP-Storage Area), etc. may be used.

  Note that the processor and the memory may be integrated. For example, in recent years, a single chip such as a microcomputer has been developed. Therefore, a case where a one-chip microcomputer mounted on an electronic device or the like includes the processor and the memory can be considered.

  Examples of the interfaces include semiconductor integrated circuits such as substrates (motherboards and I / O boards) and chips that support network communication, network adapters such as NIC (Network Interface Card), and similar expansion cards and communication devices such as antennas. A communication port such as a connection port (connector) is conceivable.

  Examples of the network include the Internet, a LAN (Local Area Network), a wireless LAN (Wireless LAN), a WAN (Wide Area Network), a backbone (Backbone), a cable television (CATV) line, a fixed telephone network, a mobile phone network, WiMAX (IEEE 802.16a), 3G (3rd Generation), dedicated line (lease line), IrDA (Infrared Data Association), Bluetooth (registered trademark), serial communication line, data bus, and the like can be considered.

  The internal components of the controller (OFC), switch (OFS), and host may be modules, components, dedicated devices, or their activation (calling) programs.

  However, actually, it is not limited to these examples.

<Features of the present invention>
As described above, in the present invention, in a CD separation type network such as an OpenFlow network, a communication path head identifier is introduced to reduce a communication delay at the time of proxy TCP connection by a switch.

  One of the defense methods of the “SYN Flood” attack, which is one of the general attacks of the Dos attack, is a router (Router) or a load balancer (Load Balancer) that determines a forwarding destination of a received packet according to the content of the packet. For example, there is a technique for detecting and defending against an attack by making a TCP connection (proxy TCP connection) on behalf of an attack target server.

  However, if this protection technique is applied as it is to a switch (OFS) that transfers packets in an OpenFlow network, if there are multiple switches (OFS) on the packet communication path, each switch (OFS) individually A proxy TCP connection is required, and communication delay may occur due to a waiting time until each connection is established.

  In the present invention, by adding information indicating the first switch (OFS) on the communication path from the packet transmission source host to the server to the path information held by the switch (OFS), the switch is set on the communication path. The number of proxy TCP connections required in proportion to the number of (OFS) is limited to two, regardless of the number of switches (OFS) on the communication path, and protection against “SYN Flood” attacks and communication delay time reduction Is possible.

  The present invention can be applied to a network system composed of network devices (switches) in which a path control function is separated into an external control device (controller), as represented by OpenFlow.

  When the present invention is applied to a network system composed of network devices (switches) in which the path control function is separated into an external control device (controller), the packet communication route among the network devices (switches) that perform packet transfer Information (communication path head identifier) indicating that the head network device (switch) in is the network device (switch) closest to the packet transmission destination among the network devices (switches) on the packet communication path Hold.

  In addition, when the present invention is applied to a network system composed of network devices (switches) in which the path control function is separated from an external control device (controller), the control device (controller) that performs route control performs packet transfer. Among the network devices (switches) to be performed, the above information (communication route head identifier) is set for the head network device (switch) in the packet communication route.

  In addition, when the present invention is applied to a network system composed of network devices (switches) in which the path control function is separated from an external control device (controller), the packet transmission destination is determined by the above information (communication path head identifier). Since only the network device (switch) closest to the device performs proxy TCP connection with the transmission source / destination, there is no need to perform TCP connection between network devices (switches) that perform packet transfer.

<Appendix>
Part or all of the above-described embodiments can be described as in the following supplementary notes. However, actually, it is not limited to the following description examples.

[Appendix 1]
Multiple switches,
A controller for setting a flow entry in which rules and actions for uniformly controlling a packet as a flow are defined for each of the plurality of switches,
Each switch is
A functional unit for receiving a SYN packet from a transmission source host;
When the proxy TCP connection with the transmission source host is successful, a function unit that requests the controller to calculate a route and set a flow entry;
If the head switch on the communication path obtained as a result of the path calculation, a functional unit that performs proxy TCP connection with the destination host;
A network system comprising: a function unit that transfers a SYN packet for proxy TCP connection between the head switch and the transmission destination host if the head switch is not the head switch on the communication path.

[Appendix 2]
The network system according to attachment 2, wherein
Each switch is
If it is the leading switch on the communication path, the confirmation response number and sequence of the TCP header of the communication packet between the transmission source host and the transmission destination host when the proxy TCP connection with the transmission destination host is established A function part for setting a conversion flow entry for changing the number and notifying the controller of the conversion flow entry;
When a communication packet is received between the transmission source host and the transmission destination host, the acknowledgment number and sequence number of the TCP header of the communication packet are changed according to the conversion flow entry, and the transmission source host A network system further comprising: a functional unit that disguises itself as a direct proxy TCP connection with a destination host.

<Remarks>
As mentioned above, although embodiment of this invention was explained in full detail, actually, it is not restricted to said embodiment, Even if there is a change of the range which does not deviate from the summary of this invention, it is included in this invention.

10 ... Controller (OFC)
DESCRIPTION OF SYMBOLS 11 ... Network management part 12 ... Path | route calculation part 13 ... Packet processing part 20 ... Switch (OFS)
DESCRIPTION OF SYMBOLS 21 ... Flow table 22 ... Flow table management part 23 ... Packet reception part 24 ... Packet transmission part 25 ... Packet discard part 26 ... Communication path head analysis part 27 ... Proxy TCP connection part 30 ... Host 200 ... Flow entry 201 ... Flow header 202 ... Action 203 ... Flow counter 204 ... Communication path head identifier

Claims (14)

A plurality of switches that process received packets in accordance with a flow entry in which rules and actions for uniformly controlling packets as flows are defined;
A controller for setting the flow entry for each of the plurality of switches,
When each switch receives a SYN packet from a transmission source host, the switch requests a path calculation from the controller. When the switch is a head switch on a communication path obtained as a result of the path calculation, the switch acts as a proxy with the transmission destination host. A network system that performs TCP connection and transfers a SYN packet for proxy TCP connection between the head switch and the destination host when the head switch is not the head switch on the communication path. The network system according to claim 1,
The controller sets a flow entry in which a value indicating the head switch is designated for the head switch on the communication path,
Each of the switches refers to the flow entry, and determines that the switch is the first switch on the communication path when a value indicating that it is the first switch on the communication path is specified in the flow entry. Network system. The network system according to claim 1 or 2,
When each switch receives a SYN packet from the transmission source host, the switch tries a proxy TCP connection with the transmission destination host, and when the proxy TCP connection with the transmission destination host is successful, the switch sends the SYN packet to the controller. The network system discards the SYN packet when requesting the route calculation of the SYN packet and when the proxy TCP connection with the destination host fails. The network system according to claim 1 or 2,
When each switch receives a SYN packet from the transmission source host, the switch forwards the SYN packet to the controller, attempts a proxy TCP connection with the transmission destination host, and establishes a proxy TCP connection with the transmission destination host. A network system that requests the controller to calculate the route of the SYN packet when it succeeds, and requests the controller to discard the SYN packet when the proxy TCP connection with the destination host fails. The network system according to any one of claims 1 to 4, wherein
Each switch, when receiving a communication packet between the transmission source host and the transmission destination host, changes an acknowledgment number and a sequence number of a TCP header of the communication packet, and the transmission source host and the transmission destination A network system that disguises itself as a direct proxy TCP connection with a host. A network system according to any one of claims 1 to 5,
Each of the switches counts the number of reception of a packet from the source host when proxy TCP connection with the source host fails, and when the number of reception reaches a preset threshold, A network system that rejects proxy TCP connections for a certain period of time. Means for processing a received packet according to a flow entry in which rules and actions for uniformly controlling the packet as a flow are defined;
Means for requesting a route calculation to the controller for setting the flow entry when a SYN packet is received from a transmission source host;
Means for performing a proxy TCP connection with the destination host if the head switch on the communication path obtained as a result of the path calculation;
A switch comprising means for transferring a SYN packet for proxy TCP connection between the head switch and the destination host if it is not the head switch on the communication path. The switch according to claim 7, wherein
Means for referring to the flow entry and determining that the flow entry is the first switch on the communication path when a value indicating the first switch on the communication path is specified in the flow entry; Switch. The switch according to claim 7 or 8, wherein
Means for attempting a proxy TCP connection with the destination host when receiving a SYN packet from the source host;
Means for transferring the SYN packet to the controller and requesting route calculation of the SYN packet when the proxy TCP connection with the destination host is successful;
The switch further comprising means for discarding the SYN packet when the proxy TCP connection with the destination host fails. The switch according to claim 7 or 8, wherein
Means for transferring the SYN packet to the controller when a SYN packet is received from the source host;
Means for attempting a proxy TCP connection with the destination host;
Means for requesting the controller to calculate the route of the SYN packet when the proxy TCP connection with the destination host is successful;
The switch further comprising means for requesting the controller to discard the SYN packet when the proxy TCP connection with the destination host fails. The switch according to any one of claims 7 to 10,
When a communication packet is received between the transmission source host and the transmission destination host, the acknowledgment number and sequence number of the TCP header of the communication packet are changed, and the transmission source host and the transmission destination host directly act as a proxy. A switch further comprising means for impersonating the TCP connection. The switch according to any one of claims 7 to 11,
Means for counting the number of packet receptions from the source host when proxy TCP connection with the source host fails;
The switch further comprising means for rejecting a proxy TCP connection with the transmission source host for a predetermined time when the number of receptions reaches a preset threshold value. A communication delay reduction method implemented in a network system,
Each of the plurality of switches performs processing of the received packet according to a flow entry in which rules and actions for uniformly controlling the packet as a flow are defined;
Of the plurality of switches, a switch that has received a SYN packet from a transmission source host requests a route calculation from a controller that sets the flow entry;
A leading switch on a communication path obtained as a result of the path calculation among the plurality of switches performs a proxy TCP connection with a destination host;
A communication delay shortening method comprising: a switch other than the head switch on the communication path among the plurality of switches transferring a SYN packet for proxy TCP connection between the head switch and the destination host. Processing received packets according to a flow entry in which rules and actions for uniformly controlling packets as flows are defined;
When a SYN packet is received from a transmission source host, requesting a route calculation to the controller for setting the flow entry;
If the head switch on the communication path obtained as a result of the path calculation, performing a proxy TCP connection with the destination host;
A program for causing a computer used as a switch to execute a step of transferring a SYN packet for proxy TCP connection between the head switch and the destination host when the head switch is not the head switch on the communication path.

Images