JP3736293B2 - Service quality control method and device service quality control program in encrypted communication - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a service quality control method and apparatus in encrypted communication, and a storage medium storing a service quality control program, and in particular, performs encrypted communication using IPsec or the like in a packet switched network such as the Internet. Stores a service quality control method and apparatus in encrypted communication and a service quality control program for controlling the quality of the communication service when providing a communication service that guarantees the service quality such as real-time property in a secure manner The present invention relates to a storage medium.
[0002]
[Prior art]
Conventionally, there are two methods for controlling service quality: a method for controlling communication quality of a network and a method for controlling quality (priority) of a service process in an OS. There are IntServ, DiffServ, and the like as methods for controlling the communication quality of the network. IntServ is a bandwidth securing type communication quality control method for performing bandwidth reservation, and DiffServ is a priority control type communication quality control method.
[0003]
In addition, as a method for controlling the quality (priority) of the user process in the OS, there are a time division method, a method of scheduling divided into a real time process and a time division process.
[0004]
Moreover, IPsec, SSL, TLS, S / MIME, etc. are mentioned as a method of providing secure communication using encryption technology on the Internet. The application ranges are different, respectively, IPsec is an IP layer, SSL and TLS are transport layers, and S / MIME is an application layer (e-mail). Usually, encryption processing in SSL, TLS, and S / MIME is performed in the user process space. On the other hand, since IPsec is usually introduced as an extension of IP, when implemented by software, cryptographic processing is also performed in the kernel. In the present invention, encryption communication such as IPsec is targeted.
[0005]
[Problems to be solved by the invention]
Conventionally, in an OS, the kernel is mainly I / O bound processing such as a keyboard and a disk. Normally, I / O bound processing is light and short processing. However, by causing packet encryption processing to be performed inside the kernel, CPU-bound heavy processing is performed by the kernel. Therefore, the kernel occupies the CPU for a long time. A normal OS has a feature that processing by a kernel is given priority over processing by a user process. In addition, the communication service in the OS is performed by two processes, that is, communication processing in the kernel and server process in the user process space.
[0006]
From the above, the problem of priority inversion occurs in the following cases.
[0007]
When both high-priority services and low-priority services are provided simultaneously using encrypted communication, packet processing is performed by the kernel of the low-priority service, rather than the server process in the user process space of the high-priority service There is a problem that quality control is not performed correctly for services with high priority and services with low priority.
[0008]
The present invention has been made in view of the above points, and in performing a service using encrypted communication, a service quality control method in encrypted communication capable of correctly performing service quality control according to priority. It is another object of the present invention to provide a storage medium storing an apparatus and a service quality control program.
[0009]
[Means for Solving the Problems]
In the present invention (Claim 1), when performing secure communication by encrypting a packet, encryption / decryption processing is performed in the kernel, and a multi-CPU and an OS that supports multi-thread in the kernel are used. A service quality control method in encrypted communication for performing communication with guaranteed service quality,
A classification step for classifying an input packet according to the type of service in a kernel process and a server process that performs a service in the user process space ;
The number of CPUs assigned to each classified class is controlled, and encryption / decryption processing of packets with low priority among the classified packets is processed by a process in the user process space having a lower priority than the kernel space. And a control step.
[0012]
The present invention (Claim 2 ) uses an OS that performs encryption / decryption processing in the kernel and performs multi-thread support in the kernel when performing secure communication by encrypting the packet. A service quality control apparatus in encrypted communication for performing communication with guaranteed service quality,
Classifying means for classifying the input packet according to the type of service in the kernel process and the server process that performs the service in the user process space ;
The number of CPUs assigned to each classified class is controlled, and encryption / decryption processing of packets with low priority among the classified packets is processed by a process in the user process space having a lower priority than the kernel space. Packet processing means.
[0014]
The present invention (Claim 3 ) uses an OS that performs encryption / decryption processing in the kernel and performs multi-CPU and multi-thread support in the kernel when performing secure communication by encrypting the packet. A storage medium storing a service quality control program for performing communication with guaranteed service quality,
A storage medium storing a program for causing a computer to execute processing for realizing the service quality control method according to claim 1.
[0017]
As described above, according to the present invention, the quality of service can be controlled by limiting the number of CPUs allocated to packet processing in the kernel and processing in the user process space.
[0018]
Also, by classifying packets according to the type of service and limiting the number of CPUs assigned to each class, it is possible to control the communication quality in the kernel.
[0019]
In addition, by performing encryption / decryption processing of a low priority packet among the classified classes by a process in the user process space, it is possible to control the communication quality by lowering the priority.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 1 shows the configuration of a service quality control apparatus of the present invention.
[0021]
The service quality control apparatus shown in FIG. 1 includes a user process space 10 including a kernel 100 and a server process 12 connected to a network interface 20.
[0022]
The kernel 100 includes an input classification unit 110, a packet processing unit 120, and an output classification unit 130. In the figure, the input classifying unit 110 and the output classifying unit 130 are shown separately, but they may be constructed as one classifying unit.
[0023]
The input classification unit 110 classifies the packet input from the network interface 20 according to the priority and sets the packet in the class-specific input queue 101.
[0024]
The packet processing unit 120 processes a packet put in the queue set in the class-specific input queue 101 or the class-specific output key 103. The packet processing is performed based on the degree of parallelism in the range up to the number of CPUs assigned to each. A method for limiting the number of CPUs for packet processing will be described later. In some cases, it is also possible to deliver the cryptographic process to the cryptographic process in the user process space 10 for processing.
[0025]
The output classifying unit 130 classifies the packets acquired from the server process 12 in the user process space 10 according to the priority, and sets the packets in the class-specific output queue 103. The process for classifying the encrypted packet will be described later.
First, operations related to input will be described.
[0026]
FIG. 2 is a flowchart of the input operation of the present invention.
[0027]
Step 101) The input classification unit 110 acquires a packet from the network interface 20.
[0028]
Step 102) The input classifying unit 110 sorts the received packets into input queues according to priority. At this time, processing when an encrypted packet is received will be described later.
[0029]
Step 103) Next, the packet processing unit 120 processes the queued queue. Each process is performed with a parallelism in a range up to the number of CPUs allocated to each process. A method for limiting the number of CPUs for packet processing will be described later. In some cases, the cryptographic process is delivered to the cryptographic process in the user process space 10 for processing.
[0030]
Step 104) It is passed to each process (server process 12 or cryptographic process) in the user process space 10 via the input queue 102.
[0031]
Step 105) Each server process 12 is subjected to priority control by a function provided for normal OS process scheduling. The priority control of the server process 12 will be described later.
[0032]
Next, the output operation will be described.
[0033]
FIG. 3 is a flowchart of the output operation of the present invention.
[0034]
Step 201) Each server process 12 in the user process space 10 is subjected to priority control by a function provided for normal OS process scheduling. The priority-controlled packet is transferred to the output classification unit 130. The priority control of the server process 12 will be described later.
[0035]
Step 202) The output classification unit 130 classifies the packets sent from the server process 12 into output queues according to the priority by classification processing, and sets them in the classification output queue 103. A method of classifying encrypted packets will be described later.
[0036]
Step 203) The packet processing unit 120 processes the packet set in the corresponding class output queue 103. Each processing is performed based on the degree of parallelism in the range up to the number of CPUs allocated to each processing. A method for limiting the number of CPUs for packet processing will be described later. In some cases, the cryptographic process is delivered to the cryptographic process in the user process space 10 for processing.
[0037]
Step 204) The packet that has undergone packet processing is set in the output queue 104, and is output via the network interface 20.
[0038]
【Example】
Embodiments of the present invention will be described below with reference to the drawings.
[0039]
In the following embodiment, first, description will be given by taking as an example a case where three services are provided using encrypted communication by IPsec using a computer having eight CPUs.
[0040]
Each service is mainly performed by the server process 12 in the user process space and the packet processing unit 120 in the kernel 100. The three services are service A, service B, and service C.
[0041]
The preconditions in the present embodiment are as follows.
[0042]
FIG. 4 shows the configuration of a service quality control apparatus according to an embodiment of the present invention.
The server process 12 in the user process space of service A is “server process a”, and the priority is “low”.
The server process 12 in the user process space of service B is “server process b”, and the priority is “medium”.
The server process 12 in the user process space of service C is “server process c”, and the priority is “high”.
-Processing in the kernel 100 of service A is performed by "packet processing a", and the priority is "low". The encryption process of the packet process a is performed using “encryption process d”.
-Processing in the kernel 100 of service B is performed by "packet processing b", and the priority is "medium".
-Processing in the kernel 100 of the service c is performed by "packet processing c", and the priority is "high".
Regarding the processing in the kernel 100, the CPU is limited to one for packet processing a, two for packet processing b, and three for packet processing c.
[0043]
Hereinafter, a specific implementation method will be described.
[0044]
(1) Classification method:
A classification method in the input classification unit 110 and the output classification unit 130 will be described below.
[0045]
In communication by IPsec, information such as an encryption key and a decryption key is held as information called SA (Security Association). For each packet, the SA is searched from the source address, destination address, SPI, etc., and encryption or decryption processing is performed. The priority information is described in this SA.
[0046]
FIG. 5 is a diagram for explaining classification according to an embodiment of the present invention.
[0047]
As shown in the figure, the input classification unit 110 and the output classification unit 130 include a packet classification unit 111, a metering unit 112, a marking unit 113, a shaping unit 114, and a queue management unit 115.
[0048]
The classification processing method (processing in the input classification unit 110 and the output classification unit 130) is performed by the same method as the packet forwarding of the normal QoS router. As shown in FIG. 5, first, the packet classification unit 111 searches for the SA as described above, and based on the priority information in the SA, the marking unit 113 writes the priority information to the packet. At the same time, the metering unit 112 observes traffic for each priority class. If excessive traffic flows, the shaping unit 114 discards the packet or the marking unit 113 lowers the priority. Perform processing such as adding new marks. Thereafter, the queue management unit 115 puts them in a queue that matches each priority.
[0049]
(2) How to limit the number of CPUs:
In the packet processing unit 120, the number of CPUs that can be used is limited. This limiting method is realized by limiting the number of threads that the packet processing unit 120 can wake up. Specifically, a variable representing the number of currently executing threads is prepared, and when the number exceeds the limit, the process is stopped until it becomes empty.
[0050]
(3) Priority control of server process 12:
For the priority control of the server process 12 in the user process space 10, a priority control method prepared in a normal OS is tried. In the case of UNIX, priority control is performed based on the nice value.
[0051]
(4) Processing by the cryptographic processing process in the user process space 10:
A packet to be encrypted or decrypted is transferred from the packet processing unit 120 in the kernel 100 to the user process space 10. Then, the packet encryption processing is performed in the user process space having a lower priority than the kernel space, and in the state where the priority is also given in the user process space 10 by the nice. The packet that has been processed is returned to the packet processing unit 120 inside the kernel 100 again.
[0052]
The above embodiment has been described with reference to FIG. 4. However, the processing of the classifying units 110 and 130 and the packet processing unit 120 in the kernel is constructed as a program and connected to a computer used as a service quality control device. It is possible to easily realize the present invention by storing it in a portable storage medium such as a disk device, a floppy disk, or a CD-ROM, and installing it when implementing the present invention.
[0053]
The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.
[0054]
【The invention's effect】
As described above, according to the present invention, in the OS, the number of CPUs to which the packet process in the kernel process and the server process in the user process space is limited, and the process originally performed in the kernel is encrypted in the user process space. It is effective when providing a communication service that guarantees secure and real-time service quality by encrypted communication by using the process and controlling the service quality. For example, there is a case where both a time delivery service such as NTP and a file transfer service are provided by encrypted communication.
[0055]
In the future, it will be natural to consider security on the Internet, and IPsec is expected to be used as the standard. Therefore, in such a case, it is expected that service quality control as in the present invention will be important.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a service quality control apparatus of the present invention.
FIG. 2 is a flowchart of an input operation according to the present invention.
FIG. 3 is a flowchart of the output operation of the present invention.
FIG. 4 is a configuration diagram of a service quality control apparatus according to an embodiment of the present invention.
FIG. 5 is a diagram for explaining classification according to an embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 User process space 12 Server process 20 Network interface 100 Kernel 101 Input queue according to class 102 Input queue 103 Output queue according to class 104 Output queue 110 Input classification part 111 Packet classification part 112 Mailing part 113 Marking part 114 Shaping part 115 Queue management part 120 packet processing unit 130 output classification unit

Claims (3)

When performing secure communication by encrypting packets, encryption / decryption processing is performed in the kernel, and communication that guarantees the quality of service using a multi-CPU and an OS that supports multi-thread in the kernel A quality of service control method in encrypted communication for performing
A classification step for classifying an input packet according to the type of service in a kernel process and a server process that performs a service in the user process space ;
The number of CPUs assigned to each classified class is controlled, and encryption / decryption processing of packets with low priority among the classified packets is processed by a process in the user process space having a lower priority than the kernel space. A packet processing step;
Service quality control method for encrypted communication, wherein the <br/> be performed. When performing secure communication by encrypting packets, encryption / decryption processing is performed in the kernel, and communication that guarantees the quality of service using a multi-CPU and an OS that supports multi-thread in the kernel A service quality control apparatus in encrypted communication for performing
Classifying means for classifying the input packet according to the type of service in the kernel process and the server process that performs the service in the user process space ;
The number of CPUs assigned to each classified class is controlled, and encryption / decryption processing of packets with low priority among the classified packets is processed by a process in the user process space having a lower priority than the kernel space. Packet processing means;
QoS controller in encrypted communication, characterized in that it comprises a. When performing secure communication by encrypting packets, encryption / decryption processing is performed in the kernel, and communication that guarantees the quality of service using a multi-CPU and an OS that supports multi-thread in the kernel A storage medium storing a service quality control program for performing
A storage medium storing a service quality control program, wherein a program for causing a computer to execute processing for realizing the service quality control method according to claim 1 is stored.

Images