JP5861424B2 - COMMUNICATION SYSTEM, CONTROL DEVICE, COMMUNICATION METHOD, AND PROGRAM - Google Patents

Description

  The present invention relates to a communication system, a control device, a communication method, and a program, and more particularly, to a communication system, a control device, a communication method, and a program including a control device that centrally controls communication nodes such as switches.

  In recent years, a technique called OpenFlow has been proposed (see Patent Document 1, Non-Patent Documents 1 and 2). OpenFlow captures communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis. The OpenFlow switch specified in Non-Patent Document 2 includes a secure channel for communication with the OpenFlow controller, and operates according to a flow table that is appropriately added or rewritten from the OpenFlow controller. The flow table defines, for each flow, a set of a match field (Match Fields) in which contents to be matched with the packet header are defined, flow statistical information (Counters), and instructions (Instructions) that define processing contents. (See FIG. 16).

  For example, when the OpenFlow switch receives a packet, the OpenFlow switch searches the flow table for an entry having a match field (see FIG. 16) that matches the header information of the received packet. If an entry that matches the received packet is found as a result of the search, the OpenFlow switch updates the flow statistical information (counter) and processes the processing (designated) in the instruction field of the entry for the received packet. Perform packet transmission, flooding, discard, etc. from the port. On the other hand, if no entry that matches the received packet is found as a result of the search, the OpenFlow switch requests the OpenFlow controller to set an entry, that is, determines the processing content of the received packet, via the secure channel. Send a request. The OpenFlow switch receives the flow entry corresponding to the request and updates the flow table. In this way, the OpenFlow switch performs packet transfer using the entry stored in the flow table as a processing rule.

  Non-Patent Document 3 proposes a method for restricting access using user authentication in a system using the above-described OpenFlow.

  Patent Document 2 discloses a network security monitoring system that controls whether communication between information processing terminals is possible based on an access policy. According to the publication, the network security monitoring system determines whether communication between information processing terminals connected on the network is permitted or not based on the access policy, and the access policy of the information processing terminal determined to be disapproved is not permitted. Information that is defined as non-permitted in the access policy by repeatedly transmitting information for interrupting communication between information processing terminals determined to be non-permitted at regular time intervals until updated to perm It is described that communication between processing terminals is quickly and surely cut off, and a communicable state between information processing terminals defined as permission is maintained.

International Publication No. 2008/095010 No. 2009/031453

Nick McKeown and 7 others, “OpenFlow: Enabling Innovation in Campus Networks”, [online], [searched on September 1, 2011], Internet <URL: http://www.openflow.org/documents/ openflow-wp-latest.pdf> “OpenFlow Switch Specification” Version 1.1.0 Implemented (Wire Protocol 0x02), [online], [searched on September 1, 2011], Internet <URL: http://www.openflow.org/ documents / openflow-spec-v1.1.0.pdf> Yasuhiro Yamazaki, Junichi Yamato, Yoshinori Miyamoto, Hideaki Goto, Hideaki Sone, “Campus VLAN System by OpenFlow”, IEICE Technical Report, IEICE, July 2011, IEICE Technical Report CQ2011-26, pp.43-48

  The following analysis is given by the present invention. When communicating with a certain partner, it is necessary to resolve the address of the lower layer in order to transfer a frame or packet for the partner to the correct partner. For this purpose, for example, ARP (Address Resolution Protocol) is prepared in IPv4 (Internet Protocol Version 4), and NDP (Neighbor Discovery Protocol) is prepared in IPv6 (Internet Protocol Version 6). Hereinafter, in ARP and NDP, a message requesting resolution of an address such as a MAC (Media Access Control) address corresponding to an upper address is referred to as an “address resolution request message”.

  In the above-described centralized control communication system represented by OpenFlow, when a new address resolution request message is received from an external node, the communication node (Patent Document 1, Non-Patent Documents 1 and 2, “OpenFlow Switch”). Corresponds to the control device (corresponding to “Open Flow Controller” in Patent Document 1, Non-Patent Documents 1 and 2), and inquires about processing for the address resolution request message. In response to this, the control device determines the transfer path of the address resolution request message as necessary, and performs control to transmit the address resolution request message to the destination external node. Also, when there is a response from the destination external node, control is performed in the same procedure to transmit a response message including an address to the source external node.

  The response message includes the lower address of the external node. For this reason, even in the centralized control type communication system, there is a problem in that it is possible to obtain the lower address of the other party to which access is originally not permitted by using the address resolution request message. Further, when the external nodes are originally not permitted to access, the transfer of the address resolution request message and the response message described above results in unnecessary traffic.

  Note that the network security monitoring system of Patent Document 2 is not a centralized control communication system such as Patent Document 1 and Non-Patent Documents 1 and 2. For this reason, each information processing terminal exchanges an ARP request packet and its response as needed. Therefore, the network security monitoring system intercepts the ARP request packet, determines whether communication is permitted / not permitted, and repeatedly transmits information for blocking communication between terminals determined to be not permitted communication for a certain period of time. Is going.

  The present invention has been made in view of the above-described circumstances, and the object of the present invention is to provide an address resolution request that should be prohibited or unnecessary in a centralized control communication system represented by the above-described OpenFlow. It is an object of the present invention to provide a communication system, a control device, a communication method, and a program that can suppress exchange of a message and its response message.

According to the first aspect of the present invention, at least one or more communication nodes, a control device that controls the communication nodes and controls communication between a plurality of external nodes, and communication availability between the plurality of external nodes A communication enable / disable storage device that stores communication enable / disable information that defines an address resolution request message received via the communication node is permitted to communicate with the external node from one external node. If it is not an address resolution request message requesting resolution of the address of another external node, the communication node is controlled to suppress forwarding of the address resolution response message to the source of the address resolution request message. A communication system for suppressing address responses is provided.

According to the second aspect of the present invention, at least one communication node arranged between a plurality of external nodes, and communication enable / disable storage for storing communication enable / disable information defining whether communication is possible between the plurality of external nodes. An address resolution request message that is connected to a device and received via the communication node requests the resolution of an address of another external node that is permitted to communicate with the external node from one external node. If it is not a message, a control device is provided that controls the communication node to suppress the forwarding of the address resolution response message, thereby suppressing the response of the address to the transmission source of the address resolution request message.

According to the third aspect of the present invention, at least one or more communication nodes, a control device that controls the communication nodes and controls communication between a plurality of external nodes, and whether communication between the plurality of external nodes is possible or not In a communication system including a communication availability storage device that stores communication availability information that defines an address, an address resolution request message received via the communication node is permitted to communicate with the external node from one external node. Confirming whether the address resolution request message is a request for resolving an address of another external node, and the address resolution request message is transmitted from one external node to another external node that is permitted to communicate with the external node. If not address resolution request message requesting the address resolution external nodes, suppresses the transfer of the address resolution response message By controlling so that the communication node, the communication method comprising the steps of inhibiting a response address to the source of the address resolution request message is provided. This method is associated with a specific machine called a control device that controls a communication node.

  According to a fourth aspect of the present invention, at least one or more communication nodes, a control device that controls the communication nodes and controls communication between a plurality of external nodes, and whether communication between the plurality of external nodes is possible or not In the communication system including the communication availability storage device that stores the communication availability information that defines the communication address, the address resolution request message received via the communication node is permitted to be connected to the external node from one external node. A process for confirming whether or not the address resolution request message is a request for resolving the address of another external node, and the address resolution request message is sent to another external node that is permitted to connect to the external node. If it is not an address resolution request message requesting resolution of an external node address, an address to the sender of the address resolution request message is sent. And processing for suppressing the response of the scan, the program to be executed by a computer constituting the control device is provided. This program can be recorded on a computer-readable storage medium. That is, the present invention can be embodied as a computer program product.

  According to the present invention, in a centralized control type communication system, it is possible to suppress exchange of an address resolution request message and a response message that should be prohibited or unnecessary.

It is a figure showing the structure of one Embodiment of this invention. It is a figure for demonstrating the operation | movement outline | summary of one Embodiment of this invention. It is another figure for demonstrating the operation | movement outline | summary of one Embodiment of this invention. It is a figure showing the structure of the 1st Embodiment of this invention. It is a figure showing the detailed structure of OFC and OFS of the 1st Embodiment of this invention. It is an example of the entry of an ARP table. It is a figure for demonstrating the information contained in an ARP request packet. It is a figure for demonstrating the information contained in an ARP response packet. It is an example of the entry hold | maintained in OFC access control DB of the 1st Embodiment of this invention. It is a flowchart showing operation | movement of OFC of the 1st Embodiment of this invention. It is a sequence diagram showing operation | movement (at the time of access permission determination) of the 1st Embodiment of this invention. It is a sequence diagram showing operation | movement (at the time of access impossibility determination) of the 1st Embodiment of this invention. It is a figure showing the structure of the 2nd Embodiment of this invention. It is a figure showing the structure of the 3rd Embodiment of this invention. It is an example of the entry hold | maintained at access control DB of the 4th Embodiment of this invention. It is a figure showing the structure of the flow entry of a nonpatent literature 2. FIG.

  First, an outline of an embodiment of the present invention will be described with reference to the drawings. Note that the reference numerals of the drawings attached to this summary are attached to the respective elements for convenience as an example for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.

  As shown in FIG. 1, the present invention, in one embodiment, at least one or more communication nodes 200, a control device 100 that controls the communication nodes 200 and controls communication between a plurality of external nodes, and communication This can be realized by a configuration including the availability storage device 300. The communication availability storage device 300 stores connection availability information defining whether or not the plurality of external nodes can be connected. For example, in the example of FIG. 1, the connection between the external node A and the external node B and the connection between the external node B and the external node C are possible (OK), but the connection between the external node A and the external node C is not possible (NG). It is assumed that the connection availability information is set.

  In the control device 100, the address resolution request message received via the communication node 200 is not an address resolution request message for requesting resolution of an address of another external node permitted to connect to the external node from one external node. If the message is a message requesting resolution of an address between external nodes for which connection is prohibited, the response of the address to the transmission source of the address resolution request message is suppressed.

  For example, prior to communication between the external node A and the external node B in FIG. 1, the external node A needs to resolve the address of the external node B. Therefore, the external node A transmits an address resolution request message addressed to the external node B (“external node B address resolution request message” in FIG. 2).

  The communication node 200 that has received the address resolution message reports to the control device 100 that it has received the address resolution request message (“address resolution request message reception report” in FIG. 2). The control device 100 refers to the connection availability information held in the communication availability storage device 300 and confirms that the connection between the external node A and the external node B is possible. In this case, the control device 100 instructs the communication node 200 to transmit the address resolution request message to the external node B (“address resolution request message processing content instruction” in FIG. 2).

  The communication node 200 transfers the address resolution request message to the external node B. After that, as shown in FIG. 3, when a response to the address resolution request message (address resolution response message) is transmitted from the external node B, the communication node 200 has received the address resolution response message to the control device 100. ("Address resolution response message reception report" in FIG. 3).

  The control device 100 refers to the connection availability information held in the communication availability storage device 300 and confirms that the connection between the external node A and the external node B is possible. In this case, the control apparatus 100 instructs the communication node 200 to transmit the address resolution response message to the external node A (“address resolution response message processing content instruction” in FIG. 3).

  The communication node 200 transfers the address resolution response message to the external node B (“external node B address resolution message” in FIG. 3). As a result, the external node A is notified of the address of the external node B. Thereafter, the external node A starts communication with the external node B using the notified address of the external node B.

  On the other hand, when the external node A transmits the address resolution request message of the external node C, the control device 100 operates as follows. The communication node 200 that has received the address resolution message addressed to the external node C from the external node A reports to the control device 100 that it has received the address resolution request message (“address resolution request message reception report” in FIG. 2). . The control device 100 refers to the connection availability information held in the communication availability storage device 300 and confirms that the connection between the external node A and the external node C is not possible. In this case, the control device 100 instructs the communication node 200 to discard the address resolution request message (“address resolution request message processing content instruction” in FIG. 2).

  As a result, the exchange of the address resolution request message and the response message that should be prohibited or unnecessary is suppressed. When there are a plurality of communication nodes 200, the control device 100 refers to the network topology configured by the communication nodes 200 and calculates a route so that the address resolution request message is transferred through the shortest route. It may be.

  In the example of FIG. 2, the address response to the address resolution request message transmission source (foreign node A) is suppressed by discarding the address resolution request message. However, the address response is suppressed. Various modes can be adopted as modes. For example, in addition to the method of not sending the above address resolution request message to the response node (external node or control device), the method of discarding the address resolution request message at the response node, as shown in FIG. A method of controlling so that a response from the response node (external node C) is not transmitted to the message transmission source can be considered.

  Further, the control device 100 is provided with an address cache unit that stores the address of each external node based on the address resolution request message or the address resolution response message, and before the control device 100 transfers the address resolution request message. In addition, the address may be returned to the source of the address resolution request message with reference to the address cache unit.

[First Embodiment]
Next, a first embodiment of the present invention in which an address resolution function is provided in an OFC (Open Flow Controller) corresponding to the control device described above will be described in detail with reference to the drawings.

  FIG. 4 is a diagram showing the configuration of the first exemplary embodiment of the present invention. Referring to FIG. 4, OFC 10, k OFS (open flow switches) 20a-20k controlled by OFC 10, m external nodes 9a1-9am connected to OFS 20a, and n externals connected to OFS 20k. A configuration including nodes 9k1 to 9kn is shown. Note that the network topology shown in FIG. 4 is an example created to help the understanding of the present invention, and various modifications can be made in practice.

  The OFC 10 is a computer that controls the OFSs 20a to 20k (hereinafter referred to as “OFS20” when OFS is not particularly distinguished), and corresponds to the above-described control device. The OFC 10 is connected to the OFS 20 via a secure channel, and performs necessary communication with the OFS 20 using the OpenFlow protocol of Non-Patent Document 2. In the example of FIG. 4, one unit is shown as an OFC, but a cluster may be composed of a plurality of OFCs. In this way, the number of OFSs 20 that can be processed can be increased and the fault tolerance can be improved.

  The OFS 20 is a communication device that processes a packet corresponding to the communication node 200 described above. The external nodes 9a1 to 9am and 9k1 to 9kn (hereinafter referred to as “external node 900” when the external nodes are not particularly distinguished) are various host devices and server devices used by the user. In addition, a wireless base station device that is wirelessly connected to a mobile terminal or the like may be included as an external node.

  FIG. 5 is a diagram illustrating a detailed configuration of the OFC and OFS according to the first embodiment of this invention. Referring to FIG. 5, the OFC 10 and the OFS 20 are shown. First, the configuration of the OFC 10 will be described. The OFC 10 includes an ARP processing unit 11 and an access control database (access control DB) 12. The OFC 10 includes other path calculation functions, OFS management functions, flow entry setting functions, and the like, but these processing blocks are omitted.

  The ARP processing unit 11 holds an ARP (Address Resolution Protocol) table (functioning as an address storage unit) that stores entries in which IP addresses and MAC addresses are associated with each other as shown in FIG. Registration of an entry in the ARP table may be performed by a user (network administrator), or the OFC 10 acquires a combination of an IP address and a MAC address from the received packet, registers the combination in the ARP table, and functions as an address cache unit You may make it do.

  When the ARP processing unit 11 receives the ARP request packet via the OFS 20, the ARP processing unit 11 accesses the access control DB 12, and communication is permitted for the combination of the source IP address and the destination (ARP request destination) IP address of the ARP request packet. It is confirmed whether or not it is a combination of external nodes. As a result of the confirmation, if it is found that the MAC address is resolved prior to communication between external nodes that are permitted to communicate, the ARP processing unit 11 is designated by the ARP request packet from the ARP table. The MAC address corresponding to the IP address is retrieved, and an ARP response packet is generated using the result. Further, the ARP processing unit 11 controls the OFS 20 to transfer the generated ARP response packet to the transmission source of the ARP request packet. On the other hand, as a result of the confirmation, when it is determined that the MAC address is resolved prior to communication between external nodes that are not permitted to communicate, the ARP processing unit 11 discards the ARP request packet.

  FIG. 7 is a diagram for explaining information included in header information of an ARP request packet. Whether or not communication between external nodes described above is permitted can be determined by reading the communication enable / disable flag (see FIG. 9) of the entry having the combination of the source / destination IP address of the ARP request packet from the access control DB 12. . If the communication enable / disable flag is a positive value, the ARP processing unit 11 has an IP address that matches the destination (ARP request destination) IP address of the ARP request packet from the ARP table storing the entries shown in FIG. Search the MAC address of the entry. At this time, since the destination (ARP request destination) MAC address is unknown, a 0 value is set in the MAC address field.

  FIG. 8 is a diagram for explaining information included in the header information of the ARP response packet. When the ARP processing unit 11 finds an entry having an IP address that matches the destination (ARP request destination) IP address of the ARP request packet from the ARP table storing the entries shown in FIG. 6, the search result (ARP An ARP response packet in which the MAC address of the entry is stored in the MAC field of the request receiving side information) is generated.

  The access control DB 12 corresponds to the communication availability storage device 300 described above, and holds entries defining communication availability information between external nodes using IP addresses assigned to the external nodes. FIG. 9 is an example of entries held in the access control DB 12. In the example of FIG. 9, a communication enable / disable flag field is provided, and a communication enable / disable state can be defined for each entry. However, only combinations that allow communication are stored as entries, and the corresponding combinations are found. Otherwise, it is possible to adopt a configuration for determining that communication is prohibited. Similarly, it is also possible to employ a configuration in which only combinations for which communication is prohibited are stored as entries, and if the corresponding combination is not found, it is determined that communication is permitted. Further, when an IP address is used as shown in FIG. 9, it can be handled as a range of addresses by combining it with a netmask.

  Next, the configuration of the OFS 20 in FIG. 5 will be described. The OFS 20 includes a packet processing unit 21 and a flow entry storage unit 22. As such OFS 20, the open flow switch described in Non-Patent Documents 1 and 2 can be used.

  The flow entry storage unit 22 stores a flow entry as shown in FIG. 16 using a table or the like.

  When receiving a packet from the external node 900, the packet processing unit 21 searches the flow entry storage unit 22 for an entry having a match field that matches the characteristics of the received packet such as the packet header. As a result of the search, when an entry having a match field that matches the characteristics of the received packet is found, the packet processing unit 21 executes the processing content described in the instruction field of the entry. On the other hand, if no entry having a match field that matches the characteristics of the received packet is found as a result of the search, the packet processing unit 21 transmits the received packet or the information contained in the received packet to the OFC 10, and the flow Request entry settings.

  Since the OFC 10 does not create a flow entry corresponding to the ARP request packet, there is no flow entry corresponding to the ARP request packet in the flow entry storage unit 22. Therefore, when the OFS 20 receives the ARP request packet, the OFS 20 transmits the ARP request packet or information included in the ARP request packet to the OFC 10 to request setting of the flow entry. In this embodiment, transmission of the ARP request packet from the OFS 20 to the OFC 10 is realized using this mechanism.

  Note that each unit (processing unit) of the OFC 10 illustrated in FIG. 5 can also be realized by a computer program that causes a computer that configures the OFC 10 to execute the above-described processes using its hardware.

  Next, the operation of this embodiment will be described in detail with reference to the drawings. FIG. 10 is a flowchart showing the operation of the OFC according to the first embodiment of this invention. Referring to FIG. 10, first, the OFC 10 waits for reception of a packet (or information included in the packet) from the OFS 20 (step S001). When the OFS 20 receives the packet (or information included in the packet) from the OFS 20, the OFS 20 receives the packet. It is determined whether or not the received packet is an ARP request packet (step S002).

  Whether the OFS 20 has received the ARP request packet can be determined, for example, by determining whether 0x0806 is set in the type field of the Ethernet (registered trademark) frame. Here, when it is determined that the packet is a packet other than the ARP request packet such as a user packet (No in step S002), the OFC 10 refers to the network topology configured by the OFS 20 and includes the packet (or the packet included in the packet). Information) is calculated from the source OFS to the egress OFS, and a flow entry is set in each OFS so as to transfer the packet along the calculated path (step S007).

  On the other hand, when it is determined in step S002 that the OFS 20 has received the ARP request packet (Yes in step S002), the OFC 10 accesses the access control DB 12 and is included in the packet (or information included in the packet) received from the OFS 20. The entry corresponding to the transmission source IP address and the transmission destination (destination) IP address is searched (step S003). As a result of the search, if no entry is found in which the communication enable flag is set in the communication enable / disable flag field, the OFC 10 ends the process without performing a response to the ARP request packet (No in step S004).

  On the other hand, as a result of the search, if an entry having a communication enable flag set in the communication enable / disable flag field is found, the OFC 10 makes an inquiry using an ARP request packet from the ARP table storing the entries shown in FIG. The MAC address corresponding to the received IP address is searched (step S005). Then, the OFC 10 generates an ARP response packet by using the searched MAC address and transmits it to the OFS 20 (step S006). Further, the OFC 10 controls the OFS 20 to transfer the ARP response packet to the external node that is the transmission source of the ARP request packet. For the transfer instruction of the ARP response packet, a packet-out message of the open flow protocol of Non-Patent Document 2 can be used.

  Next, the overall operation when an ARP request packet is transmitted from the external node 900 will be described with reference to FIGS.

  When the external node 900 transmits an ARP request packet (S101 in FIGS. 11 and 12), the OFS 20 transfers the ARP request packet (or information included in the ARP request packet) to the OFC 10 (S102 in FIGS. 11 and 12). ).

  The OFC 10 refers to the access control DB 12 based on the ARP request packet (or information included in the ARP request packet) received from the OFS 20, and the external node that is the transmission source of the ARP request packet and the external where the address resolution is requested. It is confirmed whether or not communication with the node is possible (S103 and S104 in FIGS. 11 and 12).

  As a result of the confirmation, if it is found that the external node that is the source of the ARP request packet and the external node for which address resolution is requested cannot be communicated, the OFC 10 ends the subsequent processing (FIG. 12). reference).

  On the other hand, if it is determined as a result of the confirmation that communication is possible between the external node that is the source of the ARP request packet and the external node that is requested to resolve the address, the OFC 10 stores the entry shown in FIG. The MAC address corresponding to the IP address of the external node for which address resolution is requested is searched from the ARP table (S105 and S106 in FIG. 11).

  If the MAC address corresponding to the IP address of the external node for which address resolution is requested is found as a result of the search, the OFC 10 generates an ARP response packet including the found MAC address, and transmits it to the OFS 20. The ARP response packet is instructed to be transferred to the external node 900 that is the transmission source of the ARP request packet (S107 in FIG. 11).

  The OFS 20 transfers the ARP response packet to the external node 900 in accordance with the instruction from the OFC 10 (S108 in FIG. 11). If the MAC address is not found as a result of the search in S105 and S106 in FIG. 11, the OFC 10 may resolve the MAC address by transferring the ARP request packet itself, or transfer of the ARP request packet of the OFS 20 May be indicated.

  By doing as described above, it is possible to prevent the MAC address from being known to an external node whose communication is prohibited when viewed from a certain external node. Such concealment of the MAC address also helps to improve security.

  Further, in this embodiment, in addition to the MAC address delivery control based on the confirmation of the communication availability, the ARP request packet is not broadcasted, so unnecessary traffic for MAC address resolution is greatly reduced. Is done. Since the amount of packets flowing through the network can be reduced in this way, network utilization efficiency is also improved.

[Second Embodiment]
Subsequently, a second embodiment of the present invention in which a change is made to the above-described first embodiment will be described. The present embodiment is a modification of the configuration of the first embodiment, but the functions and operations are almost the same, and therefore the differences will be mainly described below.

  FIG. 13 is a diagram showing the configuration of the second exemplary embodiment of the present invention. The difference from the first embodiment shown in FIG. 5 is that the OFC 10B accesses the external access control DB 12 to determine whether to respond to the ARP request packet transmitted from the external node 900. .

  As such an access control DB 12, a device equivalent to a server called a policy server that manages ACL (Access Control List) can be used.

  Therefore, according to the present embodiment, in addition to the effects of the first embodiment, the installation cost and management cost of the access control DB 12 can be reduced.

[Third Embodiment]
Next, a third embodiment of the present invention in which a change is made to the above-described second embodiment will be described. The present embodiment is a modification of the configuration of the first and second embodiments, but the functions and operations are substantially the same, and therefore the differences will be mainly described below.

  FIG. 14 is a diagram showing the configuration of the third exemplary embodiment of the present invention. The difference from the second embodiment shown in FIG. 13 is that the ARP processing unit 11 of the OFC 10B is omitted, and address resolution is performed using an external ARP processing device 13 instead.

  Similar to the ARP processing unit 11 of the first and second embodiments, the ARP processing device 13 holds an ARP table (address storage unit) and generates an ARP response packet for the ARP request packet. It functions as a device.

  In the present embodiment, when the OFC 10C determines that communication is possible between the external node that is the source of the ARP request packet and the external node that is requested to resolve the address, the OFC 10C sends the ARP request packet to the ARP processing device 13 via the OFS 20. Forward to. Further, the OFC 10 sets a flow entry in the OFS 20 for transferring the ARP response packet output from the ARP processing device 13 to the external node 900 that is the transmission source of the ARP request packet.

  As described above, the ARP response packet output from the ARP processing device 13 is transferred to the external node 900 that is the transmission source of the ARP request packet.

  As described above, according to the present embodiment, in addition to the effects of the first and second embodiments, the load on the OFC 10 can be reduced. The reason is that the ARP response process is performed using an external resource.

  In the above-described embodiment, the control is performed based on whether or not the ARP request packet is transferred to the ARP processing device 13. However, in principle, the ARP request packet is transferred to the ARP processing device 13 and the ARP processing is performed. Control may be performed according to whether or not the ARP response packet from the device 13 is transferred.

[Fourth Embodiment]
Next, a description will be given of a fourth embodiment of the present invention in which a change is made to the access control DB 12 of the first to third embodiments described above. In the present embodiment, the entries in the access control DB 12 of the first to third embodiments are modified, and the configuration, function, and operation are almost the same. Therefore, the differences will be mainly described below.

  FIG. 15 is an example of entries held in the access control DB according to the fourth embodiment of this invention. The difference from the entry shown in FIG. 9 is that a port number field is added to each of the protocol field, the source, and the destination.

  The protocol field is a field in which a value specifying a protocol such as TCP / UDP is set. In the port number field, a TCP / UDP source port number and a TCP / UDP destination port number are set.

  It is possible to remove the designation of the port number or protocol by registering a value indicating ANY in the protocol and port number. Further, as for the port number, not only a specific number but also an arbitrary range may be designated. An IP address can also be handled as a range of addresses by combining with an net mask.

  As described above, according to the present embodiment, it is possible to control whether or not access is possible in units of port numbers, that is, whether or not an ARP response is necessary. Of course, in this embodiment as well, only a combination for which communication is permitted may be held as an entry, and if a corresponding combination is not found, it may be determined that communication is prohibited. Similarly, only a combination for which communication is prohibited may be held as an entry, and if a corresponding combination is not found, it may be determined that communication is permitted.

  Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and further modifications, substitutions, and adjustments are possible without departing from the basic technical idea of the present invention. Can be added. For example, the number of OFCs, OFSs, external nodes, and their topology configurations exemplified in the above description of the embodiment are simplified to help understanding of the present invention, and are complicated and configured with more elements. It can also be applied to networks.

  In each of the above-described embodiments, an example in which an ARP request packet is used as an address resolution request message has been described. However, in the present invention, a Neighbor Solicitation message in IPv6 NDP and its response are exchanged. Is also applicable.

  In each of the above-described embodiments, the OFC or the ARP processing device responds to the ARP request packet. However, the OFC controls the OFS and transfers the ARP request packet to the destination external node. A response may be returned. In this case, the OFC may perform unicast by calculating the transfer route of the ARP request packet, or may broadcast without calculating the transfer route.

Finally, a preferred form of the invention is summarized.
[First embodiment]
(Refer to the communication system according to the first viewpoint)
[Second form]
In the communication system of the first form,
A communication system for suppressing an address response to a transmission source of the address resolution request message by controlling the communication node to suppress transfer of the address resolution request message or the address resolution response message.
[Third embodiment]
In the communication system of the first or second form,
The control device receives an address resolution request message received via the communication node as an address resolution request message for requesting resolution of an address of another external node permitted to communicate with the external node from one external node. If there is, a communication system for controlling the communication node to perform unicast or broadcast of the address resolution request message.
[Fourth form]
In the communication system of the third form,
The communication device controls the communication node so that the address resolution request message is transferred through the shortest path with reference to a network topology constituted by the communication node.
[Fifth embodiment]
In the communication system according to any one of the first to fourth aspects,
The control device further includes an address cache unit that stores the address of each external node based on the address resolution request message or the address resolution response message,
A communication system that refers to the address cache unit and responds an address to a transmission source of the address resolution request message.
[Sixth embodiment]
In the communication system of the first form,
The control device further includes an address storage unit that stores an address of each external node,
A communication system that refers to the address storage unit and responds an address to a transmission source of the address resolution request message.
[Seventh form]
In the communication system of the first form,
The control device is further connected to an address storage device that stores an address of each external node,
A communication system for suppressing an address response to a transmission source of the address resolution request message by suppressing transfer of an address resolution request message to the address storage device or transfer of an address resolution response message from the address storage device.
[Eighth form]
In the communication system according to any one of the first to seventh aspects,
In the communication availability storage device, communication availability between the external nodes is defined using an address higher than the address of the external node,
The control device is a communication system for determining whether or not communication is possible by using the upper address set included in the address resolution request message.
[Ninth Embodiment]
In the communication system according to any one of the first to eighth aspects,
The address is a MAC address;
The communication system wherein the address resolution request message is an IPv4 or IPv6 address resolution message.
[Tenth embodiment]
(Refer to the control device according to the second viewpoint)
[Eleventh form]
(Refer to the communication method according to the third viewpoint)
[Twelfth embodiment]
(Refer to the program from the fourth viewpoint above.)

  Within the scope of the entire disclosure (including claims) of the present invention, the embodiments and examples can be changed and adjusted based on the basic technical concept. Further, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. It is. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

10, 10B, 10C OFC
11 ARP processing unit 12, 12B Access control database (access control DB)
13 ARP processing device 20, 20a-20k OFS
21 packet processing unit 22 flow entry storage unit 100 control device 200 communication node 300 communication availability storage device 9a1 to 9am, 9k1 to 9kn, 900 external node

Claims (10)

At least one communication node;
A control device for controlling the communication node and controlling communication between a plurality of external nodes;
A communication enable / disable storage device that stores communication enable / disable information defining communication enable / disable between the plurality of external nodes, and
In the control apparatus, the address resolution request message received via the communication node is not an address resolution request message for requesting resolution of an address of another external node permitted to communicate with the external node from one external node. A communication system that suppresses an address response to a transmission source of the address resolution request message by controlling the communication node to suppress transfer of the address resolution response message . The address resolution request message by controlling the communication nodes to inhibit the transfer of di, communication system according to claim 1 for inhibiting a response address to the source of the address resolution request message.   The control device receives an address resolution request message received via the communication node as an address resolution request message for requesting resolution of an address of another external node permitted to communicate with the external node from one external node. 3. The communication system according to claim 1, wherein the communication node is controlled to perform unicast or broadcast of the address resolution request message.   The communication system according to claim 3, wherein the control device controls the communication node so that the address resolution request message is transferred through the shortest path with reference to a network topology configured by the communication node. The control device further includes an address cache unit that stores the address of each external node based on the address resolution request message or the address resolution response message,
The communication system according to any one of claims 1 to 4, wherein an address is returned to a transmission source of the address resolution request message with reference to the address cache unit. The control device further includes an address storage unit that stores an address of each external node,
The communication system according to claim 1, wherein an address is returned to a transmission source of the address resolution request message with reference to the address storage unit. In the communication availability storage device, communication availability between the external nodes is defined using an address higher than the address of the external node,
The communication system according to any one of claims 1 to 6, wherein the control device determines whether or not communication is possible by using the upper address set included in the address resolution request message. The address is a MAC address;
The communication system according to any one of claims 1 to 7, wherein the address resolution request message is an IPv4 or IPv6 address resolution message. At least one communication node disposed between a plurality of external nodes;
Connected to a communication availability storage device for storing communication availability information defining communication availability between the plurality of external nodes,
If the address resolution request message received via the communication node is not an address resolution request message for requesting resolution of an address of another external node that is permitted to communicate with the external node from one external node, the address resolution A control device that suppresses response of an address to a transmission source of the address resolution request message by controlling the communication node to suppress transfer of a response message . At least one communication node;
A control device for controlling the communication node and controlling communication between a plurality of external nodes;
In a communication system including a communication availability storage device that stores communication availability information defining communication availability between the plurality of external nodes,
Whether the address resolution request message received via the communication node is an address resolution request message for requesting resolution of the address of another external node that is permitted to communicate with the external node from one external node. Steps to check,
If the address resolution request message is not an address resolution request message requesting resolution of an address of another external node that is permitted to communicate with the external node from one external node , forwarding of the address resolution response message is suppressed. And controlling the communication node to suppress an address response to the source of the address resolution request message.

Images