JP5964789B2 - Load balancing system and method - Google Patents

Description

  The present invention relates to load distribution that dynamically distributes packets while maintaining a TCP (Transmission Control Protocol) session.

  In the service function implemented in the IP (Internet Protocol) network, packets are sent to multiple service processing devices (such as TCP-statefull firewalls) that realize services for the purpose of flexible facility design and cost reduction according to demand. Distribution is performed (an example of a distribution apparatus that distributes packets is disclosed in Non-Patent Document 1).

  In this case, the distribution device needs to distribute packets while maintaining the TCP session. The reason why the TCP session needs to be maintained will be described with reference to FIG.

  As shown in FIG. 3, the TCP-statefull firewall holds the TCP state (State) based on the signal of each packet, and discards packets that do not follow the sequence.

  Therefore, the distribution device needs to maintain the TCP session and distribute packets of the same TCP session to the same service processing device.

  Also, the distribution device needs to distribute packets dynamically. The dynamic distribution method is a distribution method in which a distribution rule is not provided in a fixed manner and is determined according to the load status of the service processing apparatus and is appropriately changed.

  Hereinafter, the sorting device of the existing technology will be described in detail.

  First, a load distribution system in which a distribution device is incorporated will be described.

  FIG. 4 shows an example of a network configuration of the load distribution system.

  As illustrated in FIG. 4, the load distribution system of this example includes distribution devices 10-1 and 10-2 and service processing devices 20-1 to 20-3.

  The distribution device 10-1 is arranged on the client side, and distributes the upstream packet from the client to one of the service processing devices 20-1 to 20-3.

  The distribution device 10-2 is arranged on the server side, and distributes downlink packets from the server to any of the service processing devices 20-1 to 20-3.

  In FIG. 4, three service processing devices 20-1 to 20-3 are shown, but the number of service processing devices 20 is not particularly limited as long as it is two or more.

  In FIG. 4, the clients and servers are omitted, but the number of clients and servers is not particularly limited.

  FIG. 5 shows a functional block diagram of the sorting apparatus of the existing technique 1. 5 assumes that the distribution device of the existing technology 1 is incorporated as the distribution device 10-1 in the load distribution system of FIG.

  As illustrated in FIG. 5, the sorting device of the existing technique 1 includes a transfer unit 111, a TCP state management unit 112, and a round robin processing unit 113.

  The transfer unit 111 includes a management table 114.

  The management table 114 includes a rule identifier composed of SA (Source Address), DA (Destination Address), SP (Source Port), DP (Destination Port), and its rules. It is a table holding a distribution rule including a session state of a TCP session to which a packet identified by an identifier belongs, and a destination device ID of a destination device that is a destination of the packet.

  The distribution rule is generated by passing an upstream SYN packet and set in the management table 114. At this time, the Next device ID managed by the round robin processing unit 113 in the round robin method is set as the destination device ID.

  In the case of uplink active-FIN, the TCP session end sequence is a sequence as shown in FIG. In this case, the distribution rule is deleted from the management table 114 when the upstream ACK packet passes the downstream FIN packet.

  The TCP state management unit 112 checks the TCP flags (TCP-FLG) of all the uplink and downlink packets received by the transfer unit 111 to determine the packet.

  Also, the TCP state management unit 112 searches the management table 114 with the SA, DA, SP, and DP of the packet received by the transfer unit 111, determines whether the TCP flag is in accordance with the state transition, and the session of the management table 114 Change state.

  When receiving the packet, the transfer unit 111 searches the management table 114 with the SA, DA, SP, and DP of the received packet, and transfers the packet to the destination device indicated by the destination device ID of the corresponding distribution rule.

  When searching the management table 114 for downstream packets, the search is performed with SA and DA, SP and DP reversed.

Hajime Uetani, Toru Konno, “Series: Understanding the Basics of Load Balancer (1) Understanding Load Balancing from Packet Flow: NAT / Connection Table / MAT”, February 5, 2003, F5 Networks, [2013 Search January 7], Internet <URL: http://www.atmarkit.co.jp/fnetwork/rensai/lb01/lb01.html>

As described above, the distribution device of the existing technology 1 performs load distribution by dynamically distributing packets while maintaining the TCP session. However, due to the following three factors (1) to (3), The load distribution cannot be accelerated.
(1) In order to maintain the TCP session, it is necessary to check the TCP flags of all the upstream and downstream packets.
(2) In order to maintain the TCP session, it is necessary to manage the session state of the TCP session.
(3) In order to distribute packets in units of TCP sessions, it is necessary to manage distribution rules for the number of simultaneously connected TCP sessions.

  Therefore, the distribution device is also required to increase the load distribution speed.

  Hereinafter, as an example of a distribution device capable of speeding up load distribution, the distribution device of the existing technology 2 will be described.

  In FIG. 7, the functional block diagram of the distribution apparatus of the existing technique 2 is shown. 7 assumes that the distribution device of the existing technology 2 is incorporated into the load distribution system of FIG. 4 as the distribution device 10-1.

  As illustrated in FIG. 7, the distribution device of the existing technique 2 includes a transfer unit 121, a rule timer management unit 122, a round robin processing unit 123, and a rule setting log management unit 124.

  The transfer unit 121 includes a management table 125.

  The management table 125 holds a distribution rule including a rule identifier composed of SA, DA, SP, and DP, and a destination device ID of a destination service processing device 20 that is a destination of an upstream packet identified by the rule identifier. It is.

  The distribution rule is generated by passing an upstream SYN packet and set in the management table 125 as will be described later. At this time, the Next device ID managed by the round robin processing unit 123 using the round robin method is set as the destination device ID.

  When a distribution rule is set in the management table 125, the timer is started by the rule timer management unit 122. When the timer expires, the distribution rule is deleted from the management table 125.

  When receiving the upstream packet, the transfer unit 121 searches the management table 125 using the SA, DA, SP, and DP of the received upstream packet, and determines whether the corresponding distribution rule exists.

  When there is a distribution rule corresponding to the management table 125, the transfer unit 121 transfers the upstream packet to the destination service processing device 20 indicated by the destination device ID of the corresponding distribution rule.

  On the other hand, when the timer expires and there is no distribution rule corresponding to the management table 125, the transfer unit 121 checks whether the TCP flag of the upstream packet is SYN.

  When the uplink packet is a SYN packet, the transfer unit 121 generates a new distribution rule and sets it in the management table 125. At this time, the Next device ID managed by the round robin processing unit 123 using the round robin method is set as the destination device ID.

  On the other hand, if the uplink packet is a packet other than the SYN packet, the distribution rule has already been deleted at this point, and the uplink packet cannot be processed. Such a situation may occur when the timer time is shorter than the communication time. Therefore, in the sorting device of the existing technology 2, the rule setting log management unit 124 manages the rule setting log list 126 in order to set a continuation rule. The rule setting log list 126 is a log list indicating the destination device ID of the destination service processing device 20 to which the packet identified by SA, DA, SP, DP is actually transferred. In this case, the transfer unit 121 transfers the upstream packet to the destination service processing device 20 according to the rule setting log list 126.

  When receiving the downlink packet, the transfer unit 121 does not search the management table 125 and passes the downlink packet as it is.

  Since the distribution device of the existing technology 2 performs the end determination of the TCP session by using a timer without using the management of the TCP state, it is possible to increase the load distribution speed.

However, the sorting device of the existing technique 2 has the following problems.
(1) First problem It is necessary to check the TCP flag of the first packet for each TCP session. Further, since a distribution rule with a timer is set for each TCP session, the number of rules and the number of timers increase.
(2) Second problem Since the timer is fixedly started when the distribution rule is set, it is necessary to set the continuation rule by checking the TCP flag of the packet every time the timer expires. A rule setting log list with a long timer must be maintained and searched.
(3) Third problem Each time a TCP-SYN packet is detected, the destination service processing device 20 is changed by the round robin method. However, the service with the lowest load is caused by the length of the session time, the difference in traffic volume, and the like There is a possibility that the packet cannot be distributed to the processing device 20.

  Therefore, an object of the present invention is to provide a load distribution system and method for solving the problems of the existing technique 2 described above.

The load balancing system of the present invention is
A load distribution system comprising a plurality of service processing devices and a distribution device that distributes packets to be distributed to any of the plurality of service processing devices,
The sorting device is
A management table that holds a distribution rule including an identifier composed of a source address of a packet to be distributed and a prefix length, and a destination device ID of a destination service processing device that is a destination of the packet identified by the identifier;
A minimum load device management unit that manages, as a NEXT device ID, a device ID of a service processing device having the lowest load among the plurality of service processing devices;
When the distribution target packet is received, the management table is searched with the source address and prefix length of the packet, and if there is a corresponding distribution rule, to the destination service processing device indicated by the destination device ID of the distribution rule When the packet is transferred and there is no corresponding distribution rule, it is confirmed whether or not the TCP flag of the packet is SYN. If it is SYN, the minimum load managed by the minimum load device management unit is checked. A transfer unit that generates a distribution rule in which the NEXT device ID of the service processing device is set to the destination device ID and sets the distribution rule in the management table;
When a distribution rule is set in the management table, an idle timer is started. After that, when a packet identified by the identifier of the distribution rule passes, the idle timer management unit starts again after resetting the idle timer. And having
The transfer unit deletes the corresponding distribution rule from the management table when the idle timer expires.

The load balancing method of the present invention
A load distribution method by a distribution device that distributes packets to be distributed to any of a plurality of service processing devices,
Holding a distribution rule in the management table including an identifier composed of a source address and a prefix length of a packet to be distributed, and a destination device ID of a destination service processing device that is a destination of the packet identified by the identifier; ,
A setting step for managing a device ID of a service processing device having the lowest load among the plurality of service processing devices as a NEXT device ID;
When the distribution target packet is received, the management table is searched with the source address and prefix length of the packet, and if there is a corresponding distribution rule, to the destination service processing device indicated by the destination device ID of the distribution rule When the packet is transferred and there is no corresponding distribution rule, it is confirmed whether or not the TCP flag of the packet is SYN. If it is SYN, the NEXT device ID of the lowest load service processing device is set as the destination. A transfer step of generating a distribution rule set in the device ID and setting it in the management table;
When a distribution rule is set in the management table, an idle timer is started, and after the packet identified by the identifier of the distribution rule passes, the idle timer is reset and then restarted.
And deleting a corresponding distribution rule from the management table when the idle timer expires.

(1) According to the present invention, the identifier of the distribution rule is a packet source address and a prefix length.

Therefore, the TCP flag only needs to be checked for the first packet (first packet) at the source address and the prefix length, so the number of TCP flag checks is reduced. Further, since the number of rules / timers in the distribution rule need only be the number corresponding to the originating address and prefix length, the number of rules / timers in the distribution rule is reduced.
(2) According to the present invention, when a distribution rule is set, an idle timer is started. When a packet identified by the distribution rule identifier passes thereafter, the idle timer is reset and then restarted. When the timer expires, the corresponding distribution rule is deleted.

Accordingly, since the distribution rule is not deleted while the communication packet is flowing, the rule setting log list required in the existing technique 2 becomes unnecessary. Also, it is not necessary to check the TCP flag of the intermediate ACK packet.
(3) According to the present invention, the device ID of the service processing device with the lowest load is set to the NEXT device ID, and the NEXT device ID of the service processing device with the lowest load is set as the destination device in the newly generated distribution rule. ID is set.

  Therefore, since the packet can be distributed to the service processing apparatus having the lowest load, the variation in the level of uniformity is reduced.

It is a figure which shows the outline | summary of the distribution apparatus of one Embodiment of this invention. It is a functional block diagram of the distribution apparatus of one Embodiment of this invention. It is a figure explaining the reason which TCP session maintenance is required. It is a figure which shows the example of the network structure of a load distribution system. It is a functional block diagram of a sorting device of existing technology 1. It is a figure which shows the completion | finish sequence of the TCP session in the case of uplink active-FIN. It is a functional block diagram of the distribution apparatus of the existing technology 2.

  EMBODIMENT OF THE INVENTION Below, the form for implementing this invention is demonstrated with reference to drawings.

  First, the outline | summary of the distribution apparatus of this embodiment is demonstrated.

  In FIG. 1, the outline | summary of the distribution apparatus of this embodiment is shown. In FIG. 1, the distribution device of this embodiment is incorporated as the distribution device 10-1 in the load distribution system of FIG. 4.

  As shown in FIG. 1, the distribution device of this embodiment has a management table 104.

  In the distribution device of the existing technology 2, the rule identifier of the distribution rule is a session (4-tuple (SA, DA, SP, DP)).

  On the other hand, in the distribution device according to the present embodiment, the rule identifier of the distribution rule is a prefix (SA / prefix length) (a bundle of flows) (for example, the prefix length is fixed). 28).

  Then, only when the first upstream packet (first packet) for which no distribution rule exists is received, it is confirmed whether or not the TCP flag of the upstream packet is SYN. If it is SYN, the destination of the upstream packet is the lowest. A distribution rule for the load service processing apparatus 20 is generated and set in the management table 104.

  In addition, in the distribution device of the existing technique 2, a timer that is fixedly started when the distribution rule is set is provided, and the distribution rule is deleted when the timer expires.

  On the other hand, in the distribution device according to the present embodiment, an idle timer is provided that starts at the time when the latest upstream packet identified by the rule identifier passes. That is, when a distribution rule is set, an idle timer is started. Thereafter, when an upstream packet identified by the rule identifier of the distribution rule passes, the idle timer is reset, and then the idle timer is restarted and the idle timer is restarted. When is expired, the distribution rule is deleted.

  Here, the service processing apparatus 20 that performs TCP statefull processing does not include a communication packet belonging to the session for a certain period of time for the purpose of security or a countermeasure against a problem that an unused TCP state (state) remains. In this case, a TCP timeout value is generally provided as a Config for forcibly disconnecting the session.

  By using this, as the timeout value of the idle timer described above, the TCP timeout value set in the configuration of the service processing apparatus 20 may be used as it is, or an appropriate value may be set based on this value.

  In the distribution device of the existing technology 2, the Next device ID managed by the round robin method is set as the destination device ID set in the distribution rule.

  On the other hand, in the distribution device according to the present embodiment, the traffic of each service processing device 20 is periodically obtained, and the device ID of the service processing device 20 with the lowest load at which the traffic becomes the lowest value is set as the Next device ID. The Next device ID is set as the destination device ID of the distribution rule.

  When a downlink packet is received, the management table 104 is not searched and the downlink packet is passed through as it is.

  Next, details of the sorting apparatus according to the present embodiment will be described.

  FIG. 2 shows a functional block diagram of the sorting apparatus of this embodiment. FIG. 2 assumes that the distribution device of this embodiment is incorporated into the load distribution system of FIG. 4 as the distribution device 10-1.

  As illustrated in FIG. 2, the distribution device according to the present exemplary embodiment includes a transfer unit 101, an idle timer management unit 102, and a minimum load device management unit 103.

  The transfer unit 101 includes a management table 104.

  The management table 104 includes a rule identifier composed of SA and prefix length, a destination device ID of the destination service processing device 20 that is a destination of the upstream packet identified by the rule identifier, and an actual bandwidth ( PPS) and a distribution rule including a distribution rule.

  As described above, the distribution rule is generated by passing an upstream SYN packet and set in the management table 104. At this time, the Next device ID that is the device ID of the service processing device 20 with the lowest load managed by the lowest load device management unit 103 is set as the destination device ID.

  The idle timer management unit 102 manages an idle timer that starts at the time when the latest upstream packet identified by the rule identifier passes.

  Specifically, the idle timer management unit 102 starts an idle timer when a transfer rule is set by the transfer unit 101 by passing an upstream packet, and thereafter, the upstream packet identified by the rule identifier of the distribution rule. Is passed, the idle timer is reset, and then the idle timer is started again. When the idle timer expires, the transfer unit 101 deletes the distribution rule from the management table 104.

  The lowest load device management unit 103 manages the Next device ID which is the device ID of the lowest load service processing device 20 at which the traffic becomes the lowest value.

  For example, the lowest load device management unit 103 periodically extracts the actual bandwidth of each distribution rule from the management table 104, obtains the sum of the actual bandwidth for each destination device ID, and sets the destination device ID having the lowest real bandwidth as next. Set to device ID.

  When receiving the upstream packet, the transfer unit 101 searches the management table 104 with the SA and prefix length of the received upstream packet, and determines whether there is a corresponding distribution rule.

  When the distribution rule corresponding to the management table 104 exists, the transfer unit 101 transfers the uplink packet to the destination service processing device 20 indicated by the destination device ID of the corresponding distribution rule.

  On the other hand, when there is no distribution rule corresponding to the management table 104, the transfer unit 101 checks whether the TCP flag of the upstream packet is SYN, and when it is SYN, generates a new distribution rule and manages it. Set in table 104. At this time, the Next device ID that is the device ID of the service processing device 20 with the lowest load managed by the lowest load device management unit 103 is set as the destination device ID.

  Here, in the above processing, when the transfer unit 101 receives the first uplink packet for which no distribution rule exists, it confirms whether the TCP flag of the uplink packet is SYN.

  However, when the idle timer is used as in the present embodiment, the first uplink packet cannot be a packet other than the SYN packet if it is a normal sequence.

  Therefore, in this embodiment, when the transfer unit 101 receives the first upstream packet for which no distribution rule exists, the transfer unit 101 omits the process of checking the TCP flag, and immediately generates the distribution rule and sets it in the management table 104. You may perform the process to do.

  In addition, when the idle timer managed by the idle timer management unit 102 expires, the transfer unit 101 deletes the corresponding distribution rule from the management table 104.

  When receiving the downlink packet, the transfer unit 101 does not search the management table 104 and passes the downlink packet as it is.

Finally, the effect of the sorting device of this embodiment will be described.
(1) First Effect In the sorting device of the existing technology 2, the rule identifier of the sorting rule is a session (4-tuple (SA, DA, SP, DP)).

  On the other hand, in the distribution device of this embodiment, the rule identifier of the distribution rule is SA and the prefix length.

  Therefore, in the sorting device of the existing technique 2, it is necessary to check the TCP flag of the first packet for each TCP session, whereas in the sorting device of this embodiment, the SA / prefix length is used. Since it is only necessary to check the TCP flag only for the first packet of the first packet, the number of checks of the TCP flag is reduced.

In the distribution device of the existing technology 2, the number of rules and timers of the distribution rule are required for the total number of TCP sessions, whereas in the distribution device of this embodiment, the number of rules and timers of the distribution rule Since the number only needs to be equal to the SA / prefix length, the number of distribution rules and the number of timers are reduced. Specifically, in the case of the distribution device according to the present embodiment, even if the number of users is 100,000 and all users use a plurality of sessions, the number of rules reaches about 100,000 / 16 = 6,000.
(2) Second Effect In the sorting device of the existing technique 2, a timer that starts fixedly when the sorting rule is set is provided, and when the timer expires, the sorting rule is deleted.

  On the other hand, in the distribution device according to the present embodiment, an idle timer is provided that starts at the time when the latest upstream packet identified by the rule identifier passes.

Therefore, in the distribution device of the existing technology 2, it is necessary to hold a rule setting log list having a timer with a long time different from the distribution rule in preparation for the case where the timer expires. In the distribution apparatus, since the distribution rule is not deleted while the communication packet is flowing by using the idle timer, the rule setting log list becomes unnecessary. Also, it is not necessary to check the TCP flag of the intermediate ACK packet.
(3) Third Effect In the distribution device of the existing technology 2, the service processing device 20 is set in the distribution rule by the round robin method.

  On the other hand, in the distribution device of the present embodiment, the traffic of each service processing device 20 is periodically obtained, and the service processing device 20 with the lowest load at which the traffic becomes the minimum value is set as the distribution rule.

  For this reason, in the sorting device of the existing technology 2, there is a possibility that the level of uniformity may vary because packets are not sorted to the service processing device 20 with the lowest load due to the length of the session time and the difference in traffic volume. On the other hand, in the distribution device according to the present embodiment, since the packet is distributed to the service processing device 20 having the lowest load, the variation in the level of uniformity is reduced.

  The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention without departing from the gist of the present invention.

  For example, in the above-described embodiment, an example has been described in which the distribution target packet is an upstream packet and is incorporated in the load distribution system of FIG. 4 as the distribution device 10-1. However, the distribution target packet is a downstream packet and the distribution device is distributed. Of course, it is possible to incorporate it as 10-2. In this case, contrary to the above embodiment, the management table 104 may be applied to the downstream packet, and the upstream packet may be passed through as it is.

10-1, 10-2 Distribution device 101 Transfer unit 102 Idle timer management unit 103 Minimum load device management unit 104 Management table 20-1 to 20-3 Service processing device

Claims (6)

A load distribution system comprising a plurality of service processing devices and a distribution device that distributes packets to be distributed to any of the plurality of service processing devices,
The sorting device is
A management table that holds a distribution rule including an identifier composed of a source address of a packet to be distributed and a prefix length, and a destination device ID of a destination service processing device that is a destination of the packet identified by the identifier;
A minimum load device management unit that manages, as a NEXT device ID, a device ID of a service processing device having the lowest load among the plurality of service processing devices;
When the distribution target packet is received, the management table is searched with the source address and prefix length of the packet, and if there is a corresponding distribution rule, to the destination service processing device indicated by the destination device ID of the distribution rule When the packet is transferred and there is no corresponding distribution rule, it is confirmed whether or not the TCP flag of the packet is SYN. If it is SYN, the minimum load managed by the minimum load device management unit is checked. A transfer unit that generates a distribution rule in which the NEXT device ID of the service processing device is set to the destination device ID and sets the distribution rule in the management table;
When a distribution rule is set in the management table, an idle timer is started. After that, when a packet identified by the identifier of the distribution rule passes, the idle timer management unit starts again after resetting the idle timer. And having
The transfer unit is configured to delete a corresponding distribution rule from the management table when the idle timer expires. The transfer unit
If a distribution rule corresponding to the management table does not exist when receiving a distribution target packet, the process of checking the TCP flag of the packet is omitted, and the process of generating the distribution rule and setting it in the management table is performed. The load distribution system according to claim 1, which is performed. The minimum load device management unit
The load distribution according to claim 1 or 2, wherein the traffic of each of the plurality of service processing devices is periodically obtained, and the device ID of the lowest load service processing device having the lowest traffic is set in the NEXT device ID. system. A load distribution method by a distribution device that distributes packets to be distributed to any of a plurality of service processing devices,
Holding a distribution rule in the management table including an identifier composed of a source address and a prefix length of a packet to be distributed, and a destination device ID of a destination service processing device that is a destination of the packet identified by the identifier; ,
A setting step for managing a device ID of a service processing device having the lowest load among the plurality of service processing devices as a NEXT device ID;
When the distribution target packet is received, the management table is searched with the source address and prefix length of the packet, and if there is a corresponding distribution rule, to the destination service processing device indicated by the destination device ID of the distribution rule When the packet is transferred and there is no corresponding distribution rule, it is confirmed whether or not the TCP flag of the packet is SYN. If it is SYN, the NEXT device ID of the lowest load service processing device is set as the destination. A transfer step of generating a distribution rule set in the device ID and setting it in the management table;
When a distribution rule is set in the management table, an idle timer is started.After that, when a packet identified by the identifier of the distribution rule passes, the idle timer is reset and restarted.
And a step of deleting a corresponding distribution rule from the management table when the idle timer expires. In the transfer step,
If a distribution rule corresponding to the management table does not exist when receiving a distribution target packet, the process of checking the TCP flag of the packet is omitted, and the process of generating the distribution rule and setting it in the management table is performed. The load distribution method according to claim 4, wherein the load distribution method is performed. In the management step,
6. The load distribution according to claim 4, wherein the traffic of each of the plurality of service processing devices is periodically obtained, and the device ID of the lowest load service processing device having the lowest traffic is set in the NEXT device ID. Method.

Images