JP6247239B2 - Network verification system, network verification method, flow inspection apparatus, and program - Google Patents

Description

  The present invention relates to a network that checks the operation of a transfer device and the transfer rule set in the transfer device in a flow-based network in which a transfer rule is determined by a combination of packet header information, input port, output port, and output header information. The present invention relates to a verification system, a network verification method, a flow inspection apparatus, and a program.

  One typical protocol for realizing SDN (Software-Defined Networking) is OpenFlow. OpenFlow separates the data transfer control function unit from the data transfer function unit, and defines a unified and open interface between them, thereby realizing flexible control of the data transfer function. OpenFlow regards communication as an end-to-end “flow” and performs path control in units of flows.

  OpenFlow does not perform packet forwarding according to the destination address of each layer specified in the OSI reference model, but for packets having header information that matches the matching conditions configured by a combination of information across multiple layers. Execute the specified action and transfer. This combination of match condition and action is called a “flow entry”. In addition to the match field and action field, statistical information for each flow called a counter is added to the flow entry.

  In order to check the normality of the network configured by the SDN node that performs flow-based packet processing represented by the above OpenFlow, a test packet having header information that matches the flow entry to be checked is transmitted, and the other party It is necessary to confirm arrival at the SDN node, acquire SDN node information that has passed through, and acquire flow entry information that matches within each SDN node. In the following description, “SDN node” may be referred to as “transfer device”.

  Conventionally, ping or traceroute using Ethernet (registered trademark) OAM, ICMP protocol, or the like has been used to check the operation of a network device and reachability between devices and to check the normality of the network. However, even if Ethernet (registered trademark) OAM, ping, traceroute, etc. are used in a virtual network formed by SDN nodes, only a specific flow entry having the same match condition as each tool can be inspected. The normality of a flow entry that includes different conditions (such as different IP protocol numbers) cannot be checked.

  Conventional research has proposed a method for dealing with the above problem by utilizing a test packet that simulates a user packet flowing on a virtual network and an inquiry process (Packet-In) to a control device such as an OpenFlow controller. (For example, see Non-Patent Documents 1 and 2.)

  Non-Patent Document 1 proposes a technique that enables communication confirmation between specified SDN nodes and acquisition of route information by utilizing TTL subtraction processing of a test packet and Packet-In by TTL Invalid.

  In Non-Patent Document 1, first, a UDP packet (if another L4 protocol is used in the OpenFlow switch flow table is used) is generated as a test packet, and header information that matches the inspection target flow entry is generated. Set. At this time, a value for identifying the test packet is stored in a header field that is not used in the match condition. In the TTL area, 2 (the number of hops to the destination in the case of route confirmation) is stored, and in the payload portion, path information (information that can identify the source SDN node and the destination SDN node) is stored, and Packet-Out To do. Thereby, reachability and route information of an arbitrary packet can be acquired.

  In Non-Patent Document 2, it is possible to distinguish between test packets and user packets by tagging each SDN node, thereby realizing communication confirmation between specified SDN nodes and acquisition of route information. For tagging SDN nodes, a graph coloring algorithm is utilized so that adjacent SDN nodes do not have the same tag. When a test packet is transmitted from the control device to the SDN node to be inspected, a tag indicating the packet-out destination SDN node is inserted into the header field of the test packet. At this time, the tag indicating the SDN node is stored in a header field (such as a VLAN priority bit) that is not used as a match condition for each flow entry. The SDN node that has received the test packet by Packet-Out processes the test packet according to the flow entry that matches the packet. Next, in the adjacent SDN node that has received the test packet, the packet is based on a flow entry (this is set in advance) for a packet storing a tag different from its own tag. Perform In. With such a series of operations, arrival information and route information of an arbitrary packet can be acquired via the control device.

Junichi Otsuka, Takaharu Omi, Seiji Oyama, Yasumi Hasegawa, Yoichi Yamada, “Examination of communication / path confirmation method for each virtual network in the OpenFlow environment”, IEICE Technical Report ICM2013-64, pp. 75-80, 2014.

K. Agarwal, E .; Rozner, C.I. Dixon, and J.M. Carter, "SDN traceout: Trading SDN Forwarding without Changing Network Behavior," ACM International Workshop on Hottop in Nep. 145-150, 2014.

  In Non-Patent Document 1 and Non-Patent Document 2, transmission confirmation between SDN nodes of a packet having arbitrary header information and acquisition of route information are realized by transmitting a test packet to a real network. However, in order to manage the virtual network, as described above, in addition to these pieces of information, it is necessary to acquire flow entry information in which packets match in each SDN node. This is mainly used for setting creation, setting verification, and identification of a failure location when a failure occurs.

  Therefore, an object of the present invention is to provide a network verification system, a network verification method, a flow inspection apparatus, and a program that can collect flow entry information set in a transfer apparatus in order to solve the above-described problems.

  In order to achieve the above object, the network verification system according to the present invention transmits a test packet having header information that matches a desired transfer rule to the transfer device, and processes the test packet with respect to the transfer device. It was decided to collect information on flow entries that matched the transfer rules, and collect and analyze the processed test packets.

Specifically, the network verification system according to the present invention is a network verification system comprising at least one transfer device configuring a virtual network, and a flow inspection device for verifying the normality of the virtual network,
The transfer device is
A packet matching condition, a forwarding rule that describes an action to be performed when the matching condition is met, and a flow table in which a forwarding rule ID that is information of the forwarding rule is set,
The flow inspection apparatus includes:
A flow information management unit for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device;
Generating a test packet having header information that matches the desired match condition, and transmitting the test packet to the transfer device; and
A test result receiving unit for receiving a test result from the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the match condition of the test packet to metadata, and the transfer that is written to the metadata when the received packet is the test packet The rule ID is transmitted to the test result receiving unit as the test result together with the test packet, and if the transfer rule is set to transfer or discard to another transfer device, the test packet is transferred or discarded. Transfer destination judgment function,
A flow table conversion unit for converting to a rule having
Based on the identification information of the test packet of the test result received by the test result receiving unit, the transfer rule for the desired match condition is detected from the flow information management unit, and the transfer rule and the test result receiving unit are A test result determination unit that verifies the normality of the virtual network by comparing the transfer rule of the received test result;
It is characterized by having.

The network verification method according to the present invention is a network verification method for verifying the normality of a virtual network composed of at least one transfer device,
A flow table setting procedure for setting a packet match condition, a transfer rule that describes an action to be performed when the match condition is met, and a transfer rule ID that is information of the transfer rule in the flow table of the transfer device;
A flow information management procedure for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device in a flow information management unit;
A test packet generating procedure for generating a test packet having header information matching the desired match condition and transmitting the test packet to the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the match condition of the test packet to metadata, and the transfer that is written to the metadata when the received packet is the test packet A transfer destination determination function that transmits a rule ID together with the test packet as a test result, and further transfers or discards the test packet when the transfer rule is set to transfer or discard to another transfer device;
A flow table conversion procedure for converting to a rule having
Receiving the test result from the transfer device, detecting the transfer rule for the desired match condition from the flow information management unit based on the identification information of the test packet of the test result, and receiving the transfer rule A test result determination procedure for verifying the normality of the virtual network by comparing the transfer rule of the test result;
It is characterized by performing.

The flow inspection apparatus according to the present invention includes a flow table in which a packet match condition, a transfer rule that describes an action to be performed when the match condition is met, and a transfer rule ID that is information on the transfer rule are set. A flow inspection device for verifying the normality of a virtual network composed of at least one transfer device,
A flow information management unit for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device;
Generating a test packet having header information that matches the desired match condition, and transmitting the test packet to the transfer device; and
A test result receiving unit for receiving a test result from the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the match condition of the test packet to metadata, and the transfer that is written to the metadata when the received packet is the test packet The rule ID is transmitted to the test result receiving unit as the test result together with the test packet, and if the transfer rule is set to transfer or discard to another transfer device, the test packet is transferred or discarded. Transfer destination judgment function,
A flow table conversion unit for converting to a rule having
Based on the identification information of the test packet of the test result received by the test result receiving unit, the transfer rule for the desired match condition is detected from the flow information management unit, and the transfer rule and the test result receiving unit are A test result determination unit that verifies the normality of the virtual network by comparing the transfer rule of the received test result;
It is characterized by having.

  In the current OpenFlow framework, there is no function for assigning each transfer rule an ID or the like for identifying the transfer rule. For this reason, the present invention uses the action part of all the transfer rules and sets the transfer rule ID for each transfer rule.

  Before transmitting the test packet, the ID is written in the metadata as the flow entry information set in the flow table in the transfer apparatus. Then, by causing the transfer device to process the test packet, it is possible to collect the flow entry information set in the flow table in the transfer device. By comparing the collected flow entry information with the flow entry information stored in the flow inspection device, it is possible to create settings, verify settings, specify a fault location when a fault occurs, and the like.

  The program according to the present invention causes a computer to function as the flow inspection apparatus. The flow inspection apparatus according to the present invention can be realized by a computer and a program, and can be recorded on a recording medium or provided through a network.

  Therefore, the present invention can provide a network verification system, a network verification method, a flow inspection apparatus, and a program that can collect flow entry information set in a transfer apparatus.

  Furthermore, in order to apply the SDN node to the network service, it is necessary to be able to acquire the information by tracking the flow of a specific test packet in a situation where various user traffic flows in the network.

  Therefore, the test packet generation unit of the flow inspection apparatus provided in the network verification system according to the present invention encapsulates the test packet with a protocol different from the match condition of the transfer rule used for the user packet. The transfer apparatus can determine whether the header information of the packet matches the match condition to determine whether the packet is a user packet or a test packet.

  Further, the test packet determination function of the flow inspection apparatus provided in the network verification system according to the present invention records a specific packet in the metadata as a test packet determination flag when the received packet is the test packet. The transfer destination determination function recognizes that a packet to be processed by the test packet determination flag of the metadata is a test packet.

  In some cases, the flow table of the transfer apparatus is a multi-table having a plurality of tables in which work contents are described. In this case, the flow information storage processing function of the flow inspection apparatus provided in the network verification system according to the present invention divides the metadata into sections for each table, and assigns the transfer rule ID in each table to each section. It is described.

  The present invention can provide a network verification system, a network verification method, a flow inspection apparatus, and a program that can collect flow entry information set in a transfer apparatus.

It is a figure explaining the structure of the network verification system which concerns on this invention. It is a figure explaining the structure of the network verification system which concerns on this invention. It is a figure explaining the structure of the network verification system which concerns on this invention. It is a figure explaining the structure of the network verification system which concerns on this invention. It is a figure explaining the structure of the network verification system which concerns on this invention. It is a flowchart explaining the network verification method which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining operation | movement of the network verification system which concerns on this invention. It is a figure explaining the metadata used with the network verification system which concerns on this invention. It is a figure explaining the metadata used with the network verification system which concerns on this invention. It is a figure explaining the method in which the flow inspection apparatus which concerns on this invention converts the flow table of a transfer apparatus.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are embodiments of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

The present invention is a network verification system that acquires information on a flow entry (hereinafter referred to as a transfer rule) in which a test packet matches in each SDN node. This network verification system is a network verification system comprising at least one transfer device that constitutes a virtual network, and a flow inspection device that verifies the normality of the virtual network,
The transfer device is
A packet matching condition, a forwarding rule that describes an action to be performed when the matching condition is met, and a flow table in which a forwarding rule ID that is information of the forwarding rule is set,
The flow inspection apparatus includes:
A flow information management unit for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device;
Generating a test packet having header information that matches the desired match condition, and transmitting the test packet to the transfer device; and
A test result receiving unit for receiving a test result from the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the test packet match condition to metadata, and the transfer that is written to the metadata when the received packet is the test packet The rule ID is transmitted to the test result receiving unit as the test result together with the test packet, and if the transfer rule is set to transfer or discard to another transfer device, the test packet is transferred or discarded. Transfer destination judgment function,
A flow table conversion unit for converting to a rule having
Based on the identification information of the test packet of the test result received by the test result receiving unit, the transfer rule for the desired match condition is detected from the flow information management unit, and the transfer rule and the test result receiving unit are A test result determination unit that verifies the normality of the virtual network by comparing the transfer rule of the received test result;
It is characterized by having.

  The flow inspection device is a functional unit that mainly manages the flow table in the transfer device, generates and transmits a test packet that simulates a user packet, and receives and determines a test result. The flow table conversion unit is a functional unit that changes the transfer rule in the flow table in order to embed a test packet discrimination function and a transfer rule information acquisition function that matches the test packet in the flow table in the transfer device. . Test packet discrimination is realized by preparing one test packet identification flow table before and after the transfer rule group. Acquisition of transfer rule information that matches the test packet is realized by changing the action field of each transfer rule and using metadata that can store processing information of each packet in the SDN node.

  1 to 5 are diagrams for explaining a configuration for realizing such a network verification system.

  In the functional connection configuration 301 shown in FIG. 1, the control device 1 is provided inside the flow inspection device 100, and the control device 1 is used for transmitting test packets and receiving test results. This can be realized by using the OpenFlow Packet-In and Packet-Out functions.

  In the functional connection configuration 302 shown in FIG. 2, the control device 1 and the flow table conversion unit 2 are separated from the flow inspection device 100, and the test packet transmission unit 105 and the test result reception unit 104 are provided, so that the flow inspection device 100 performs the test. Responsible for sending packets and receiving test results. In addition, the flow table conversion unit 2 is installed in the upper stage of the control device 1, and changes are made in advance to the transfer rule (flow table) input from the control device to the transfer device. Therefore, the flow table 202 in a state where the test function of the present invention is introduced is set in the transfer device 200 by the control device 1.

  In the functional connection configuration 303 shown in FIG. 3, the flow table conversion unit 2 is installed in the lower stage of the control device 1, and the flow table conversion unit 2 receives the setting contents to the flow table transmitted from the control device 1. After performing the conversion to which the invention is applied, the transfer device 200 is set. When the flow table conversion unit 2 enters between the control device 1 and the transfer device 200, the transfer device 200 needs a mechanism that regards the flow table conversion unit as a control device. Further, the control device 1 also includes the flow table conversion unit. 2 is regarded as the transfer apparatus 200, and it is required to transmit setting information and the like.

  In the function connection configuration 304 illustrated in FIG. 4 and the function connection configuration 305 illustrated in FIG. 5, a test packet generation device 250 is newly provided, and the test packet generation unit 102 and the test packet transmission unit 105 are separated from the flow inspection device 100.

  Below, the network verification system of each function connection structure is demonstrated.

(Embodiment 1)
The network verification system of this embodiment is the functional connection configuration 301 of FIG.
The flow inspection apparatus 100 includes a test result determination unit 101, a test packet generation unit 102, a flow information management unit 103, a test result reception unit 104, a flow table conversion unit 2, and a control device 1.

  The test result determination unit 101 associates the test packet with the test result from the test packet identification information added to the received test result payload. The test result determination unit 101 calls a transfer rule that matches the transfer rule ID described in the test result from the transfer rule group stored in the flow information management unit 103.

  The test packet generation unit 102 generates a test packet having header information that matches a transfer rule to be tested based on the flow table information of the inspection target transfer apparatus 200 obtained from the flow information management unit 103. In order to process the test packet separately from the user packet in the SDN node, the test packet generator 102 encapsulates the test packet using a protocol that is not used in the matching condition in all the transfer apparatuses 200, and Identification information for uniquely identifying is added.

  The flow information management unit 103 stores the transfer rule set in each transfer device 200, the association of the transfer rule ID, and the test packet identifier added to the test packet.

  The flow table conversion unit 2 includes a transfer rule scheduled to be set from the control device 1 to the flow table 202 in the transfer device 200 by three elements: a test packet determination unit 203, a flow information storage processing unit 204, and a transfer destination determination unit 205. Then, the data is converted and transmitted to the control device 1.

  The control device 1 sets transfer rules in the flow table 202 of the transfer device 200, transmits test packets and receives test results, and exchanges control information with the transfer device 200.

  The test result receiving unit 104 receives the test result (the ID of the transfer rule matched in the transfer device 200) from the test target transfer device 200 via the control device 1.

  The transfer apparatus 200 (SDN node) includes a reception unit 201, a flow table 202, and a transmission unit 206.

  The receiving unit 201 receives a packet from another transfer apparatus, a test packet from the flow inspection apparatus 100, and control information.

  The transmission unit 206 transmits a packet to another transfer apparatus, a test packet to the flow inspection apparatus 100, and metadata information.

  The flow table 202 includes a table having an action field in which processing according to a packet matching condition is described. A transfer rule is configured by the match condition and its processing, and an ID is assigned to each transfer rule. Further, there may be one table or a multi-table having a plurality of tables. The flow table 202 converts the transfer rule into a test packet determination unit 203, a flow information storage processing unit 204, and a transfer destination determination unit 205 based on a control signal from the flow inspection apparatus 100. FIG. 16 is an example in which the transfer rule is changed based on the control signal from the flow inspection apparatus 100. FIG. 16A shows a state before the transfer rule is changed. There is only one table in the flow table, and the processing content “src_mac = 0: 23: 45: 67: 89: AB, actions = output: 2” is described. FIG. 16B shows a state after changing the transfer rule. Three tables (table_id = 0, table_id = 1, and table_id = 2) are formed in the flow table.

The table of table_id = 0 corresponds to the test packet determination unit 203. In the table of table_id = 0, if the received packet is a test packet (mpls_label = 100), metadata of written data “0x800000” is created, a flag for identifying the test packet is written in a specific bit of the metadata, and encapsulation is performed. There is an instruction to release (pop_mpls). The test packet is in the same state as other user packets when it moves to the next table through this processing, and is processed according to the same transfer rule.
A table of table_id = 1 corresponds to the flow information storage processing unit 204. In the table of table_id = 1, there is an instruction that describes the transfer rule ID “0x000001” in the metadata regardless of the packet type, and stores the processing content (output: 2) in the stack (write_actios output: 2).
A table of table_id = 2 corresponds to the transfer destination determination unit 205. In the table of table_id = 2, the content of the metadata is confirmed (confirmation of the flag) to determine whether the packet is a test packet. If it is a test packet, the content of the metadata is included in the test packet. Are encapsulated (“push_mpls”), transferred to the flow inspection apparatus (“output: 3”), and stacked (normally processed (output: 2)) (apply-actions). There is also an instruction (apply_actions) that executes a specified transfer rule if the packet is a user packet.

  The test packet determination unit 203 determines whether or not the packet received by the transfer apparatus 200 is a test packet. Since it is encapsulated if it is a test packet, the encapsulation is released and the state is the same as the user packet. Furthermore, the test packet determination unit 203 uses the 1 bit in the metadata that can store the processing information of each packet in the transfer apparatus 200 as a test packet determination flag, and records that the test packet is being processed (value). Is set to 1). FIG. 14 is a diagram illustrating an example in which one bit in the metadata is used as a test packet determination flag.

  The flow information storage processing unit 204 changes the action field of the transfer rule in advance according to the setting from the control device 1, and stores the ID of the transfer rule matched with the test packet in the metadata.

  The transfer destination determination unit 205 always passes through the transfer destination determination unit before all packets are transferred (or discarded). The transfer destination determination unit 205 refers to the test packet determination flag in the metadata and determines whether the currently processed packet is a test packet. In the case of a test packet, the transfer destination determination unit 205 encapsulates the packet again and transmits it to the flow inspection apparatus 100 together with metadata information in which the ID of the matched transfer rule is stored. Furthermore, the transfer destination determination unit 205 transmits the same test packet to the next transfer device 200. On the other hand, in the case of a user packet, the transfer destination determination unit 205 performs a transfer (or discard) process as described in the action field.

  Next, the operation of the network verification system in FIG. 1 will be described. FIG. 6 is a flowchart for explaining the packet processing after the flow table 202 of the transfer apparatus is set. 7 to 13 are diagrams for explaining the flow of test packets. 7 to 13 are diagrams illustrating a case where a test packet is transmitted from the transfer device 200-1 to the transfer device 200-3 that is a monitoring section in the function connection configuration 301. FIG.

  First, before setting a transfer rule in the transfer apparatus 200, the flow table conversion unit 2 of the flow inspection apparatus 100 sets a transfer rule to be set in the flow table 202 of the transfer apparatus 200, the test packet determination unit 203, and the flow information. The data is converted into a form configured by the storage processing unit 204 and the transfer destination determination unit 205, and set in each transfer device via the control device 1.

  Next, in response to a request from the network administrator, a test packet is generated by the test packet generation unit 102 based on the management information of the flow information management unit 103, and is transferred from the control device 1 to the transfer device 200 that is the first destination. Is transmitted (FIG. 7). At this time, header information matching the transfer rule group to be tested is stored in the header portion of the test packet. Further, the test packet is encapsulated using a protocol that is not used as a match condition in the flow table 202 of all SDN nodes. This is for matching the same transfer rule while distinguishing and recognizing the test packet and the user packet.

  The test packet received by the transfer apparatus 200 is first processed by the test packet determination unit 203 (FIG. 8). The test packet determination unit 203 determines whether or not the received packet is encapsulated with a specified protocol, and if it is encapsulated, it is regarded as a test packet. In the case of a test packet, the encapsulation is released and the test packet determination flag provided in the metadata that can store the processing information of each packet in the transfer apparatus 200 is set to 1. Here, the metadata can be used only within the transfer apparatus 200, and the value cannot be stored directly in the packet.

  Next, the test packet is processed by the flow information storage processing unit 204. The transfer rule is stored in the flow information storage processing unit 204, and the test packet is processed according to the transfer rule in the same manner as the user packet. In the flow information storage processing unit 204, in order to acquire the ID of the transfer rule that matched the test packet, the action field of each transfer rule is changed in advance and an action for writing the transfer rule ID in the metadata is added. . This action is added by an instruction from the flow table conversion unit 2. When the transfer rule covers a plurality of tables, the metadata is divided and masked to store information on transfer rules matched in all tables. FIG. 15 is a diagram illustrating an example in which the transfer rule is a multi-table, metadata is divided into the total number of tables, and each partition is assigned to each table.

  Finally, the test packet is processed by the transfer destination determination unit 205. The transfer destination determination unit 205 refers to the test packet determination flag in the metadata and confirms whether the value is 1. When the test packet determination flag is 1, it is determined that the packet is a test packet, and the transfer destination determination unit 205 transmits metadata storing the ID of the matched transfer rule and the processed test packet to the flow inspection apparatus 100. Further, the transfer destination determination unit 205 encapsulates the test packet again and executes an action (transfer or discard). When the test packet determination flag is 0, it is assumed that the packet is a user packet, and the transfer destination determination unit 205 executes an action (transfer or discard) without processing anything.

  The control device 1 that has acquired the test packet and the metadata transmits these to the test result receiving unit 104. The test result receiving unit 104 further transmits the received test result to the test result determining unit 101, associates the test packet with the test result from the test packet identification information added to the payload of the received test result, and generates metadata. The transfer rule is derived from the transfer rule ID inside. Then, after receiving the test result by the test result receiving unit 104, the test result judging unit 101 judges the normality of the monitoring section. For example, the test result determination unit 101 detects the transfer rule ID for the match condition of the test packet from the flow information management unit 103 based on the identification information of the test packet, and the transfer rule and the transfer rule received together with the test packet. Compare the ID. If the IDs are the same, the monitoring section is determined to be normal, and if the IDs are different from each other, it is determined that the monitoring section is abnormal (setting abnormality, failure, etc.).

The operation of the network verification system will be specifically described based on the transfer rule described in FIG.
(1) A test packet “mpls label is 100 and mac address 01: 23: 45: 67: 89: AB” is transmitted from the flow inspection apparatus 100.
(2) As described above, the transfer device 200 includes the test packet determination unit 203, the flow information storage processing unit 204, and the transfer destination determination unit 205 as “from mac address 01: 23: 45: 67: 89: AB”. The packet records the transfer rule ID (0x000001) in the metadata, the action to be output to “2” is saved in the stack (write_actions output: 2), and the transfer rule “table_id = 2” (goto_table: 2) ” Is set. For this reason, the packet determined as the test packet by the test packet determination unit 203 (table_id = 0) describes the transfer rule ID (0x000001) in the metadata with table_id = 1, and the test packet with the table_id = 2 as the flow inspection device Return to (output: 3) and execute the stacked action “transfer to“ 2 ”(output: 2)”.
(3) The flow inspection apparatus 100 detects the transfer rule stored by the flow information management unit 103 based on the transfer rule ID attached to the returned test packet, and stores it in advance in the payload portion of the input test packet. The test packet information transmitted based on the placed test packet identification information is acquired, and the transfer rule group to be matched by the test packet (held by the flow information management unit 103) and the actually matched transfer rule group are the same Compare

(Embodiment 2)
The network verification system of this embodiment is the function connection configuration 302 of FIG.
The function connection configuration 302 is different from the function connection configuration 301 of FIG. 1 in that the flow table conversion unit 2 and the control device 1 are arranged outside the flow inspection device 100.

  The control device 1 sets a transfer rule in the flow table 202 of the transfer device 200.

  The flow table conversion unit 2 converts the transfer rule scheduled to be set in the flow table 202 so as to be configured by three elements of the test packet determination unit 203, the flow information storage processing unit 204, and the transfer destination determination unit 205. Send to 1.

  The flow inspection apparatus 100 includes a test result determination unit 101, a test packet generation unit 102, a flow information management unit 103, a test result reception unit 104, and a test packet transmission unit 105.

  The test result determination unit 101 associates the test packet with the test result from the test packet identification information added to the received test result payload. The test result determination unit 101 calls a transfer rule that matches the transfer rule ID described in the test result from the transfer rule group stored in the flow information management unit 103.

  The test packet generation unit 102 generates a test packet having header information that matches a transfer rule to be tested based on the flow table 202 of the inspection target transfer device 200 obtained from the flow information management unit 103. In order for the transfer device 200 to process the test packet separately from the user packet, the test packet generator 102 encapsulates the test packet using a protocol that is not used in the matching condition in all the transfer devices 200, and the test packet. Identification information for uniquely identifying is added.

  The flow information management unit 103 stores the transfer rule set in each transfer device 200, the association of the transfer rule ID, and the test packet identifier added to the test packet.

  The test packet transmission unit 105 transmits the test packet generated by the test packet generation unit 102 to the test target transfer apparatus 200.

  The test result receiving unit 104 receives a test result (a test packet including an ID of a transfer rule matched in the transfer device 200) from the test target transfer device 200.

  The transfer device 200 (SDN node) is the same as the transfer device 200 described in the first embodiment.

  Next, the operation of the network verification system in FIG. 2 will be described. Packet processing after the flow table 202 of the transfer apparatus is set is the same as the flowchart of FIG. 6 described in the first embodiment. Also, the flow of the test packet is almost the same as the description of FIGS. 7 to 13 described in the first embodiment.

  First, before setting transfer rules in the transfer device 200, the flow table conversion unit 2 sets the transfer rules to be set in the flow table 202 of the transfer device 200 to the test packet determination unit 203, the flow information storage processing unit 204, The data is converted into a form configured by the transfer destination determination unit 205 and set in each transfer device 200 via the control device 1.

  Next, in response to a request from the network administrator, a test packet is generated by the test packet generation unit 102 based on the management information in the flow information management unit 103, and the transfer device 200 that is the first destination from the test packet transmission unit 105. (See FIG. 7). At this time, header information matching the transfer rule group to be tested is stored in the header portion of the test packet. Further, the test packet is encapsulated using a protocol that is not used as a match condition in the flow table 202 of all transfer apparatuses 200. This is for matching the same transfer rule while distinguishing and recognizing the test packet and the user packet.

  The test packet received by the transfer apparatus 200 is first processed by the test packet determination unit 203 (see FIG. 8). The test packet determination unit 203 determines whether or not the received packet is encapsulated with a specified protocol, and if it is encapsulated, it is regarded as a test packet. In the case of a test packet, the encapsulation is released and the test packet determination flag provided in the metadata that can store the processing information of each packet in the transfer apparatus 200 is set to 1.

  Next, the test packet is processed by the flow information storage processing unit 204. The transfer rule is stored in the flow information storage processing unit 204, and the test packet is processed according to the transfer rule in the same manner as the user packet. In the flow information storage processing unit 204, in order to acquire the ID of the transfer rule that matched the test packet, the action field of each transfer rule is changed in advance and an action for writing the transfer rule ID in the metadata is added. . This action is added by an instruction from the flow table conversion unit 2. If the transfer rule covers a plurality of tables, the metadata is divided and masked to store information on the transfer rule matched in all the tables.

  Finally, the test packet is processed by the transfer destination determination unit 205. The transfer destination determination unit 205 refers to the test packet determination flag in the metadata and confirms whether the value is 1. When the test packet determination flag is 1, the transfer destination determination unit 205 stores the ID of the matched transfer rule stored in the metadata in the empty header field of the test packet and directs it to the flow inspection apparatus 100. To send. Furthermore, the transfer destination determination unit 205 encapsulates the test packet again and executes an action (transfer or discard). When the test packet determination flag is 0, it is assumed that the packet is a user packet, and the transfer destination determination unit 205 executes an action (transfer or discard) without processing anything.

  The test result is acquired by the test result receiving unit 104 and transmitted to the test result determining unit 101. The test result determination unit 101 associates the test packet with the test result from the test packet identification information added to the received test result payload, and derives the transfer rule from the transfer rule ID in the metadata. Then, the test result receiving unit 104 determines the normality of the monitoring section using the method example described in the first embodiment.

(Embodiment 3)
The network verification system of this embodiment is the functional connection configuration 303 of FIG.
Unlike the function connection configuration 301 in FIG. 1, the function connection configuration 303 includes the flow table conversion unit 2 and the control device 1 arranged outside the flow inspection device 100.

  The control device 1 sets transfer rules in the flow table 202 of the transfer device 200 and exchanges control information with the transfer device 200.

  The flow table conversion unit 2 receives the transfer rule scheduled to be set in the flow table in the transfer device 200 from the control device 1, and the transfer rules are the test packet determination unit 203, the flow information storage processing unit 204, and the transfer destination determination unit 205. Conversion is performed so as to be composed of two elements, and the data is transmitted to the transfer apparatus 200.

  The configuration of the flow inspection apparatus 100 is the same as the functional connection configuration 302 described in FIG.

  The transfer device 200 (SDN node) is the same as the transfer device 200 described in the first embodiment.

  Next, the operation of the network verification system in FIG. 3 will be described. Packet processing after the flow table 202 of the transfer apparatus is set is the same as the flowchart of FIG. 6 described in the first embodiment. Also, the flow of the test packet is almost the same as the description of FIGS. 7 to 13 described in the first embodiment.

  When setting transfer rules in the transfer device 200, the flow table conversion unit 2 acquires flow table setting information transmitted from the control device 1. The flow table conversion unit 2 converts the transfer rule scheduled to be set in the flow table 202 into a form constituted by the test packet determination unit 203, the flow information storage unit 204, and the transfer destination determination unit 205, and then transmits it to each transfer device 200. To do.

  The test packet generation in the flow inspection apparatus 100, the processing in the transfer apparatus, and the determination of the test result are the same as described in the functional connection configuration 202 in FIG.

(Embodiment 4)
The network verification system of this embodiment is the function connection configuration 304 of FIG.
The function connection configuration 304 is different from the function connection configuration 302 of FIG. 2 in that the test packet generation unit 102 and the test packet transmission unit 105 are arranged outside the flow inspection apparatus 100.

  The control device 1 and the flow table conversion unit 2 are the same as those described in the functional connection configuration 302 in FIG.

  The flow inspection apparatus 100 includes a test result determination unit 101, a flow information management unit 103, and a test result reception unit 104.

  The test result determination unit 101 associates the test packet with the test result from the test packet identification information added to the received test result payload. The test result determination unit 101 calls a transfer rule that matches the transfer rule ID described in the test result from the transfer rule group stored in the flow information management unit 103.

  The flow information management unit 103 stores the transfer rule set in each transfer device 200, the association of the transfer rule ID, and the test packet identifier added to the test packet.

  The test result receiving unit 104 receives the test result (the ID of the transfer rule matched in the transfer device 200) from the test target transfer device 200.

  The test packet generation apparatus 250 includes a test packet generation unit 102 and a test packet transmission unit 105.

  The test packet generation unit 102 generates a test packet having header information that matches a transfer rule to be tested based on the flow table 202 of the inspection target transfer device 200 obtained from the flow information management unit 103. In order for the transfer device 200 to process the test packet separately from the user packet, the test packet generator 102 encapsulates the test packet using a protocol that is not used in the matching condition in all the transfer devices 200, and Identification information for uniquely identifying is added.

  The test packet transmission unit 105 transmits the test packet generated by the test packet generation unit 102 to the test target transfer apparatus 200.

  The transfer device 200 (SDN node) is the same as the transfer device 200 described in the first embodiment.

  Next, the operation of the network verification system in FIG. 4 will be described. The packet processing after the flow table 202 of the transfer apparatus 200 is set is the same as the flowchart of FIG. 6 described in the first embodiment. Also, the flow of the test packet is almost the same as the description of FIGS. 7 to 13 described in the first embodiment.

  The transfer rule conversion by the control device 1 and the flow table conversion unit 2 is the same as that described in the functional connection configuration 302 of FIG.

  Next, in response to a request from the network administrator, a test packet is generated by the test packet generation unit 102 of the test packet generation device 250 based on the management information acquired from the flow information management unit 103, and the test packet transmission unit 105 It is transmitted to the transfer device 200 that is the first destination (see FIG. 7). At this time, header information matching the transfer rule group to be tested is stored in the header portion of the test packet. Further, the test packet is encapsulated using a protocol that is not used as a match condition in the flow table 202 of all SDN nodes. This is for matching the same transfer rule while distinguishing and recognizing the test packet and the user packet.

  The processing in the transfer device and the determination of the test result are the same as described in the functional connection configuration 302 in FIG.

(Embodiment 5)
The network verification system of this embodiment is the function connection configuration 305 of FIG.
The function connection configuration 305 is different from the function connection configuration 304 of FIG. 4 in that the connection between the flow table conversion unit 2 and the control device 1 is arranged in reverse.

  The control device 1 and the flow table conversion unit 2 are the same as those described in the functional connection configuration 303 in FIG. Further, the flow inspection apparatus 100 and the test packet generation apparatus 250 are the same as those described in the functional connection configuration 304 in FIG.

  The transfer device 200 (SDN node) is the same as the transfer device 200 described in the first embodiment.

  Next, the operation of the network verification system in FIG. 5 will be described. The packet processing after the flow table 202 of the transfer apparatus 200 is set is the same as the flowchart of FIG. 6 described in the first embodiment. Also, the flow of the test packet is almost the same as the description of FIGS. 7 to 13 described in the first embodiment.

  A method for setting a transfer rule in the transfer device 200 and a method for converting the transfer rule are the same as those in the function connection configuration 303 in FIG.

(Other embodiments)
1, the flow inspection apparatus 100 of FIGS. 2 to 3, the control apparatus 1, and the flow table conversion unit 2, the flow inspection apparatus 100, the control apparatus 1, and the flow table conversion unit 2 of FIGS. 4 to 5. The test packet generator 250 can also be realized by a computer and a program, and can be recorded on a recording medium or provided through a network.

(Effects of the invention)
The present invention has proposed a method for acquiring a transfer rule that matches a test packet in each SDN node without using a counter value. This is a function not realized by the existing method. The present invention enables the network administrator to grasp the flow of the test packet in detail separately from the user packet, so that the normality in the virtual network can be verified more finely than before. It becomes. Furthermore, when a failure occurs, the location of the failure can be identified more quickly than in the past by sequentially processing the test packet in each SDN node using the present invention.

(Point of invention)
Before the transfer rule is set in the transfer device, each transfer rule is changed so as to be composed of three elements: a test packet determination unit, a flow information storage processing unit, and a transfer destination determination unit (FIG. 16).

In order to distinguish the test packet from the user packet, the test packet is encapsulated with a protocol that is not used in the matching condition of the transfer rule.

In order to uniquely identify the transfer rule, a new transfer rule ID is defined.

In order to obtain transfer rule information (transfer rule ID) that matches the test packet, an action for storing the transfer rule ID in the metadata is added to the action field of the transfer flow entry.

In order to identify the test packet inside the SDN node and perform processing different from that of the user packet, one test packet control table is provided before and after the table storing the transfer rules (using a multi-table mechanism). ).

In the table (test packet determination unit) installed in the preceding stage of the transfer rule group, the encapsulation of the test packet is released, and the test packet is being processed in the specific bit (test packet determination flag) of the metadata that can be used inside the SDN node 1 is set to indicate that (FIG. 14).

When the transfer rule is a multi-table, the metadata is divided into the total number of tables, and each partition is assigned to each table (FIG. 15).

A table (transfer destination determination unit) installed in the latter stage of the transfer rule group identifies whether the packet being processed is a test packet by referring to the test packet determination flag in the metadata. If it is a test packet, it is encapsulated again to execute the action, and the transfer rule ID stored in the metadata is transmitted to the flow inspection apparatus. If it is not a test packet, it is regarded as a user packet, an action is executed, and it is transferred (or discarded).

Among the actions described in the transfer rule group, those related to packet transfer (including flooding) and discarding are always executed after the determination process in the transfer destination determination unit provided in the subsequent stage.

1: Control device 2: Flow table conversion unit 100: Flow inspection device 101: Test result determination unit 102: Test packet generation unit 103: Flow information management unit 104: Test result reception unit 105: Test packet transmission unit 200: Transfer device 201 : Reception unit 202: flow table 203: test packet determination unit 204: flow information storage processing unit 205: transfer destination determination unit 206: transmission unit 250: test packet generation devices 301 to 305: functional connection configuration

Claims (7)

A network verification system comprising at least one transfer device constituting a virtual network and a flow inspection device for verifying the normality of the virtual network,
The transfer device is
A packet matching condition, a forwarding rule that describes an action to be performed when the matching condition is met, and a flow table in which a forwarding rule ID that is information of the forwarding rule is set,
The flow inspection apparatus includes:
A flow information management unit for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device;
Generating a test packet having header information that matches the desired match condition, and transmitting the test packet to the transfer device; and
A test result receiving unit for receiving a test result from the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the test packet match condition to metadata, and the transfer that is written to the metadata when the received packet is the test packet The rule ID is transmitted to the test result receiving unit as the test result together with the test packet, and if the transfer rule is set to transfer or discard to another transfer device, the test packet is transferred or discarded. Transfer destination judgment function,
A flow table conversion unit for converting to a rule having
Based on the identification information of the test packet of the test result received by the test result receiving unit, the transfer rule for the desired match condition is detected from the flow information management unit, and the transfer rule and the test result receiving unit are A test result determination unit that verifies the normality of the virtual network by comparing the transfer rule of the received test result;
A network verification system comprising: The test packet generator is
The network verification system according to claim 1, wherein the test packet is encapsulated by a protocol different from a match condition of the transfer rule used for a user packet. The test packet determination function is
When the received packet is the test packet, it is recorded in a specific 1 bit in the metadata as a test packet determination flag,
The forwarding destination determination function is
The network verification system according to claim 1 or 2, wherein a packet to be processed by the test packet determination flag of the metadata is recognized as a test packet.   The flow information storage processing function divides the metadata into sections for each table, and describes the transfer rule ID in each table in each of the sections. The network verification system described. A network verification method for verifying the normality of a virtual network composed of at least one transfer device,
A flow table setting procedure for setting a packet match condition, a transfer rule that describes an action to be performed when the match condition is met, and a transfer rule ID that is information of the transfer rule in the flow table of the transfer device;
A flow information management procedure for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device in a flow information management unit;
A test packet generating procedure for generating a test packet having header information matching the desired match condition and transmitting the test packet to the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the match condition of the test packet to metadata, and the transfer that is written to the metadata when the received packet is the test packet A transfer destination determination function that transmits a rule ID together with the test packet as a test result, and further transfers or discards the test packet when the transfer rule is set to transfer or discard to another transfer device;
A flow table conversion procedure for converting to a rule having
Receiving the test result from the transfer device, detecting the transfer rule for the desired match condition from the flow information management unit based on the identification information of the test packet of the test result, and receiving the transfer rule A test result determination procedure for verifying the normality of the virtual network by comparing the transfer rule of the test result;
The network verification method characterized by performing. A virtual network composed of at least one transfer device having a packet match condition, a transfer rule describing an action that matches the match condition, and a flow table in which a transfer rule ID that is information of the transfer rule is set A flow inspection device for verifying the normality of
A flow information management unit for storing the transfer rule and the transfer rule ID set in the flow table of the transfer device;
Generating a test packet having header information that matches the desired match condition, and transmitting the test packet to the transfer device; and
A test result receiving unit for receiving a test result from the transfer device;
Before transmitting the test packet, the transfer rule set in the flow table of the transfer device,
A test packet determination function for determining whether or not the received packet is the test packet;
A flow information storage processing function that writes the transfer rule ID of the transfer rule that matches the match condition of the test packet to metadata, and the transfer that is written to the metadata when the received packet is the test packet The rule ID is transmitted to the test result receiving unit as the test result together with the test packet, and if the transfer rule is set to transfer or discard to another transfer device, the test packet is transferred or discarded. Transfer destination judgment function,
A flow table conversion unit for converting to a rule having
Based on the identification information of the test packet of the test result received by the test result receiving unit, the transfer rule for the desired match condition is detected from the flow information management unit, and the transfer rule and the test result receiving unit are A test result determination unit that verifies the normality of the virtual network by comparing the transfer rule of the received test result;
A flow inspection apparatus comprising:   A program for causing a computer to function as the flow inspection apparatus according to claim 6.

Images