JP6570033B2 - Virtual switch control system and method - Google Patents

Description

  The present invention relates to container-type virtualization technology.

  In current carrier networks, especially fixed networks, functions for providing network services such as Internet access, Internet Protocol TeleVision (IPTV), and Virtual Private Network (VPN) (NW functions) include edge routers and dedicated appliances. Implemented in the form.

  In recent years, NFV (Network Function Virtualization) has been studied in which such an NW function is virtualized and operated on a general-purpose server to provide a network service (see Non-Patent Document 1).

  When NFV is realized, it becomes possible to consolidate the NW functions of the virtualized carrier network in one server group or data center, and it can be expected that the introduction cost is reduced and the equipment efficiency is improved. Furthermore, by combining with quick and flexible network control by SDN (Software Defined Network) technology, it becomes possible to provide services quickly.

  One of the NW functions for which NFV is being considered is CPE (Customer Premises Equipment). The CPE is a device installed for each user connected to the carrier network, and the number of CPEs is very large in a carrier network accommodating many tens of millions of users. When such a large number of NW functions are virtualized and accommodated in a server, improvement of server accommodation efficiency becomes a major issue.

  Currently, hypervisor type virtualization is widely used in data centers that provide cloud services. In hypervisor type virtualization, a virtual machine obtained by virtualizing a physical machine can be created by emulating the operation of a computer, and an OS can be operated on the virtual machine. As a result, a different OS can be executed for each virtual machine on one server. On the other hand, the overhead due to emulation is large, and there is a problem that the performance is degraded and the accommodation efficiency of the server is also degraded as compared with the case where the application is directly operated on the server.

  Under such circumstances, there is a container type virtualization technology as a technology for creating an independent environment in which a process operates on an OS by separating a name space and a process space instead of emulating a virtual machine. In the container-type virtualization technology, an environment in which server resources such as a name space, a process space, and a CPU and memory are logically separated on one OS is executed, and an application is executed. This separated environment is called a “container”, and resource use and access to the file system are controlled for each container. Compared with hypervisor type virtualization, container type virtualization technology has a smaller overhead because virtual machines are not emulated, and is advantageous over hypervisor type virtualization in terms of accommodation efficiency (see Non-Patent Document 2). )

"Network Functions Virtualisation", NFV White Paper, Oct. 22, 2012, [online], [searched on January 22, 2013], Internet <URL: http: //portal.etsi.org/NFV/NFV_White_Paper.pdf > Xavier M.G., et al., "Performance Evaluation of Container-Based Virtualization for High Performance Computing Environments", Parallel, Distributed and Network-Based Processing (PDP), 2013 21st Euromicro International Conference on, pp233-240, Feb. 2013

  However, since the container technology shares the kernel, there is a problem that an application using a kernel area such as a virtual switch (vSwitch) is restricted in operation on the container. In addition, it is possible to implement a virtual switch in the kernel and share it in multiple containers.For example, in a multi-tenant environment where users are different for each container, each user individually controls the virtual network in the container. As a result, a common virtual switch is controlled, and there is a concern about security problems.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a virtual network having a high security level without being restricted by the environment even in an environment in which the container is constructed by the container-type virtualization technology. It is an object to provide a virtual switch control system and method capable of providing a switch.

In order to achieve the above object, the present invention relates to one or more containers that are virtualized environments constructed on an OS (Operating System) by container-type virtualization technology, and built in the OS and contained in the containers. A virtual switch control system comprising a virtual switch shared from a process and a virtual switch controller for controlling the virtual switch, wherein the virtual switch is connected to an external physical interface and the one or more containers. One or more virtual interfaces that are generated correspondingly and connected to the corresponding containers, and processing corresponding to the control contents notified from the virtual switch controller to the physical interface and the packet that arrives at the virtual interface A packet processing function unit for performing the virtual switch controller Comprises storage means for storing independent switch control information for each container and a network control function unit for controlling the virtual switch, wherein the network control function unit is a container received by the packet processing function unit of the virtual switch. The packet related to the switch to the network control function unit of the virtual switch controller is transferred to the network control function unit of the virtual switch controller and the packet related to the switch control signal from the user controller using the container is transferred to the container via the virtual interface. A first function unit that controls the virtual switch to transfer, and a switch control signal of a container that is used by a user related to the switch control signal for the switch control signal transferred from the virtual switch by the control of the first function unit As a signal stored in the storage means, Characterized by comprising a second functional unit for controlling the packet processing function unit of the virtual switch based on the switch control signal.

Further, the present invention provides a virtual environment that is built on an OS (Operating System) using a container-type virtualization technology and is shared by processes built on the OS and processes in the container. in an environment that includes a switch, a method of virtual switch controller for controlling the virtual switch, the virtual switch is a physical interface for connecting with the outside, and generated corresponding to the one or more containers performing one or more of the temporary Soi interface to be connected to the corresponding container, a process corresponding to the prior Symbol physical interface and control content in which the notified from the virtual switch controller for a packet arriving at the temporary Soi interface A packet processing function unit, and the virtual switch controller is independent for each container. A storage unit that stores switch control information; and a network control function unit that controls the virtual switch , wherein the network control function unit receives a packet related to communication in the container received by the packet processing function unit of the virtual switch. the virtual switch as another packet with a packet according to a switch control signal from the user of the controller to transfer to the network control function unit of the virtual switch controller utilizing containers of the transfer to the container via a virtual interface The first control step and the switch control signal transferred from the virtual switch by the control of the first step by the network control function unit as a switch control signal for a container used by a user related to the switch control signal When storing in the storage means Moni, characterized in that it comprises a second step of controlling the packet processing function unit of the virtual switch on the basis of the switch control signal.

  According to the present invention, it is possible to control the virtual switch independently for each container while sharing the virtual switch in each container. Therefore, when viewed from the process in the container, each container has a dedicated virtual switch. Looks like it exists. In other words, a pseudo virtual switch (hereinafter referred to as a pseudo virtual switch (pvSW)) can be provided to each container. Thereby, the security level between containers can be improved without being restricted by the container type virtualization technology.

Configuration diagram of virtual switch control system Virtual switch configuration diagram Virtual switch controller configuration diagram An example of DB storage information An example of container information Example of pseudo virtual switch information Example of virtual switch information User information The figure explaining schematic operation of a virtual switch control system Example of virtual switch control contents Sequence chart explaining the operation of the virtual switch control system The figure explaining schematic operation of a virtual switch control system Example of virtual switch control contents Sequence chart explaining the operation of the virtual switch control system Diagram explaining the operation when moving the container to another server Sequence chart explaining the operation when the container is moved to another server Flowchart for generating a configuration file for a virtual switch

  A virtual switch control system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram of a virtual switch control system.

  In the virtual switch control system, as shown in FIG. 1, the server 100 includes one or more containers 120 and 130 constructed on the OS 110, one or more virtual switches 150 constructed on the OS 110, and the OS 110. And a virtual switch controller 190 constructed in the above. If the virtual switch controller 190 can communicate with the virtual switch 150, the mounting position is not limited, and the virtual switch controller 190 may be mounted outside the OS 110 or on a computer different from the server 100.

  The containers 120 and 130 are virtualized environments formed in the user space of the OS 110 and resources are separated at the process level, and the name space and process space are separated between containers. The containers 120 and 130 are constructed for each user who uses the container, and a plurality of containers 120 and 130 can be constructed in the server 100, that is, containers can be provided to a plurality of users. In the containers 120 and 130, one or more user processes 121 and 131 can be generated in the container 120 or 130 according to an instruction of a user who uses the container. Here, “a user who uses a container” is, for example, a person who receives a container providing service when a business provider performs a container providing service using this system, and the user is formed as a user process 121 or 131. Various applications can be provided to the customer of the user by the application. As another form of using this system, in order for an operator operating a plurality of services to provide these services, a container is generated for each service on one server, and different administrators are assigned. In this case, the administrator corresponds to “a user who uses a container”. As another form of using this system, in the case of constructing a plurality of verification systems in research and development, etc., for the purpose of sharing the servers to reduce physical devices, each verification system on one server A container is created and one server is shared from a plurality of verification systems, but there may be a case where each verification system wants to appear as if a virtual switch exists for each verification system. Corresponds to “user using container”. In addition, the form using this system is not limited to these.

  The virtual switch control system according to the present invention controls the virtual switch 150 so that one or more virtual switches (pseudo virtual switches) 129 and 139 exist in the containers 120 and 130 in a pseudo manner. is there.

  The virtual switch 150 is implemented in the kernel space of the OS 110 and is shared by the containers 120 and 130. One or more virtual switches 150 are constructed on one server 100. FIG. 2 shows a configuration diagram of the virtual switch 150. As shown in FIG. 2, the virtual switch 150 includes one or more physical interfaces (Eth) 151 connected to the network 300 outside the server 100 and n (n is a natural number) virtual interfaces connected to the containers 120 and 130. An interface (vEth) 152 and a packet processing function unit 153 are provided.

  The virtual interface 152 is a network interface on the container 120, 130 side, and is generated corresponding to the container 120, 130 existing in the server 100. The packet processing function unit 153 performs a process according to the control content notified from the virtual switch controller 190 on the packet that has arrived at the physical interface 151 and the virtual interface 152, so that the pseudo virtual switch of each container 120, 130 The packet processing functions of 129 and 139 are substantially substituted, so that the virtual virtual switches 129 and 139 appear to exist in the containers 120 and 130, respectively. Note that the pseudo virtual switches 129 and 139 may not exist in the containers 120 and 130, or may exist in two or more.

  The virtual switch 150 corresponds to one or more protocols for constructing a virtual network such as VLAN (Virtual Local Area Network), MPLS (Multi-Protocol Label Switching), and VxLAN (Virtual eXtensible Local Area Network), and is included in the header. The user of the virtual network can be identified from the identification ID.

  The virtual switch controller 190 is installed in the user space of the OS 110 and controls the virtual switch 150. FIG. 3 shows a configuration diagram of the virtual switch controller 190. As shown in FIG. 3, the virtual switch controller 190 includes a network control function unit 191 (corresponding to a “packet control unit” in the claims), an inter-server cooperation function unit 192, and a DB (Data Base) 193. And.

  The network control function unit 191 controls the virtual switch 150 using a protocol such as OpenFlow, NETCONF, ForCES (Forwarding and Control Element Separation), or XMPP (eXtensible Messaging and Presence Protocol). In addition, the network control function unit 191 transfers only specific control traffic (such as the above-described protocol or API (Application Programming Interface) protocol) arriving at the virtual switch 150 to the virtual switch controller 190, thereby transferring each container 120, 130 has the function of providing the pseudo virtual switches 129 and 139 for each user.

  The inter-server cooperation function unit 192 has a function of moving the network settings of the migration source containers 120 and 130 to the migration destination when the containers 120 and 130 are migrated to another server.

  The DB 193 has a function of holding information about containers 120 and 130, pseudo virtual switches 129 and 139, users in the server 100, and the like. FIG. 4 shows information held in the DB. As illustrated in FIG. 4, the DB 193 holds container information 201, pseudo virtual switch information 202, virtual switch information 203, and user information 204.

  As illustrated in FIG. 5, the container information 201 indicates a connection state between a container and a pseudo virtual switch, and holds a container ID for identifying the container and a pseudo virtual switch ID for identifying the pseudo virtual switch.

  As illustrated in FIG. 6, the pseudo virtual switch information 202 holds various types of information about the pseudo virtual switches 129 and 139, the pseudo virtual switch ID, the mapping information between the port in the container and the virtual interface 152, and the virtual The interface 152 and virtual network mapping information, control address / port number information, and setting content information are held. Here, the in-container port means the port names of the pseudo virtual switches 129 and 139 viewed from inside the container. Further, as will be described later, the control address / port number information is used as a destination when a user controller (described later) sends a packet related to a switch control signal toward the pseudo virtual switches 129 and 139. This indicates an address / port number. As described later, a packet destined for the control address / port number reaches the virtual switch controller 190. The setting content information is setting information of the pseudo virtual switches 129 and 139 included in the switch control signal received from the user's controller. For example, packet filter setting information, NAT (Network Address Translator) setting information, VPN (Virtual Private Network) Setting information etc. are mentioned.

  As illustrated in FIG. 7, the virtual switch information 203 holds various information for each virtual switch 150, and holds a virtual switch ID, physical interface information, virtual interface information, and setting content information. Here, the setting content information is setting information of the virtual switch 150, and examples thereof include filter setting information, NAT setting information, and VPN setting information.

  As illustrated in FIG. 8, the user information 204 holds the user authentication information and the association state between the user and the pseudo virtual switches 129 and 139, and includes the user ID, the authentication information, and the user. The information of one or more pseudo virtual switches 129 and 139 associated with each other is held.

  The network 300 corresponds to one or more protocols for constructing a virtual network such as VLAN, MPLS, VxLAN, and the like. The protocol for constructing the virtual network may be other than those described above.

  Next, the operation of the virtual switch control system according to the present embodiment will be described with reference to FIG. 9 is a diagram for explaining the schematic operation of the virtual switch control system, FIG. 10 is an example of control contents of the virtual switch, and FIG. 11 is a sequence chart for explaining the operation of the virtual switch control system.

  First, the user A notifies the virtual switch controller 190 of creation of a pseudo virtual switch (step S1). The pseudo virtual switch creation notified here includes identification information of an application that uses the created virtual virtual switch. Or the identification information of the container using the created pseudo virtual switch is included.

  The virtual switch controller 190 writes the pseudo virtual switch information 202 to the DB 193 related to the corresponding container ID from the identifier of the container in which the corresponding application is executed (step S2), and the control address / The port number information is returned to the user (step S3).

  Note that the communication between the user A and the virtual switch controller 190 in the processes of steps S1 to S3 is performed by a mechanism / route different from that of the present invention. For example, the server 100 may provide the user A with a web interface for controlling container generation and the like, and perform the steps S1 to S3 via the web interface.

  Next, the virtual switch controller 190 controls the virtual switch 150 so that the packet related to the switch control signal received from the controller 301 of the user A is transferred to the virtual switch controller 190 (step S4). Here, the controller 301 of the user A is a control application having a function of controlling the virtual switch, and is installed on the terminal or other server of the user A or in the container of the user A.

  Next, when a switch control signal related to user authentication is transmitted from the controller 301 of the user A to the control address / port number notified in step S3 (step S5), the packet related to the switch control signal is virtual. The data is transferred to the switch controller 190 (step S6). When receiving the switch control signal, the virtual switch controller 190 performs user authentication (step S7), and transmits the setting information of the pseudo virtual switch of the container used by the user to the controller 301 of the user A (step S8). .

  Next, a switch control signal (see FIG. 10) relating to various switch settings such as packet filtering settings is transmitted from the controller 301 of the user A to the control address / port number notified in step S3 (step S9). The packet related to the switch control signal is transferred to the virtual switch controller 190 (step S10). When receiving the switch control signal, the virtual switch controller 190 writes the setting information in the DB 193 (step S11), and controls the virtual switch 150 so that the virtual switch 150 performs an operation based on the setting information (step S12).

  Thereafter, a packet related to communication from the terminal 302 to the application of the user A, that is, a packet other than a packet related to the switch control signal from the controller 301 of the user A (step S13), the virtual switch 150 performs processing such as packet filtering. Is performed (step S14) and transferred to the application of user A in the container (switch S15). Here, the terminal 302 is not limited to the one related to the user A, but is assumed to be a terminal of a customer or the like who receives a service by the application of the user A.

  Next, a case where the user changes the setting of the pseudo virtual switch in the environment set as described above will be described. Here, a case will be described in which the setting is updated so that packets destined for the TCP port 80 directed to the application of user A are filtered. 12 is a diagram for explaining the schematic operation of the virtual switch control system, FIG. 13 is an example of control contents of the virtual switch, and FIG. 14 is a sequence chart for explaining the operation of the virtual switch control system.

  When a switch control signal related to user authentication is transmitted from the controller 301 of the user A to the control address / port number notified in step S3 (step S21), the packet related to the switch control signal is transmitted to the virtual switch controller 190. (Step S22). When receiving the switch control signal, the virtual switch controller 190 performs user authentication (step S23), and transmits the setting information of the pseudo virtual switch of the container used by the user to the user controller 301 (step S24).

  Next, a switch control signal (see FIG. 13) related to various switch settings such as packet filtering settings is transmitted from the controller 301 of the user A to the control address / port number notified in step S3 (step S25). ), The packet related to the switch control signal is transferred to the virtual switch controller 190 (step S26). When receiving the switch control signal, the virtual switch controller 190 writes the setting information in the DB 193 (step S27), and controls the virtual switch 150 so that the virtual switch 150 performs an operation based on the setting information (step S28).

  Thereafter, the packet addressed to the TCP port 80 from the terminal 302 to the user A application (step S29) is subjected to packet filtering in the virtual switch 150 (step S30).

  Next, the operation when the container is moved to another server will be described with reference to the drawings. FIG. 15 is a diagram for explaining the movement of the container, and FIG. 16 is a sequence chart for explaining the operation when the container is moved. Here, as shown in FIG. 15, it is assumed that the container of user A has moved from server 100A to server 100B.

  When the virtual switch controller 190A of the server 100A detects that the container has moved (step S51), the virtual switch controller 190A acquires the destination of the container (step S52), and the application of user A is transferred to the server 100B in which the destination container is constructed. Is present (step S53). The virtual switch controller 190B of the server 100B notifies the virtual switch controller 190A of the server 100A that the user A application exists (step S54).

  Next, the virtual switch controller 190A of the server 100A notifies the virtual switch controller 190B of the server 100B of the setting information of the pseudo virtual switch for the application of the user A (Step S55). Next, the virtual switch controller 190B of the server 100B writes the pseudo virtual switch information to the DB related to the container ID from the ID of the container in which the user application is executed (step S56), and completes the writing to the virtual of the server 100A. The switch controller 190A is notified (step S57). The virtual switch controller 190A of the server 100A instructs the virtual switch 150A of the server 100A to delete the setting for the application of the user A (step S58). On the other hand, the virtual switch controller 190B of the server 100B controls the virtual switch 150B so that only the packet related to the switch control signal for the user A is transferred to the virtual switch controller 190B, and received from the virtual switch controller 190A in step S55. The setting information of the pseudo virtual switch is set in the virtual switch 150B (step S59).

  Next, a method for generating a setting file (config file) for the virtual switch 150 from the setting information of the pseudo virtual switch information 202 in the DB 193 will be described with reference to FIG.

  When the setting content of the pseudo virtual switch information 202 in the DB 193 is updated, the virtual switch controller 190 extracts the updated setting content (step 101). Next, the virtual switch controller 190 determines the control type for the i-th row of the extracted setting content (step S102).

  When the control type is “NAT”, the virtual switch controller 190 converts the in-container port number described in the setting content of the i-th line into a virtual interface, and sets NAT processing between the corresponding virtual interfaces (step S103, S104). Further, when the control type is “Filter”, the virtual switch controller 190 converts the in-container port number described in the setting content of the i-th line into a virtual interface, and sets the packet filtering processing of the corresponding virtual interface (step S105). , S106). Further, when the control type is “VPN”, the virtual switch controller 190 converts the in-container port number described in the setting contents of the i-th line into a virtual interface, and from the corresponding virtual interface, the destination IP address described in the setting contents VPN generation processing is set for (steps S107 and S108).

  Next, if there is a part that overlaps with the existing virtual switch setting contents (step S109), the virtual switch controller 190 initializes the setting contents determined so far and gives an error indicating that the update contents cannot be executed. The user A is notified to the controller 301 (step S110). The above operation is performed for each line of the setting information (steps S111 and S112).

  As described above, according to the virtual switch control system according to the present embodiment, when viewed from the container, it appears that there is a pseudo virtual switch dedicated to the container, but the switching process itself is a virtual switch shared by the container. Do. As a result, the efficiency of the switching process can be improved while ensuring a high security level.

100, 100A, 100B ... server 110 ... OS
120, 130 ... container 121, 131 ... process (application)
129, 139: Pseudo virtual switch 150, 150A, 150B ... Virtual switch 190, 190A, 190B ... Virtual switch controller 191 ... Network control function unit 192 ... Inter-server cooperation function unit 193 ... DB
301 ... Controller of user A 302 ... Terminal

Claims (4)

One or more containers which are virtual environments constructed on an OS (Operating System) by container virtualization technology, a virtual switch constructed on the OS and shared by processes in the container, and the virtual switch A virtual switch control system comprising a virtual switch controller for controlling
The virtual switch arrives at the physical interface connected to the outside, one or more virtual interfaces generated corresponding to the one or more containers and connected to the corresponding containers, and the physical interface and the virtual interface. A packet processing function unit that performs processing according to the control contents notified from the virtual switch controller to the packet,
The virtual switch controller includes storage means for storing independent switch control information for each container, and a network control function unit for controlling the virtual switch,
The network control function unit, the virtual switch network packets according to the switch control signal from the user of the controller of the virtual switch controller utilizing containers of the packet of the communication to the packet processing function unit received in the container of The first function unit that controls the virtual switch to transfer the packet to the control function unit and other packets to the container via the virtual interface, and the packet is transferred from the virtual switch under the control of the first function unit. A second function of storing a switch control signal in the storage means as a switch control signal of a container used by a user related to the switch control signal, and controlling a packet processing function unit of the virtual switch based on the switch control signal A virtual switch characterized by comprising Control system. The storage means further stores user information including authentication information,
In the second function unit of the network control function unit , when a switch control signal related to the user authentication information is received from the user controller via the packet processing function unit of the virtual switch , the user information of the storage unit is used. The authentication process is performed, and when the authentication is successful, the subsequent switch control signal is stored in the storage unit and the packet processing function unit of the virtual switch is controlled based on the switch control signal. The virtual switch control system described. The second function unit of the network control function unit converts the address included in the switch control signal into a virtual interface when controlling the packet processing function unit of the virtual switch based on the switch control signal. The virtual switch control system according to claim 1 or 2, characterized by comprising: An environment including one or more containers that are virtual environments constructed on an OS (Operating System) by container virtualization technology, and a virtual switch that is constructed on the OS and shared by processes in the containers Below, the virtual switch controller controls the virtual switch,
The virtual switch includes a physical interface for connecting with the outside, one or more and the temporary Soi interface to be connected to the one or more generated corresponding to the container and the corresponding container, before Symbol physical interface and the temporary and a packet processing function unit for performing a process corresponding to the notified control content from the virtual switch controller for each incoming packet to Soi interface,
The virtual switch controller includes storage means for storing independent switch control information for each container, and a network control function unit for controlling the virtual switch ,
The network control function unit transmits a packet related to a switch control signal from a controller of a user who uses the container among packets related to communication in the container received by the packet processing function unit of the virtual switch. A first step of controlling the virtual switch to transfer to the control function unit and transfer other packets into the container via the virtual interface ;
The network control function unit stores the switch control signal transferred from the virtual switch by the control of the first step in the storage unit as a switch control signal of a container used by a user related to the switch control signal, And a second step of controlling a packet processing function unit of the virtual switch based on the switch control signal.

Images