KR101658824B1 - Method, apparatus and computer program for updating flow rules of software defined network - Google Patents

Abstract

The present invention relates to a method in which a controller server changes a flow rule in a software-defined network. The method comprises the steps of: adding a flow rule for consistency so that a packet, introduced into a network at a time at which a first flow rule is applied, is processed based on the first rule before change even after the first flow rule is changed; and changing the first flow rule after the flow rule for consistency has been added. According to the present invention, a packet can be processed by using a consistent flow rule based on a time at which the packet is introduced into a network, and thus provided are effects of improving reliability of an overall network and facilitating programming of an application.

Description

METHOD, APPARATUS AND COMPUTER PROGRAM FOR UPDATING FLOW RULES OF SOFTWARE DEFINED NETWORK,

The present invention relates to a method, apparatus and computer program for controlling a software defined network. More particularly, the present invention relates to a method for applying a consistent flow rule to a packet even though the flow rule is changed in a software defined network.

Software Defined Networking (SDN) is a technology that manages all the network devices in the network by an intelligent central management system. In the SDN technology, a controller provided in a form of software can perform processing instead of a control operation related to the packet processing performed by itself in a conventional hardware type network device, so that various functions can be developed and given over the existing network structure.

The SDN system generally comprises a controller server for controlling the entire network, a plurality of open flow switches controlled by the controller server for processing packets, and a host corresponding to a lower layer of the open flow switch. Here, the open flow switch is only responsible for transmitting and receiving packets, and routing, management, and control of the packets are all performed in the controller server. In other words, separating the data planes and control planes that form the network equipment is the basic structure of the SDN system.

In some cases, however, the basic SDN system described above may operate inefficiently. The controller server sets and controls the path of the packet by forwarding the flow rule to the open flow switch. One example is when the route of the packet becomes uncertain due to mixing of the flow rules before and after the change in the flow rule.

The flow rules may be changed while a packet is being transferred from one switch to another, rather than a state change of a plurality of switches to a changed flow rule being completed at the same time, It is not clear whether each switch is processed according to a conventional flow rule or according to a changed flow rule.

Taking all of these exceptions into consideration by the controller server or application may unnecessarily use the resources of the network, which may cause the stability to deteriorate.

It is an object of the present invention to provide a method and apparatus in a SDN environment in which a packet is processed according to a consistent flow rule until the packet enters the network and the processing is completed.

A method for changing a flow rule in a software defined network according to an embodiment of the present invention is a method for changing a flow rule at a time point when a first flow rule is applied, Adding a flow rule for consistency so as to be processed according to the flow rule; And changing the first flow rule after adding the flow rule for the consistency.

Further, a method for a switch to process a packet in a software defined network according to an embodiment of the present invention is characterized in that, after the first flow rule is changed, Adding a flow rule for consistency to be processed according to a rule; Modifying the first flow rule after adding the flow rule for the consistency; And processing the packet in accordance with the flow rule for consistency and the changed first flow rule.

Meanwhile, a controller server for changing a flow rule in a software defined network according to an embodiment of the present invention includes: a communication unit for communicating with at least one switch; And adding a flow rule for consistency so that a packet flowing into the network at the time of applying the first flow rule is processed according to a first flow rule before the change even after the first flow rule is changed, And a control unit for changing the first flow rule after the flow rule is added.

Further, a switch for processing packets in a software defined network according to an embodiment of the present invention includes: a communication unit for communicating with a controller server; And adding a flow rule for consistency so that the packet flowing into the network at the time of applying the first flow rule is processed according to the first flow rule before the change even after the first flow rule is changed, And a control unit for changing one flow rule and processing the packet according to the flow rule for consistency and the changed first flow rule.

On the other hand, a computer program stored in a medium for executing a process of changing a flow rule in a software defined network according to an embodiment of the present invention in a controller server may be configured such that, at a point of time when the first flow rule is applied, A function of adding a flow rule for consistency so as to be processed according to the first flow rule before the change even after the one flow rule is changed; And a function of changing the first flow rule after the flow rule for consistency is added.

Further, a computer program stored in a medium for executing a processing of a packet in a software defined network according to an embodiment of the present invention includes a first flow rule, a second flow rule, A function for adding a flow rule for consistency so as to be processed according to the first flow rule before the change even after the change; A function to change the first flow rule after adding the flow rule for the consistency; And a function of processing the packet according to the flow rule for consistency and the changed first flow rule.

According to the present invention, a packet can be processed according to a coherent flow rule based on a time point of entry of a network of packets, thereby improving the reliability of the entire network and facilitating the creation of an application.

1 is a diagram for explaining the configuration of a software defined network;
2 is a view for explaining a problem of the prior art;
3 is a flowchart for explaining a specific method of changing a flow rule according to an embodiment of the present invention

It is to be understood that the present invention is not limited to the description of the embodiments described below, and that various modifications may be made without departing from the technical scope of the present invention. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

In the drawings, the same components are denoted by the same reference numerals. And in the accompanying drawings, some of the elements may be exaggerated, omitted or schematically illustrated. It is intended to clearly illustrate the gist of the present invention by omitting unnecessary explanations not related to the gist of the present invention. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The term " flow rule " in the context of the present invention should be understood to mean a network policy applied by a controller server in a software defined network in the context of an ordinary technician in the field. Further, the term " flow rule " can be interpreted to mean a flow entry according to the network policy for an open flow switch.

Further, updating of a flow rule in this specification should be understood as a concept involving addition of a new flow rule, deletion of a previous flow rule, or modification.

1 is a diagram for explaining a configuration of a software defined network. Referring to FIG. 1, a software defined network may include a controller server 100, network equipment 200, and a host 300. The network device 200 and the host 300 may be referred to as a node, and a link may denote a connection between two nodes.

The controller server 100 manages the network equipment 200 and centrally manages and controls the plurality of network equipment 200. Specifically, the controller server 100 is equipped with software that performs functions such as topology management, path management related to packet processing, link discovery, and packet flow flow management. As shown in FIG.

The network device 200 functions to process packets under the control of the controller server 100. Examples of the network equipment 200 include a mobile communication base station, a base station controller, a gateway equipment, a wired network switch, and a router. Hereinafter, for convenience of explanation, the case where the network equipment 200 is an open flow switch will be mainly described.

In particular, in the present specification, the open flow switch 200 should be understood as a concept including a switch supporting only an open flow protocol, a virtual switch supporting an open flow protocol, and a general L2 switch supporting an open flow protocol.

In the software defined network, the controller server 100 and the open flow switch 200 exchange information with each other. The open flow protocol is widely used as a protocol for this. That is, the open flow protocol is a standard that allows the controller server 100 and the open flow switch 200 to communicate with each other.

More specifically, the open flow switch 200 exchanges information with the controller server 100 through a secure channel. The secure channel is a communication channel between the open flow switch 200 and the controller server 100 located at a remote location. Information exchanged between the controller server 100 and the open flow switch 200 can be encrypted.

The open flow switch 200 has one or more flow tables for defining and processing packets and including statistical information related to the packets. The flow table includes a flow rule for defining packet processing. The flow rule is a flow mode message (Flow-Mode Message) generated by the controller server 100 and transmitted to the open flow switch 200 And may be added, modified or deleted by the user. The open flow switch 200 processes the packet with reference to the flow table.

The flow table may include a match field for a packet defining a flow, operation information for defining processing of the packet, and statistical information for each flow (Stats). Each row constituting the flow table is called a flow entry, and a priority can be assigned to each flow entry. The open flow switch can process the packet according to the operation information of the flow entry having the highest priority among the flow entries having match information matching the information of the packet.

The host 300 means a terminal or the like corresponding to a lower layer of the open flow switch 200, and can be used to mean a client and a server. The host 300 can generate a packet for sending to another host via a software defined network and transmit the packet to the open flow switch 200 through a port of the network interface.

For example, when the first host 300a wants to send a packet to the second host 300b, the first host 300a first generates a packet to be sent and transmits the packet to the first host 300a via an open flow To the switch 200a. When there is a flow entry matching the packet in the open flow switch that received the packet, the packet is processed as specified in the flow entry. However, when there is no flow entry matched with the packet in the open flow switch 200a, the open flow switch 200a transmits a packet-in message informing the controller server 100 of the packet flow. The controller server 100 generates a flow rule change that specifies the processing of the packet and transmits the flow rule change to the open flow switch 200a. The open flow switch 200a changes the state based on the change and processes the packet.

Meanwhile, a path through which the first host 300a can send a packet to the second host 300b may vary. This is because a plurality of open flow switches 200 and the host 300 exist in the whole network, and therefore, each node has a plurality of links. At this time, the controller server 100 can calculate an optimal path among a plurality of paths that can transmit the packet based on the entire network topology map. The controller server 100 transmits information on the calculated route to the open flow switch 200 in the form of a flow rule, and the open flow switch 200 processes the packet in accordance with the flow rule.

2 is a diagram for explaining a problem that may occur when a flow rule applied to an arbitrary packet is changed.

For example, at some point the controller server can route a packet such that any packet is forwarded to the host 250 via the open flow switches 210-220. In this case the open flow switches 210 and 220 will receive a message for the first flow rule of the packet from the controller server and process the packet accordingly.

When the flow rule is changed in such a situation, for example, when the HTTP packet transmitted by the switch 210 is set to arrive at the specific host 240 after passing through the IPS (Intrusion Prevention System, intrusion prevention system, 230) It can be assumed.

In this case, the controller server may add a flow rule that directs the HTTP packet to arrive at the host 240 via the IPS 230 and the open flow switch 220 from the open flow switch 210 at a higher priority than the first flow rule. In this case, the open flow switches 210 and 220 receive a message for the second flow rule of the HTTP packet from the controller server, change the flow table, and process the packet accordingly (step < RTI ID = 0.0 > will be.

However, the open flow standard does not consider the synchronization of the change point of the open flow switch at the time of change. Therefore, while the first flow rule and the second flow rule are applied at 210 while the change procedure is in progress, the change may not be completed at 220 and the first flow rule may be applied only. Similarly, only the first flow rule is applied to 210, and a case where the first flow rule and the second flow rule are applied to 220 may occur.

In this case, in the first case, the HTTP packet may arrive at the host 250 via the IPS 230, not the host 240, and in the second case, an HTTP packet not passing through the IPS 230 may arrive at the host 240 . This is a result of the network policy before the change that all packets are sent through the IPS without going through the IPS, and the network policy after the change that all HTTP packets are sent to the network via the IPS at 240.

On the other hand, even if the status change of the open flow switches 210 and 220 is completed at the same time, the path of the packet is still not certain. For example, an HTTP packet transmitted 220 from the open flow switch 210 according to the first flow rule before the change time can be transmitted to the host 240 with the change of the second flow rule of the open flow switches 210 and 220 being completed . That is, even though a plurality of open flow switches concurrently complete the status change, the result that an HTTP packet is transmitted to the host 240 without passing through the IPS 230 may still occur.

In this way, in the current SDN structure, one packet may be applied inconsistently because a plurality of switches are mixed with network policies at different points in time. Since the current SDN standard can not guarantee consistent application of flow rules to arbitrary packets, the reliability of path computation is lowered and can be a serious problem especially in a network environment requiring high security.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made to solve the above problems. According to the embodiment of the present invention, if version information is given to a packet based on a time point of entry of a network and the version of the packet remains in the network, even if the flow rule changes in the middle, Lt; / RTI > can be treated as if it conforms to the previous flow rule.

That is, a consistent flow rule is applied to the packet based on the point of time when the network is introduced. This allows the packet to be processed according to a consistent flow rule from the moment it enters the network to the moment it is dropped or dropped, regardless of when the open flow switch applies the modified flow rule.

According to the embodiment of the present invention in the previous example of FIG. 2, a packet that has flowed into the network before the flow rule change starts and is transmitted at 220 according to the first flow rule, The flow rules for consistency will be applied without being subject to the rules and will be transmitted to 250. Also, all the HTTP packets that have been received after the change is completed will be transmitted to the IPS 240 through the IPS 230 according to the second flow rule.

A more specific method will be described later with reference to FIG. 3 attached hereto.

3 is a flowchart illustrating a concrete method of applying a consistent flow rule by assigning a version to a packet according to an embodiment of the present invention.

In step 305, the op-flow switch can add and delete version information to packets entering the network. Such versioning is preferably handled by an open flow switch directly connected to the host to be processed at the point in time when the packet enters and / or leaves the network. The version information can be changed at any time, and the controller is responsible for version management. For example, the controller can change the version of the incoming packet, along with the flow rule change.

In particular, in the example of FIG. 3, step 305 is shown as proceeding prior to other steps, but this is for illustrative convenience only. Therefore, it should be noted that according to the embodiment of the present invention, the versioning proceeds at the time of entry into and / or exit from the network of packets.

Furthermore, the versioning may be processed at any time in the open flow switch, or may be processed only when a predetermined condition is met. For example, in the case where it is desired to exclude a packet that has flowed at a certain time from the application of a changed flow rule, versioning may be set to be processed only at that time.

According to the embodiment of the present invention, the version information can be given using a VLAN tag, an MPLS tag, and a time-to-live (TTL) based on the network entry point of the packet. Or may be given using the MAC address of the packet or some byte of the IP address temporarily. The open flow switch may then delete the entry used as version information as the packet leaves the network.

Step 310 is a general case in which an arbitrary flow rule is applied to the open flow switch. For convenience of explanation, the flow rule is referred to as a first flow rule, and the first flow rule includes a configuration for a match field, a priority, and an instruction for a condition of a packet. In step 310, the open flow switch processes the packet according to the first flow rule.

According to the embodiment of the present invention, whether or not the first flow rule is applied only to a specific version of the packet does not matter to the subsequent procedure. Furthermore, the version information given to the packet at the time when the first flow rule is applied will be referred to as first version information for the sake of convenience.

In such a situation, it may be considered that a change such as adding, deleting, or modifying a flow rule is required. (Step 320).

For convenience of explanation, a flow rule to be added is referred to as a second flow rule, and the first flow rule is referred to as an old flow rule based on the change, A rule is called a new flow rule.

According to the embodiment of the present invention, the controller server updates the old version information (version information given at the time when the old flow rule is applied) to the old version information before the flow rule change so that it can be processed in the same way as following the old flow rule There is a feature to add a separate flow rule. (Step 330)

For example, in FIG. 3, even if the first flow rule is changed, the packet having the first version information added at the time of application of the first flow rule continues to be processed in the same manner as in the first flow rule .

In the specification of the present invention, this is referred to as a flow rule for consistency. The flow rule for consistency is intended to apply a consistent flow rule based on the network entry point of the packet.

The flow rule for consistency is applied only to a packet having a specific version of packet, that is, old version information, and even if the packet satisfies the condition of the new flow rule, . To this end, the flow rule for consistency is applied to the packet having the old version information in preference to the new flow rule, and is set to be processed according to the condition of the new flow rule and the instruction of the old flow rule.

More specifically, the flow rules for consistency are applied only to packets having i) old version information, ii) match fields are new flow rules, instructions are old flow rules, and iii) priority is newer than old flow rules There is a characteristic of high value. At this time, the content related to the version information of the packet to which the flow rule for consistency is applied may be described using a match field.

With this configuration, older packets can be processed the same as following old rules even after changing the flow rules.

Thereafter, the controller server may change the open flow switch by adding a second flow rule at step 340 or by sending a message instructing to delete or modify the first flow rule.

 The second flow rule has a higher priority than the first flow rule, and it does not matter whether it applies only to a specific version of the packet. At the same time, the controller server can change the version so as to give the second version information to packets that are to be transmitted to the network in the future. (Step 345)

In step 340, when the first flow rule is changed to the second flow rule, and the flow rule for consistency is applied to the flow table, the open flow switch can check the version information of the packet together with the flow table have.

For example, when version information of a packet is given using a VLAN tag, the open flow switch checks the VLAN tag of the packet to check whether it is an old version packet or a new version packet. As another example, if the version information is given using the MAC address of the packet or a part of the IP address, the open flow switch can confirm the version by checking the corresponding position of the packet.

At this time, if the packet has the old version information, i.e., the first version information, the open flow switch will apply the flow rule for high priority consistency so that the same processing as the first flow rule will be applied. If the packet has the second version information, the flow rule for consistency is not applied, so the second flow rule having the next highest priority will be processed.

On the other hand, according to the embodiment of the present invention, some consideration can be made so that the flow rule for consistency does not collide with a general flow rule (the first flow rule and the second flow rule in the example of Fig. 3).

For example, the priority range of the flow rule can be set in advance.

In other words, in any case, since the priority of the flow rule for consistency is larger than the new flow rule and can be selected as a value not equal to other flow rules irrelevant to the change, It can be set to select from the set range. For example, if the priority of a general flow rule is set to be assigned to an even number, the priority of a flow rule for consistency can always be selected from an odd value, so that a flow rule conflict does not occur.

 As another example, to ensure that there is no conflict in the flow table, the flow rules for consistency may not allow flow rule changes if they conflict with other flow rules. For example, in the example of FIG. 3, if the priority of the flow rule for consistency is the same as the second flow rule, the open flow switch may not reflect the second flow rule in the flow table.

Meanwhile, the flow rule for consistency is intended to apply the old flow rule consistently to packets having old version information in the process of changing the old flow rules, so that they can be deleted after all of old packets disappear from the network have.

In step 350, the controller server checks whether a packet having old version information is no longer present in the network. If all packets are missing, the controller server can delete the flow rule for consistency in step 360.

To this end, the controller server may estimate the time at which the old version packet is present in the network at step 350. For example, the controller server can estimate the amount of time it takes a packet to travel between switches and estimate the maximum time that an old packet may exist in the network using the packet's time-to-live (TTL) . As another example, the controller server may estimate the time required for old packets to disappear from the network, taking into account conventional statistics, etc., without rigorous calculations.

The estimated time may be sufficient if the old packets disappear, and exact estimation is not required. This is because the estimated time is overestimated and no special load is generated in the network even if the flow rule for consistency remains more than necessary.

Once the estimated time has elapsed, the controller server may delete the flow rules for consistency at step 360.

According to another embodiment of the present invention, steps 350 to 360 may not be performed in a separate procedure. For example, the controller server does not separately transmit a message instructing deletion of a flow rule for consistency in step 360, estimates the existence time of the old version packet in step 330, and sets the idle_timeout field of the consistency rule The time (idle time) may be described. The flow rule describing the idle time will be discarded after the estimated time has elapsed.

In the above description, the flow rule change is exemplified as the addition of the second flow rule in the first flow rule, but the present invention is not limited to this. That is, according to the embodiment of the present invention, the flow rule change should be understood as a concept including the addition of the new flow rule, the deletion of the old flow rule and the modification of the old flow rule.

According to the embodiment of the present invention, even when the old flow rule is deleted or modified, the flow can proceed according to FIG.

For example, if the controller server wishes to delete a flow rule (step 320), it will first add a flow rule for consistency. (Step 330) This is for processing old packets even after the flow rule is deleted, in the same way as following the flow rule before deletion. Therefore, the flow rule for consistency is applied only to a packet having old version information, that is, a packet flowing into the network at the time of applying the pre-deletion flow rule, and the match field and the instruction may be set according to the pre-deletion flow rule.

Next, the controller server can change the version assigned to the packet in the network while deleting the flow rule. (Step 340), if the old packet is no longer present in the network, the flow rule for consistency can be deleted. (Steps 350 and 360)

As another example, if the controller server wishes to modify a flow rule (step 320), it will also add a flow rule for consistency. (Step 330) This is for processing the old packet even after the flow rule is modified, in the same way as following the flow rule before the modification, and is applied only to the packet having the old version information. Next, the controller server changes the version of the network to the new version while modifying the old flow rule (step 340), and then can delete the flow rule for consistency if the old version packet is no longer present in the network. (Steps 350 and 360)

For the sake of understanding, the features of the present invention will be described below with a simple example. In the example, it is assumed that version information is given to a packet using a VLAN tag.

For example, a case may be considered in which a flow rule indicating " forward to port 1 with priority 10 for all packets " is applied at the time when a packet enters the network. According to the embodiment of the present invention, the packet is provided with version information based on the network inflow time point, and packets entered into the network at the corresponding time point are given as version information of 100 packets.

Priority Match Field Instruction 10 All packets Output port 1

In such a situation, it may be considered to add a flow rule indicating that the controller server should drop "priority 20 to the HTTP packet". (Table 2)

Priority Match Field Instruction 20  HTTP packet Drop 10 All packets Output port 1

In this case, according to the embodiment of the present invention, the controller server has a feature of adding a flow rule for consistency before changing the flow rule. (Table 3)

Priority Match Field Instruction 21 If the VLAN tag is 100 and the HTTP packet Output port 1

As described above, the flow rule for consistency is intended to treat a packet as if one flow rule is applied based on the network inflow point. That is, when the flow rule for consistency is applied, even if the flow rule applied at the network inflow time of the packet is changed, the same result as that the packet is processed according to the flow rule before the change is derived.

For this purpose, the flow rule for consistency is applied only to packets having specific version information. In the above example, the flow rule for consistency is applied only to packets having version information (VLAN tag) 100.

In the above example, the priority of the flow rule for consistency is higher than that of the flow rule to be added. The match field is a form in which a match field of the flow rule to be added is attached to the version information of the packet. , It can have the same form as the instruction corresponding to the match field of the flow rule to be added.

According to an embodiment of the present invention, the controller server first applies the flow rules for consistency and changes the flow rules. At the same time as changing the flow rule, it is possible to increase the version given to the packets entering the network. In the previous example, the version of the network could be changed to 101.

Priority Match Field Instruction 21 If the VLAN tag is 100 and the HTTP packet Output port 1 20  HTTP packet Drop 10 All packets Output port 1

Table 4 shows the flow table in which the conventional flow rule, the consistency flow rule, and the added flow rule are all reflected in the above example. The version information 101 will be given to the packet flowing into the network at the time when the flow table of Table 4 is applied.

According to the flow table in Table 4, a packet with a version number of 100 is processed in the same manner as the conventional flow rule applied at the time of network inflow. That is, if the packet having the version 100 is an HTTP packet, the packet is transmitted to the port 1 according to the flow rule for the highest priority for consistency. If the packet is not the HTTP packet, the packet is transmitted to the port 1 according to the conventional flow rule. All packets are processed as if they were applied to the conventional flow rules as shown in Table 1.

On the other hand, packets of version 101 will be dropped if they are HTTP packets as shown in Table 2, and will be sent to port 1 if they are not HTTP packets because they are not subject to the flow rules for consistency. Then the flow rule for consistency will be deleted when the remaining estimated time of packet of version 100 passes.

The embodiments of the present invention disclosed in the present specification and drawings are intended to be illustrative only and not intended to limit the scope of the present invention. It is to be understood by those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

100: Controller server
200, 200a, 210, 220: open flow switch
300, 300a, 300b, 240, 250:
230: IPS

Claims (15)

In a method for changing a flow rule by a controller server in a software defined network,
Adding a flow rule for consistency so that a packet flowing into the network at a time when the first flow rule is applied is processed according to a first flow rule before the change even after the first flow rule is changed;
Modifying the first flow rule after adding the flow rule for the consistency;
Estimating a maximum time at which a packet having version information added at a time point when the first flow rule is applied may exist in the network; And
And deleting the flow rule for the consistency when the estimated maximum time has elapsed. 2. The method of claim 1, wherein the flow rule for consistency comprises:
Is applied only to a packet having version information given at a time when the first flow rule is applied. 3. The method of claim 2,
Wherein the step of modifying the first flow rule is a step of adding a second flow rule,
The consistency flow rule includes a higher priority than the second flow rule, a match field following the second flow rule, and an instruction following the first flow rule before the change. The flow rule changing method comprising the steps of: 3. The method of claim 2,
Wherein changing the first flow rule is a step of deleting or modifying the first flow rule,
The flow rule for consistency includes a higher priority than the first flow rule before the change, a match field following the first flow rule before the change, and an instruction following the first flow rule before the change. How to change. The method according to claim 3 or 4,
Wherein the match field of the flow rule for consistency includes version information of a packet to which the flow rule for consistency is applied. 2. The method of claim 1, wherein changing the first flow rule comprises:
And changing the version information to be given to a packet flowing into the network. 3. The method of claim 2,
Further comprising the step of deleting the flow rule for consistency if it is estimated that a packet having version information added at the time of applying the first flow rule is not present in the network. delete 2. The method of claim 1, wherein deleting the flow rules for consistency comprises:
And writing the estimated maximum time in the idle_timeout field of the flow rule for consistency. The method according to claim 1,
Wherein the priority order of the first flow rule and the second flow rule has a value in a preset range so as not to conflict with the priority of the flow rule for consistency. A method for a switch to process packets in a software defined network,
Adding a flow rule for consistency so that a packet flowing into the network at a time when the first flow rule is applied is processed according to a first flow rule before the change even after the first flow rule is changed;
Modifying the first flow rule after adding the flow rule for the consistency;
Processing the packet according to the flow rule for consistency and the changed first flow rule; And
And deleting the flow rule for consistency when a maximum time that a packet having version information given at the time of application of the first flow rule is estimated to exist in the network has elapsed, Lt; / RTI > 1. A controller server for changing a flow rule in a software defined network,
A communication unit for communicating with at least one switch; And
Adding a flow rule for consistency so that a packet flowing into the network at a time when the first flow rule is applied is processed according to a first flow rule before the change even after the first flow rule is changed, And a control unit for changing the first flow rule after the rule is added,
The control unit estimates a maximum time that a packet having version information given at a time point when the first flow rule is applied may exist in the network, and deletes the flow rule for consistency when the estimated maximum time has elapsed Wherein the controller server comprises: 1. A switch for processing packets in a software defined network,
A communication unit for communicating with the controller server; And
Adding a flow rule for consistency so that a packet flowing into the network at the time of applying the first flow rule is processed according to a first flow rule before the change even after the first flow rule is changed, And a control unit for changing the flow rule and processing the packet according to the flow rule for consistency and the changed first flow rule,
Wherein the control unit deletes the flow rule for consistency when a maximum time estimated that a packet having version information given at a time point when the first flow rule is applied may exist in the network has elapsed . A computer program stored on a computer readable medium for executing in a controller server processing of changing a flow rule in a software defined network,
Adding a flow rule for consistency so that a packet flowing into the network at a time when the first flow rule is applied is processed according to a first flow rule before the change even after the first flow rule is changed;
A function to change the first flow rule after the flow rule for consistency is added;
A function of estimating a maximum time that a packet having version information given at a time when the first flow rule is applied may exist in the network; And
And deletes the flow rule for the consistency when the estimated maximum time has elapsed. CLAIMS 1. A computer program stored on a medium for performing processing of packets in a software defined network at a switch,
Adding a flow rule for consistency so that a packet flowing into the network at a time when the first flow rule is applied is processed according to a first flow rule before the change even after the first flow rule is changed;
A function to change the first flow rule after adding the flow rule for the consistency;
A function of processing a packet according to the flow rule for consistency and the first flow rule changed; And
And a function for deleting the flow rule for consistency when a maximum time estimated that a packet having version information given at a time point when the first flow rule is applied may exist in the network has elapsed program.

Images