KR102026447B1 - Offload apparatus and method for virtual network - Google Patents

Abstract

The present invention provides an offload device for operating a virtual network including a plurality of virtual devices, the communication unit communicating with an external network device, a storage unit storing an integrated offload cache for the plurality of virtual devices, and the communication unit. If session information corresponding to session information of the received packet exists in the unified offload cache, at least one virtual to be transmitted by the packet by referring to information stored in the unified offload cache in association with the corresponding session information. And a control unit for determining a device and controlling the at least one virtual device to process the packet through TCP offload.

Description

Offload apparatus and method for virtual network

The present invention relates to an offload apparatus and method for a virtual network, and more particularly, to an offload apparatus and method for providing offload between a plurality of virtual equipment by using an integrated offload cache.

As communication technology advances, the amount of packets transmitted and received on a network is increasing rapidly. In order to solve the low latency problem and high performance networking, TCP offload (offload) technology has emerged.

Offloading is a technique that reduces CPU overhead and improves packet processing / transmission speed by preventing the CPU from performing TCP / IP processing performed by the OS kernel. Offloading is applied by the Network Interface Card (NIC) directly processing the packet without passing it to the CPU.

This offload technique can be applied in a virtual network environment. When each virtual device created in one physical device transmits and receives a packet, the packet is processed directly by the NIC instead of being processed by the CPU in any virtual device. Is implemented.

As such, offloading is applied within a single device, even in a virtualized environment, within each single virtual device.

However, since the virtual network environment implements a plurality of network devices by using the resources of a single device, the performance is inferior to the actual network environment. Therefore, there is a need for an efficient offload method for improving packet processing speed in a virtual network environment composed of virtual devices in a single device.

The present invention is to solve the above problems, and provides an offload apparatus and method for a virtual network including an integrated offload cache to apply the offload between virtual devices in the virtual network.

In addition, when the offload is applied to any packet through the integrated offload cache, the virtual security equipment in the virtual network does not perform a separate offload control, the predetermined security function required for the packet, For example, the present invention provides an offloading device and method for a virtual network that is controlled to perform firewall, network address translation (NAT), intrusion prevention, intrusion detection, and the like. .

The offload device for a virtual network according to the present invention for solving the above problems is an offload device for operating a virtual network consisting of a plurality of virtual equipment, a communication unit for communicating with an external network device, the plurality of virtual A storage storing an integrated offload cache for the device and session information corresponding to session information of a packet received through the communication unit exists in the integrated offload cache, the integrated offload in association with the corresponding session information. And a controller configured to determine at least one virtual device to which the packet passes through, based on the information stored in the cache, and to control the at least one virtual device to process the packet through TCP offload.

If the session information corresponding to the session information of the received packet does not exist in the unified offload cache, the controller stores the session information of the received packet in the unified offload cache and the packet is stored in the unified offload cache. Store path information and processing information in association with the session information in the integrated offload cache while passing through at least one virtual device, wherein the path information includes identification information of the at least one virtual device; The information may be information on an operation performed on the packet in the at least one virtual device.

The controller may be further configured to determine the at least one virtual device based on the path information and to process and transmit the at least one virtual device on a virtual network interface card without performing TCP processing on the packet. Characterized in that.

The controller may control the virtual device to process the packet by calling an operation to be performed on the packet based on the processing information.

The processing information may include at least one of a firewall, network address translation (NAT), intrusion prevention, and intrusion detection performed by the virtual security device on the packet when any virtual device is a virtual security device. Characterized in that it comprises information relating to network security processing including one.

In addition, the offload method for a virtual network according to the present invention for solving the above problems is an offload method of an offload apparatus for a virtual network composed of a plurality of virtual equipment, when the packet is received from the outside, Determining whether session information corresponding to the session information of the received packet exists in an integrated offload cache for the plurality of virtual devices; if session information corresponding to the session information exists in the integrated offload cache, Determining at least one virtual device for the packet to pass through, referring to the information stored in the integrated offload cache in association with the session information, and processing the at least one virtual device to process the packet via TCP offload. It characterized in that it comprises a step of controlling.

Further, if session information corresponding to the session information does not exist in the unified offload cache, storing session information of the received packet in the unified offload cache and wherein the packet passes through the at least one virtual device. Storing path information and processing information in the integrated offload cache in association with the session information, wherein the path information includes identification information of the at least one virtual device. And information on an operation performed on the packet in the at least one virtual device.

The determining of the at least one virtual device may include determining the at least one virtual device based on the path information, and controlling the at least one virtual device may include determining the at least one virtual device. And controlling the virtual device to process and transmit the packet on the virtual network interface card without performing TCP processing on the packet.

The controlling of the at least one virtual device may include controlling the virtual device to process the packet by calling an operation to be performed on the packet based on the processing information. .

The processing information may include at least one of a firewall, network address translation (NAT), intrusion prevention, and intrusion detection performed by the virtual security device on the packet when any virtual device is a virtual security device. Characterized in that it comprises information relating to network security processing including one.

The offloading apparatus and method for a virtual network according to the present invention requires only an integrated offload cache in comparison with the offload cache for each virtual device when performing offload for each virtual device. Has an advantage.

In addition, the offloading apparatus and method for a virtual network according to the present invention can improve the packet transmission rate through offloading between devices, and unlike each virtual device refers to the offload cache independently, one integration off Offload control can be controlled through load cache references, allowing for improved offload performance.

1 is a diagram illustrating an embodiment of a virtual network according to the present invention.
2 is a diagram illustrating a general packet forwarding flow in a virtual network.
3 is a diagram for describing a method of offloading a single virtual device in a virtual network.
4 is a view for explaining the offload method according to the present invention.
5 is a flowchart illustrating an offload method according to the present invention.
6 is a block diagram showing the structure of an offload device according to the present invention.

In the following description of embodiments of the present disclosure, when it is determined that a detailed description of a related well-known configuration or function may obscure the gist of the present disclosure, the detailed description may be omitted.

As used herein, "includes," "can include." And the like refer to the existence of the corresponding function, operation, component, etc. disclosed, and do not limit one or more additional functions, operations, components, and the like. Also, in this specification, "includes." Or "have." And the like are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described in the specification, and that one or more other features or numbers, step, action, component, part, or It should be understood that they do not preclude the presence or possibility of adding these in advance.

As used herein, the singular forms "a", "an" and "the" include plural forms unless the context clearly indicates otherwise.

Hereinafter, with reference to the accompanying drawings will be described the present invention.

1 is a diagram illustrating an embodiment of a virtual network according to the present invention. FIG. 2 is a diagram illustrating a general packet forwarding flow in a virtual network, and FIG. 3 is a diagram for describing a method of offloading a single virtual device in a virtual network.

Referring to FIG. 1, a virtual network is implemented in the offload device 100 of the present invention.

The virtual network is composed of at least one virtual equipment (130-1, 130-2, 130-3) implemented as a virtual machine in the offload device 100.

2 and 3, the offload device 100 has various physical resources 110 including a CPU, a memory, a disk, in particular a NIC 111, and the like. The offload device 100 transmits a packet received from an external network device to the at least one virtual device 130-1, 130-2, and 130-3 through the NIC 111, and at least one virtual device. Send a packet from (130-1, 130-2, 130-3) to an external network device.

The host OS 120 is installed on a physical resource, for example, a disk. The host OS 120 may be driven by a controller such as a CPU to perform control for various operations of the offload apparatus 100. The host OS 120 has a kernel 121 that performs a control operation using data stored in a kernel region of a memory. The kernel 121 may perform, for example, TCP / IP layer processing of a packet transmitted from the NIC 111.

In various embodiments of the present disclosure, the host OS 120 may include a program, software, and instructions for performing a control operation for creating and managing at least one virtual device 130-1, 130-2, and 130-3. have. In one embodiment, the host OS 120 is a program, software, or command for driving a hypervisor to create / remove, control, and manage at least one virtual device 130-1, 130-2, 130-3. Can include them.

At least one virtual device 130-1, 130-2, 130-3 may be generated on the host OS 120 through a hypervisor or in a content-based manner. The host OS 120 allocates some area or some amount of physical resources such as CPU, memory, and disk for each of the virtual devices 130-1, 130-2, and 130-3, and allocates the allocated physical resources, eg, For example, the virtual equipment can be realized by driving the guest OSs 133-1, 133-2, and 133-3 installed on the disk.

Each virtual device 130-1, 130-2, 130-3 may have virtual NICs 131-1, 131-2, and 131-3. Each of the virtual devices 130-1, 130-2, and 130-3 transmits and receives packets to and from each other through the virtual NICs 131-1, 131-2, and 131-3, or through the offload device 100. Send and receive packets with external network devices.

In one embodiment, the virtual NICs 131-1, 131-2, and 131-3 are offload caches 132-1, 132-2, and 132-3 for performing offload in the virtual equipment. It can have The offload caches 132-1, 132-2, and 132-3 store the source / destination IP addresses, port numbers, and the like for packets flowing into the respective virtual devices 130-1, 130-2, and 130-3. Session information including the data may be stored. The virtual NICs 131-1, 131-2, and 131-3 transmit packets when the packets received through the virtual devices 130-1, 130-2, and 130-3 have session information stored in the offload cache. The packet may be directly processed based on the stored session information without being transferred to the CPU, that is, the kernels of the guest OSs 133-1, 133-2, and 133-3.

The guest OSs 133-1, 133-2, and 133-3 are configured to control the respective virtual devices 130-1, 130-2, and 130-3. Similar to host OS 120, guest OS 133-1, 133-2, and 133-3 have TCP / IP layer processing of packets forwarded from virtual NICs 131-1, 131-2, and 131-3. A kernel (not shown) for performing the above is provided.

The guest OSs 133-1, 133-2, and 133-3 of each of the virtual devices 130-1, 130-2, and 130-3 have various programs, software, and applications 134-1, 134-2, and 134. -3) are driven. In an embodiment, when the virtual device is a virtual security device, the applications 134-1, 134-2, and 134-3 may be applications for a firewall, NAT, IPS, IDS, and the like as an operation for network security. . Such a network security application may determine whether a packet received by each of the virtual devices 130-1, 130-2, and 130-3 is malicious, and allow / block packet forwarding.

Through the above-described structure, at least one virtual device (130-1, 130-2, 130-3) performs the operations required on the virtual network. For example, the at least one virtual device 130-1, 130-2, and 130-3 may transmit / receive packets with each other. At least some of the at least one virtual device 130-1, 130-2, 130-3 may be in communication with the network device that is external to the offload device 100 and connected to the offload device 100. . Such a virtual device may forward a packet received from an external network device to another virtual device in the virtual network, or forward a packet received from another virtual device in the virtual network to an external network device.

The at least one virtual device 130-1, 130-2, 130-3 may be a packet forwarding control device (virtual router, virtual switch) such as a router or a switch. Alternatively, the at least one virtual device 130-1, 130-2, 130-3 may be a security device (virtual security device) that performs network security. In various embodiments, the virtual network may be a mixture of packet forwarding control equipment and security equipment. For example, in the embodiment of FIG. 1, the first virtual device 130-1 and the third virtual device 130-2 are virtual switches, and the second virtual device 130-2 is a virtual security device.

In various embodiments, more virtual devices may be provided in the virtual network than the virtual devices shown in FIG. 1.

In the virtual network having the above-described structure, the packet introduced into the offload device 100 may be delivered in the path as shown in FIG.

In detail, when the offload apparatus 100 receives a packet through the NIC 111, the NIC 111 transmits the packet to the kernel 121 for TCP / IP processing of the received packet. The kernel 121 processes the packet and delivers the packet to the virtual device to which the packet is to be delivered, that is, the source virtual device in the device. 2 and 3, the starting virtual equipment is the first virtual equipment 130-1.

The first virtual device 130-1 may receive a packet through the first virtual NIC 131-1. The first virtual NIC 131-1 analyzes the session information of the received packet to determine whether it corresponds to the session information previously stored in the offload cache. If the prestored session information corresponding to the session information of the received packet does not exist, the first virtual NIC 131-1 transmits the packet to the first guest OS 133-1 so that the packet can be TCP / IP processed. It can be delivered to the kernel and the session information of the packet can be stored in the offload cache. The packet may be delivered to and processed by the first application 134-1 on the first guest OS 133-1. The processed packet is passed back to the first virtual NIC 131-1, and the first virtual NIC 131-1 is sent to the virtual device to which the packet is to be delivered, for example, the second virtual device 130-2. The packet can be sent.

The packet transmitted to the second virtual device 130-2 may be processed similarly to the first virtual device 130-1 and transmitted to the third virtual device 1300-3. In addition, the packet transmitted to the third virtual device 130-3 may be processed similarly to the first and second virtual devices 130-1 and 130-2.

In the offload device 100, the packet is sent to the virtual device that must be finally delivered, that is, to the destination virtual device in the device. 2 and 3, the destination virtual equipment is the third virtual equipment 130-3.

When the packet is to be transmitted to a network device outside the offload device 100 by the packet processing, the third virtual device 130-3 transmits the packet to the external network through the NIC 111 of the offload device 100. Can be sent to the device.

If the session information pre-stored in the offload cache corresponding to the session information of the packet received in the first virtual device 130-1 exists, as shown in FIG. 3, the first virtual NIC 131-1 ) May perform the offload process of the packet directly without passing the packet to the kernel of the first guest OS 133-1. For example, the first virtual NIC 131-1 may perform a processing operation to be performed on the packet based on the session information stored in the offload cache, and transmit the packet directly to the destination according to the session information. .

Offload in such a single virtual device is shown in the virtual NIC (131-1, 131-2, 131-3) provided in each of the virtual devices (130-1, 130-2, 130-3) as shown in FIG. Each can be performed.

Using offload within a single virtual device, each virtual device 130-1, 130-2, 130-3 does not pass all of the in-device layer (e.g., Internet Protocol layer) processing of the packet, which is fast. Packet processing performance can be secured. However, this offload within a single virtual appliance is freed of offload cache capacity for as many virtual NICs (131-1, 131-2, 131-3) as there are virtual machines (130-1, 130-2, 130-3). Since the virtual devices 130-1, 130-2, and 130-3 must refer to the offload cache individually, there is a limit in improving packet processing speed.

The present invention provides an off-device offload method using an integrated offload cache to solve this problem. This will be described in detail later.

4 is a view for explaining the offload method according to the present invention.

Referring to FIG. 4, the offload apparatus 200 according to the present invention further includes an integrated offload cache 222 as compared to the offload apparatus 100 illustrated in FIG. 1. The aggregate offload cache 222 may be provided on the host OS 220 as shown in FIG. 4, but is not necessarily limited thereto. In various embodiments, the aggregate offload cache 222 may include a NIC 211. It may be provided by an application provided on or run separately on the host OS (220).

The integrated offload cache 222 may store session information about packets flowing into the offload device 100, that is, all packets flowing into the at least one virtual device 230-1, 230-2, and 230-3. have. In detail, the integrated offload cache 222 may store information about an IP address, a port number, and the like of a source / destination as session information of a packet flowing into the offload apparatus 100.

In addition, the integrated offload cache 222 may store the path information and the processing information of the packet in association with the session information.

In detail, the integrated offload cache 222 passes the packet while the packet introduced to the offload apparatus 100 is transmitted and received between at least one virtual device 230-1, 230-2, 230-3. Information about one or more virtual devices 230-1, 230-2, and 230-3 may be stored as path information. In this case, the path information may include identification information of the virtual device.

The integrated offload cache 222 may store processing information regarding an operation performed on the packet in at least one virtual device 230-1, 230-2, 230-3 through which the packet passed. In one embodiment, when the virtual device is a virtual security device, the processing information may include API information about a network security operation performed on the packet, for example, firewall, NAT, intrusion prevention, intrusion detection, and the like.

The storage of path information and processing information for the packet may be performed until the packet reaches the destination virtual equipment or until it exits the offload device 100.

The information stored in the unified offload cache 222 may be used for offload between devices. When the offload apparatus 200 receives a packet having the same session information as the previously introduced packet, that is, when the session information of the packet corresponds to any one of the session information previously stored in the integrated offload cache 222, The device performs offloading based on the path information and processing information stored in the integrated offload cache 222 in association with the corresponding session information.

Specifically, the offload device 200 may, based on the path information stored in the unified offload cache 222, at least so that the packet is transmitted and received directly from the source virtual device to the destination virtual device without TCP / IP processing, that is, directly through the virtual NIC. One virtual device 230-1, 230-2, 230-3 may be controlled. In addition, the offload device 200 may perform processing operations on the corresponding packet based on the processing information stored in the integrated offload cache 222 for at least one virtual device 230-1. 230-2, 230-3) can be controlled.

More details on this will be described later.

The other components shown in FIG. 4 are similar to those described with reference to FIG. 1, and thus detailed descriptions thereof will be omitted.

5 is a flowchart illustrating an offload method according to the present invention. The following method may be performed after the offload apparatus 200 creates at least one virtual equipment 230-1, 230-2, 230-3 and configures the virtual network.

Referring to FIG. 5, when a packet is received from the outside (501), the offload apparatus 200 first analyzes the session information of the received packet (502). In addition, the offload apparatus 200 determines whether there is previously stored session information corresponding to the session information analyzed for the packet in the integrated offload cache 222 (503). That is, the offload apparatus 200 may retrieve the analyzed session information from the integrated offload cache 222 and determine whether there is session information corresponding to the analyzed session information.

If there is no session information corresponding to the analyzed session information in the unified offload cache 222, the offload device 200 stores the session information of the packet in the unified offload cache 222 (504). The packet may be delivered to the device (505).

In detail, the offload apparatus 200 may transfer the packet to the virtual device to which the packet is to be delivered based on the analyzed session information of the packet, for example, destination information, for example, the first virtual device 230-1 in FIG. 4. You can forward the packet. In addition, the offload apparatus 200 may store the analyzed session information of the packet in the integrated offload cache 222.

The offload apparatus 200 transmits the path information and processing information to the session information while the packet is transmitted and received between at least one virtual device 230-1, 230-2, 230-3 in the offload apparatus 200. In association with the unified offload cache 222.

The packet delivered to the first virtual device 230-1 may be a virtual device to which the packet is to be delivered next according to packet processing in the first virtual device 230-1, for example, a second virtual device 230-. 2) and the third virtual equipment 230-3 may be sequentially transmitted. In addition, the packet may be transmitted from a specific virtual device, for example, the third virtual device 230-3, to an external network device according to packet processing.

At this time, the processing of the packet is TCP / IP processing and application (134-) by the guest OS (133-1, 133-2, 133-3) of at least one virtual device (230-1, 230-2, 230-3). 1, 134-2, 134-3), and the like.

While the packet is transmitted and received between the at least one virtual device 230-1, 230-2, 230-3 by the above-described processing, the offload apparatus 200 collects path information and processing information and aggregates offloading. May be stored in cache 222.

This information may be stored by the virtual device that processes the packet. Specifically, at least one virtual device 230-1, 230-2, 230-3 receiving the corresponding packet from the NIC 111 (or host OS 220) or other virtual device of the offload device 200. May store its identification information in the unified offload cache 222 as path information of the corresponding packet. In addition, the at least one virtual device (230-1, 230-2, 230-3) receiving the packet processes the packet in the integrated offload cache 222 information about the operation performed on the received packet. Can be stored as information. In one embodiment, when the virtual device is a virtual security device, the processing information may include API information about a network security operation performed on the packet, for example, firewall, NAT, intrusion prevention, intrusion detection, and the like.

Thereafter, when transmission in the offload apparatus 200 for the packet is terminated (507), the offload apparatus 200 terminates storing (update) the information to the integrated offload cache 222, and returns to the previous step. The next packet may be received (501). In one embodiment, the offload device 200 terminates storing information in the unified offload cache 222 when the packet reaches or exits the destination virtual equipment in the offload device 200. can do.

When the next packet is received, the offload apparatus 200 analyzes the session information of the received packet (502) and determines whether there is already stored session information corresponding thereto (503).

If there is session information corresponding to the analyzed session information in the integrated offload cache 222, the offload apparatus 200 performs offloading between devices with reference to the integrated offload cache 222 (508).

The offload device 200 refers to the path information stored in association with the session information in the integrated offload cache 222. The offload apparatus 200 may determine at least one virtual device 230-1, 230-2, 230-3 through which the packet is to be routed based on the path information. Here, the at least one virtual device 230-1, 230-2, 230-3 may include a source virtual device. Also, the at least one virtual device 230-1, 230-2, 230-3 may include a destination virtual device.

The offload device 200 may deliver the packet to the source virtual device. In addition, the offload apparatus 200 may control the determined at least one virtual device 230-1, 230-2, 230-3 to transmit and receive a packet through the virtual NIC without TCP / IP processing on the packet. . Such control may be implemented by adding a packet header or transmitting a separate control message. Through such control, when the virtual NICs 231-1, 231-2, and 231-3 of the at least one virtual device 230-1, 230-2, and 230-3 pass through the packet, receive the packet. Instead of transmitting to the host OSs 233-1, 233-2, and 233-3, the host OS 233-1, 233-2, and 233-3 can directly process and transmit the data to the next virtual device.

In addition, the offload apparatus 200 refers to the processing information stored in association with the session information in the integrated offload cache 222. The offload apparatus 200 may control the at least one virtual device 230-1, 230-2, 230-3 to perform a processing operation that should be performed on the packet based on the processing information. Under such control, at least one virtual device 230-1, 230-2, 230-3 may perform a processing operation on a packet through, for example, a function API call.

In various embodiments of the present disclosure, the processing operation may be network security processing by the virtual security apparatus. For example, the processing operation may be an operation for allowing / blocking packet transmission by determining whether a packet is malicious. In this case, depending on whether packet forwarding is allowed by the processing operation, the virtual security device may continuously perform packet forwarding according to offload between devices, or block packet forwarding.

In one embodiment, this processing operation may be directly handled by the host OS 220 of the offload device 200. Since the function APIs related to the operations performed by each of the virtual devices 230-1, 230-2, and 230-3 are stored in the physical resources 110 assigned to the corresponding virtual device, the host OS 220 provides the corresponding function API. It can be configured to directly access the storage area of the. In such an embodiment, the host OS 220 may refer to the unified offload cache 222 to directly call a function API of the processing operation to be processed for the packet and process the packet.

Accordingly, packets are quickly processed and forwarded between the at least one virtual device 230-1, 230-2, 230-3 through the virtual NICs 132-1. 132-2, 132-3, The necessary processing on the packet, for example network security processing, can be performed efficiently.

According to the present invention described above, the offload apparatus 200 does not require offload cache memory for each of the virtual equipment 230-1, 230-2, and 230-3 separately, and requires one offload cache reference. This allows you to quickly control offload while performing the necessary processing on the packet. Thus, the present invention enables inter-device offload with improved performance over offload in a single virtual device.

According to various embodiments of the present disclosure, such inter-device offload may be applied only to a grouped part of the entire virtual devices constituting the offload apparatus 200. That is, the offload device 200 may include at least some of the at least one virtual device 230-1, 230-2, and 230-3 that are driven in the offload device 200 (eg, the first and second virtual devices). The off-device offload may be controlled only for the 230-1 and 230-2. In this case, the remaining virtual devices (for example, the third virtual device 230-3) to which the off-device offload does not apply. ) May separately perform offload in a single virtual equipment, or not offload.

6 is a block diagram showing the structure of an offload device according to the present invention.

Referring to FIG. 6, the offload apparatus 100 according to the present invention may include a communication unit 201, a control unit 202, and a storage unit 203.

The communication unit 201 may transmit and receive a packet with an external network device. In various embodiments of the present disclosure, the communication unit 201 may be configured to include a NIC. The NIC may be configured to process a packet received from the outside, deliver the packet to the controller 202, and deliver the packet from the controller 202 to the outside.

The controller 202 may control each component of the offload apparatus 100 to perform the offload method according to the present invention.

For example, the controller 202 allocates at least one physical resource provided in the offload apparatus 100, for example, a CPU constituting the controller 120, a memory constituting a storage unit, a disk, and the like to the virtual device. The virtual device may be created by running a guest OS for the virtual device. In such an embodiment, the virtual device may be assigned a virtual NIC, and the virtual device may transmit and receive packets with an external network device or other virtual devices therein through the assigned virtual NIC.

The controller 202 may allocate and store an integrated offload cache in the storage 203. The controller 202 may store session information of a packet received through the communication unit 201 in an integrated offload cache. In addition, the controller 202 may control the virtual device to store the path information and the processing information in association with the session information in the integrated offload cache while the packet is transmitted and received between the virtual devices.

When the packet is received through the communication unit 201, the controller 202 may analyze the session information and compare the session information with session information previously stored in the integrated offload cache. If the same session information as the analyzed session information is previously stored in the integrated offload cache, the controller 202 refers to the stored path information and processing information in association with the session information to perform packet processing by offloading between devices. You can control the virtual equipment.

In detail, the controller 202 may deliver the packet to the source virtual device of the packet, and the virtual device included in the path information may perform packet processing and delivery through the virtual NIC to the virtual devices via the packet based on the path information. You can control the equipment. In addition, the controller 202 may control virtual devices that process the packet based on the processing information to perform the packet processing.

More specific control operations of the controller 202 are the same as those described with reference to FIGS. 1 to 5.

The storage unit 203 may store and manage an operating system, software, a program, an application, data, and the like necessary for performing the operation of the offload apparatus 200. In various embodiments, the storage unit 203 may be a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (eg, SD or xD memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EPEROM), programmable read-only memory (PROM) ), A magnetic memory, a magnetic disk, and an optical disk may include at least one type of storage medium.

The storage unit 203 may include a memory and a disk as physical resources. The storage unit 203 may be configured to store an operating system, software, programs, applications, data, etc. for the virtual device in an area allocated for the virtual device.

The storage unit 203 may provide an integrated offload cache in one region under the control of the controller 202, and store session information, path information, processing information, and the like necessary for offloading between devices.

Those skilled in the art will appreciate that various modifications and variations can be made without departing from the essential features of the present invention. In addition, the embodiments disclosed in the specification and the drawings merely present specific examples to easily explain and easily understand the contents of the present invention, and are not intended to limit the scope of the present invention. Therefore, the scope of the present invention should be construed that all changes or modifications derived based on the technical spirit of the present invention are included in the scope of the present invention in addition to the embodiments disclosed herein.

200: off-road device
201: communication unit
202: control unit
203: storage unit

Claims (10)

Offload device for operating a virtual network consisting of a plurality of virtual devices,
A communication unit communicating with an external network device;
A storage unit to store an integrated offload cache for the plurality of virtual devices; And
If the session information corresponding to the session information of the packet received through the communication unit does not exist in the integrated offload cache, the session information of the received packet is stored in the integrated offload cache, and the packet is stored in the at least one packet. And a controller configured to store path information and processing information in association with the session information in the integrated offload cache while passing through a virtual device.
The control unit,
If session information corresponding to the session information of the received packet exists in the unified offload cache, the packet may pass through at least by referring to the path information stored in the unified offload cache in association with the corresponding session information. Determine one virtual device and control the at least one virtual device to process and transmit the packet on a virtual network interface card without performing TCP processing on the packet. The method of claim 1, wherein the route information,
Includes identification information of the at least one virtual device,
The processing information is
Offload device characterized in that the information on the operation performed on the packet in the at least one virtual equipment. delete The method of claim 1, wherein the control unit,
And control the virtual device to process the packet by calling an operation to be performed on the packet based on the processing information. The method according to claim 4, wherein the processing information,
If any virtual device is a virtual security device, the network security process including at least one of a firewall, network address translation (NAT), intrusion prevention, and intrusion detection that the virtual security device performs on the packet. Offload device, characterized in that it comprises information. An offloading method of an offloading device for a virtual network composed of a plurality of virtual devices,
If a packet is received from the outside, determining whether session information corresponding to the session information of the received packet exists in an integrated offload cache for the plurality of virtual devices;
If session information corresponding to the session information does not exist in the unified offload cache, the session information of the received packet is stored in the unified offload cache, and the path is performed while the packet passes through the at least one virtual device. Storing information and processing information in association with the session information in the unified offload cache;
If session information corresponding to the session information exists in the unified offload cache, referring to the path information stored in the unified offload cache in association with the corresponding session information, at least one virtual device to be passed by the packet. And controlling the at least one virtual device to process the packet via TCP offload. The method of claim 6, wherein the route information,
Includes identification information of the at least one virtual device,
The processing information is
Offload method, characterized in that the information on the operation performed on the packet in the at least one virtual device. The method of claim 7, wherein
Controlling the at least one virtual device,
Controlling the at least one virtual device to process and transmit the packet on a virtual network interface card without performing TCP processing on the packet. The method of claim 8, wherein the controlling of the at least one virtual device comprises:
Controlling the virtual device to process the packet by invoking an action to be performed on the packet based on the processing information. The method of claim 9, wherein the processing information,
If any virtual device is a virtual security device, the network security process including at least one of a firewall, network address translation (NAT), intrusion prevention, and intrusion detection that the virtual security device performs on the packet. Offload method comprising the information on.

Images