KR20180000524A - Node device, method for processing packet of the node device, and network system which comprises node device and control device for managing control information associated with the packet-processing - Google Patents

Abstract

According to an embodiment of the present invention, in a node device including one or more virtual machines to which different physical addresses are allocated, disclosed is the node device which includes: a packet receiving unit for receiving a first packet from a first node device connected through a first network; a control information requesting unit for transmitting a signal requesting control information related to the processing of the first packet to a control device connected through the first network; a control information receiving unit for receiving a response of the signal from the control device and determining whether to receive the packet according to the control information included in a response signal of the signal; and a packet processing unit for receiving the packet according to whether the packet is received or not, and transmitting the packet to a virtual machine to which a destination address is allocated. Accordingly, the present invention can determine whether to receive the packet by receiving the control information from the control information and determine whether to block the packet by receiving firewall information.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network system including a node device, a method of processing packets of the node device, and a control device for managing control information related to packet processing of the node device COMPRISES NODE DEVICE AND CONTROL DEVICE FOR MANAGING CONTROL INFORMATION ASSOCIATED WITH THE PACKET-PROCESSING}

The present invention relates to a network system including a node device, a method of processing packets of the node device, and a control device for managing control information associated with packet processing of the node device.

In the field of communications, a switch is a network device that selects a path or a circuit to send unit data to the next destination. The switch may include a router function, which is the device that can determine the route, i.e., more specifically, to the adjacent network point where data should be sent. Switches are much simpler and faster to operate than routers that typically require knowledge of how to determine the network and route. Switches are usually associated with the second layer, the data link layer, in the OSI reference model. However, some of the newer switches also perform the routing function of the network layer, which is three layers. The more devices connected to the switch, the greater the broadcast traffic, which can also cause network performance degradation.

Also, in providing a cloud service, since a physically separated node device used for providing cloud services is added, a switch for managing network information of the added node device has been required. Also,

The above-described background technology is technical information that the inventor holds for the derivation of the present invention or acquired in the process of deriving the present invention, and can not necessarily be a known technology disclosed to the general public prior to the filing of the present invention.

Embodiments of the present invention provide a node device for determining whether to receive the packet by receiving control information related to transmission and reception of packets between one or more node devices including a plurality of virtual machines from a control device.

In addition, embodiments of the present invention provide a network system for determining whether to block the packet by receiving firewall information related to blocking of a packet received from a terminal apparatus not connected to a network, from a control apparatus.

Further, in the embodiments of the present invention, when a node device is to be additionally installed as many as the number of users to be increased, a network device (a switch or the like) for managing the installed node devices through a single network, System.

In addition, embodiments of the present invention can dynamically allocate a virtual machine to users in order to share a packet among virtual machines assigned to the same user, and transfer the virtual machine assigned to the first user to another user To a network system.

A node device including at least one virtual machine to which different physical addresses are allocated according to an embodiment of the present invention includes a packet receiver for receiving a first packet from a first node device connected to a first network; A control information requesting unit for transmitting a signal requesting control information associated with the processing of the first packet to a control apparatus connected to the first network; A control information receiving unit that receives a response of the signal from the control device and determines whether to receive the packet according to control information included in a response of the signal; And a packet processor for receiving the packet according to whether the packet is received or not, and for transmitting the packet to a virtual machine to which a destination address is allocated.

The node device including at least one virtual machine to which different physical addresses are allocated according to an embodiment of the present invention may further include a backup unit for backing up the control information. In this case, when the packet processor receives the second packet from the first node device by the packet receiver in succession to the first packet, it does not request control information related to the processing of the packet to the control device, And may transmit the second packet to the virtual machine to which the destination address is allocated according to the stored control information.

Wherein the control information requesting unit receives a third packet from the terminal apparatus connected to the second network by the packet receiving unit by using a signal requesting the control apparatus for firewall information related to the processing of the third packet The control information receiving unit receives the response of the signal from the control device and determines whether to block the packet according to the firewall information included in the response signal of the signal, And transmits the packet to the virtual machine to which the destination address is allocated.

A network system according to an embodiment of the present invention includes a packet receiver including a plurality of virtual machines assigned different physical addresses and receiving a first packet from a first node device connected to a first network; A control information requesting unit for transmitting a signal requesting control information associated with the processing of the first packet to a control apparatus connected to the first network; A control information receiving unit that receives a response of the signal from the control device and determines whether to receive the packet according to control information included in a response of the signal; And a packet processor for receiving the packet according to whether the packet is received or not and for transmitting the packet to a virtual machine to which a destination address is allocated, and a physical address of one or more virtual machines connected to the first network, And a control information processing unit for generating and storing control information related to a process on the packet based on the relationship between the control information and the control information.

Wherein the control information processing unit is configured to determine whether or not the first virtual machine and the second virtual machine connected to the first network are allocated to the first user and the packet between the physical address of the first virtual machine and the physical address of the second virtual machine It is possible to generate control information that is set to enable transmission and reception.

A firewall information processing unit for generating and storing firewall information arranged in the order of size of an IP address or a subnet mask included in network information to be blocked for processing a packet received from a network different from the first network; . ≪ / RTI >

Wherein the control information processing unit of the control device allocates a physical address of a second virtual machine included in the second node device and sets a physical address of the second virtual machine and a physical address of one or more virtual machines assigned to the first user, The control information according to the relationship between addresses can be generated.

A method of processing a packet of a node device including one or more virtual machines assigned different physical addresses according to an embodiment of the present invention includes receiving the first packet from another node device connected to the first network ; Transmitting, by the node device, a signal requesting control information associated with processing of the first packet to a controller connected to the first network; The node device receiving a response of the signal from the control device and determining whether to receive the packet according to control information contained in a response of the signal; Receiving the packet according to whether the node device receives the packet, and transmitting the packet to a virtual machine to which a destination address is allocated; And generating and storing control information that couples the source address and the destination address of the packet received by the control device to the node device.

The packet processing method of a node device including one or more virtual machines assigned different physical addresses according to an embodiment of the present invention may further include the step of the node device backing up the control information, Does not request control information related to the processing of a packet to the control device when the first node device receives the second packet from the first node device subsequent to the first packet, And transmitting the packet to the virtual machine to which the destination address is allocated.

The requesting of the control information may include requesting the control device for firewall information related to the processing of the third packet when the node device receives the third packet from the terminal device connected to the second network different from the first network Wherein the step of receiving the control information includes receiving a response of the signal from the control device, determining whether to block the packet according to the firewall information included in the response signal of the signal, The transmitting step may receive the packet according to whether the packet is blocked, and may transmit the packet to the virtual machine to which the destination address is allocated.

A computer program according to an embodiment of the present invention may be stored in a medium to execute any one of the methods of processing a packet using a computer according to an embodiment of the present invention.

In addition to this, another method for implementing the present invention, another system, and a computer-readable recording medium for recording a computer program for executing the method are further provided.

Other aspects, features, and advantages other than those described above will become apparent from the following drawings, claims, and the detailed description of the invention.

The present invention can determine whether to receive the packet by receiving control information relating to transmission and reception of packets between one or more node devices including a plurality of virtual machines from the control device.

In addition, the present invention can determine whether to block the packet by receiving firewall information related to blocking of a packet received from a terminal device not connected to the network, from the control device.

In addition, when the node device is to be additionally installed as many as the number of users to be increased, it may not be necessary to add a network device (a switch or the like) for managing the installed node devices through one network.

The present invention also relates to a method and apparatus for dynamically allocating a virtual machine to users in order to share a packet among virtual machines allocated to the same user and allocating a virtual machine assigned to a first user to another user only by changing control information .

1 is a block diagram illustrating an overall system including a network system and a terminal apparatus according to embodiments of the present invention.
2 is a block diagram showing the structure of a control apparatus and a node apparatus.
3 is a block diagram showing the structure of a storage medium of the control apparatus.
4 is a block diagram showing a structure of a storage medium of a node device.
5 is a block diagram showing the structure of a packet control unit.
6 to 7 are diagrams showing a method of processing a packet in a node device.
8 is a diagram showing an example of control information generated by the control apparatus according to the embodiments of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. The effects and features of the present invention and methods of achieving them will be apparent with reference to the embodiments described in detail below with reference to the drawings. However, the present invention is not limited to the embodiments described below, but may be implemented in various forms.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, wherein like reference numerals refer to like or corresponding components throughout the drawings, and a duplicate description thereof will be omitted .

In the following embodiments, the terms first, second, and the like are used for the purpose of distinguishing one element from another element, not the limitative meaning.

In the following examples, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise.

In the following embodiments, terms such as inclusive or possessed mean that a feature or element described in the specification is present, and does not exclude the possibility that one or more other features or components are added in advance.

If certain embodiments are otherwise feasible, the particular process sequence may be performed differently from the sequence described. For example, two processes that are described in succession may be performed substantially concurrently, and may be performed in the reverse order of the order described.

In the following embodiments, the term "circuit" refers to any circuitry, circuitry, and / or circuitry, including, for example, hardwired circuitry, programmable circuitry, state machine circuitry, and / or firmware that stores instructions executed by a programmable circuit, either alone or in any combination . The application may be implemented as code or instructions that may be executed on a programmable circuit, such as a host processor or other programmable circuit. A module, as used in any of the embodiments herein, may be implemented as a circuit. The circuitry may be implemented as an integrated circuit, such as an integrated circuit chip.

In the following embodiments, when a component is referred to as "comprising ", it means that it can include other components as well, without excluding other components unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

1 is a diagram of a network system 10 in accordance with embodiments of the present invention.

Referring to FIG. 1, a network system 10 according to embodiments of the present invention includes a control apparatus 100 and a plurality of node apparatuses 201, 202, and 200 connected to a first network. The network system 10 may be connected to a plurality of terminal devices 401 and 402 (hereinafter referred to as 400) and a second network 300 different from the first network.

The network system 10 is a server connected to the first network and providing a single cloud service, and can provide storage space to a plurality of users. At this time, as the space used by the users is increased, the virtual machines of the physically separated node devices 200 can be set to be assigned to one user, and the virtual machines of the physically separated node devices 200 It is also possible to set the storage area of the user to be shared. In order to perform such a function, conventionally, a switch device for processing and controlling a packet received by the node devices 200 is included, and the node devices 200 managed through the limited resources of the switch device, The number of machines and the number of users were limited. However, the network system 10 according to the embodiments of the present invention does not physically add a switch device for packet processing and control, . In addition, generation and modification of control information may be possible through software setting and storage without changing the setting for the switch device.

In addition, due to the already set virtual machines, redundant control information for a plurality of virtual machines is required when a plurality of virtual machines are allocated to one user due to the increase in storage area. However, the network system 10 according to the embodiments of the present invention can dynamically create a virtual machine in consideration of the size of a region provided to a user, without setting a virtual machine in advance. The control information and / or the firewall information of the network system 10 according to embodiments of the present invention may be generated, changed, or changed by a user who uses the service, .

The control device 100 and the plurality of node devices 200 may include a plurality of virtual machines assigned to a plurality of users. The control device 100 stores and manages control information for operating as one cloud server. Each of the node devices 200 creates one or more virtual machines and assigns the virtual machines to the users. Here, the virtual machines are physically contained in one device, but logically independent devices. A virtual machine may be created by an application or program that creates a virtual machine (such as a drive). To distinguish the virtual machines from each other, the control device 100 assigns physical addresses that are distinguished to each virtual machine. One or more virtual machines assigned to the first user may be included in the physically separate node devices 200. In this case, for smooth data sharing, And controls the node devices 200 so as to transmit and receive packets between the virtual machines.

Conventionally, the number of virtual machines included in each node device connected to the first network is fixed, and one virtual machine has to be allocated to one user. However, the node devices 200 according to the embodiments of the present invention are not fixed but include variously divided virtual machines, and each node device 200 includes a virtual machine . That is, each node device 200 may include virtual machines of various capacities set by the user. In addition, the virtual machines included in the node device 200 include statically managed control information areas as they are allocated to users. In response to a request from the user, the control device 100 generates control information allowing communication between virtual machines not assigned to the same user, thereby enabling communication between virtual machines not assigned to the same users .

The control device 100 controls the processing of packets between a plurality of node devices 200 connected to the first network. To this end, the control device 100 may generate control information for determining whether to receive the packet. Each node device 200 may include one or more virtual machines, and the control device 100 may generate the relationship between the first virtual machine and the second virtual machine included in the different node devices 200 as control information can do. The control device 100 may generate control information that is assigned to the same user and connects physical addresses assigned to the first virtual machine and the second virtual machine, which need sharing of the packet, to each other. Here, the method of connecting the physical addresses may be such that a physical address of the first virtual machine and a part of the physical address of the second virtual machine coincide with each other, and the first virtual machine and the second virtual machine Physical addresses can be created and stored as a single record. The controller 100 may search for and transmit control information related to the address of each node 200 according to a request from each node 200.

The control device 100 controls the processing of the external packet received by the node device 200 from the external terminal device 400. [ To this end, the control apparatus 100 may generate firewall information for determining whether to block the external packet. The control device 100 controls the node device 200 to receive a packet from the external terminal device 400. [ The control device 100 and the node device 200 are connected to a closed network that is not connected to an external network. The control apparatus 100 may specifically refer to a control apparatus to which an open flow technique is applied, and may include a device for storing a flow table and a device for controlling an op-flow packet.

The control device 100 may generate and change control information and / or firewall information through a packet for setting control information and / or firewall information. The control device 100 can generate and change control information and / or firewall information through the packet received from the user terminal device 400. [

Here, the first network plays a role of connecting the controller 100 and the node device 200. That is, the first network refers to a communication network that provides a connection path so that a plurality of node devices 200 can access the control device 100 and then transmit and receive data. The first network may be a wired network such as LANs (Local Area Networks), WANs (Wide Area Networks), MANs (Metropolitan Area Networks), ISDNs (Integrated Service Digital Networks), wireless LANs, CDMA, Bluetooth, Wireless networks, but the scope of the invention is not so limited.

The plurality of node devices 200 may be any type of device capable of communicating with a computer (e.g., a desktop, laptop, tablet, etc.), a media computing platform (e.g., a cable, a satellite set top box, a digital video recorder), a handheld computing device , A PDA, an email client, etc.), any form of mobile phone, or any other type of computing or communication platform, but the invention is not so limited.

The second network 300 plays a role of connecting a plurality of terminal devices 400 to the node device 200. That is, the second network 300 refers to a communication network that provides a connection path so that a plurality of terminal devices 400 can access and transmit data to a plurality of terminal devices 400. The second network 300 may be a wired network such as LANs (Local Area Networks), WANs (Wide Area Networks), MANs (Metropolitan Area Networks), ISDNs (Integrated Service Digital Networks), wireless LANs, CDMA, Communication, and the like, but the scope of the present invention is not limited thereto.

The plurality of terminal devices 400 means a communication terminal that can use a web service in a wired / wireless communication environment. Here, the plurality of terminal devices 400 may be a user's personal computer or a user's portable terminal.

A plurality of terminal devices 400 may be connected to a computer (e.g., a desktop, a laptop, a tablet, etc.), a media computing platform (e.g., a cable, a satellite set- A computing device (e.g., a PDA, an email client, etc.), any form of mobile phone, or any other type of computing or communication platform, although the invention is not so limited.

2 is a block diagram showing the structure of a control apparatus 100 according to the embodiments of the present invention.

Referring to FIG. 2, a control apparatus 100 according to embodiments of the present invention may include a communication interface 110, a processor 120, and a storage medium 130.

The communication interface unit 110 may be a device including hardware and software necessary for transmitting and receiving signals such as control signals or data signals with a plurality of node devices 200 connected to the first network. The communication interface unit 110 can control not to transmit or receive data through the second network other than the first network.

The processor 120 typically controls the overall operation of the control device 100. For example, the processor 120 may control not only the control software installed on the storage medium 130, but also the control information processing unit 131 and the firewall information processing unit 132.

The processor 120 may be, for example, a data processing device embedded in hardware having circuitry physically structured to perform the functions represented by code or instructions contained within the program. As an example of the data processing apparatus built in hardware, a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, an application-specific integrated circuit (ASIC) circuit, and a field programmable gate array (FPGA), but the scope of the present invention is not limited thereto.

The storage medium 130 refers to a storage device included in the control device 100 or electrically connected to the control device 100. The storage medium 130 may store a plurality of modules for operation of the control apparatus 100. [

The storage medium 130 may be a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (for example, SD or XD memory) (Random Access Memory) SRAM (Static Random Access Memory), ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), PROM (Programmable Read-Only Memory) A disk, and / or an optical disk.

3 is a block diagram showing the structure of the control apparatus 100. As shown in Fig.

3, the control apparatus 100 may include a control information processing unit 131 and a firewall information processing unit 132. [

The control information processing unit 131 generates and changes control information for processing packet transmission / reception between the node devices 200 connected to the first network. The control information is information for setting a relationship between one or more virtual machines included in the first network and can be generated using the physical address assigned to identify the virtual machine to the same user. For example, the control information may be generated by connecting two or more physical addresses of a virtual machine assigned to a first user.

The control information processing unit 131 may store and manage MAC / IP information of virtual machines in order to block packets to be attacked by malicious codes, viruses, and the like to the node devices 200. [ The control information processing unit 131 can drop the packet whose network address corresponding to the destination is modulated by using the MAC / IP address of the stored virtual machines. The control information processing unit 131 can automatically check whether communication is possible by comparing the information with the pre-registered modulation packet when the packet having the modulated network address is input. The information associated with the modulation packet may include MAC / IP address information. The control information processing unit 131 may generate and store control information (drop rule) for a packet whose network information is modulated.

The firewall information processing unit 132 generates firewall information for processing packet transmission / reception from the second network 300 received by the node devices 200, and performs a function of changing the firewall information. The firewall information is network information of a packet to be blocked, and may include information related to a packet in which the network information is modulated. Since packets with modulated network information are likely to contain malicious code and / or viruses, it is possible to decide whether to block or not by modulating. In addition, the firewall information may include IP information, a subnet mask, and the like corresponding to a destination of a packet to be blocked. The control device 100 can control the sorting of the respective information items so that the received packets can be more quickly searched for.

The control device 100 according to embodiments of the present invention transmits control information and firewall information related to the processing of a packet to the node device 200 in response to a request from the node devices 200 connected to the first network do. Accordingly, the control apparatus 100 according to the embodiments of the present invention can manage transmission and reception of packets between the node devices 200 connected to the closed network.

4 is a block diagram showing the structure of the node device 200. As shown in Fig.

4, the node device 200 includes a packet control unit 231 for performing a function of receiving or intercepting a packet received through the communication interface unit 210, at least one virtual machine 232a, 232b, 232).

The packet control unit 231 may perform functions such as receiving or intercepting a packet received through the communication interface unit 210 and may perform an error control function for detecting an error of a packet or recovering a detected error have. In addition, the packet control unit 231 may perform a function of controlling a flow to solve a speed difference between a sending apparatus and a receiving apparatus, and may perform a function of synchronizing a packet and a frame. The packet control unit 231 may also function to allow the packet to be successfully transmitted from the first node device 200 as a source to the second node device 200 as a destination. The packet control unit 231 will be described in detail with reference to FIG.

The node device 200 may include one or more virtual machines 232 that are physically one computing device but logically separate. The virtual machine 232 can be created by a manager through a predetermined program or application. Even though the virtual machine 232 included in one node device 200, the one or more virtual machines 232 can be assigned to different physical addresses.

The network system 10 including the control device 100 and the node devices 200 according to the embodiments of the present invention may require more storage space while providing cloud services. In this case, And a process of setting one or more virtual machines in the node device. Providers providing cloud services will create virtual machines that are allocated to users, respectively, to provide storage space for users using cloud services. In addition, the provider providing the cloud service may allocate a plurality of virtual machines assigned to different node devices to one user. 5 is a block diagram showing the structure of the packet control unit 231. [

Referring to FIG. 5, a process of requesting and receiving control information by the packet control unit 231 of the node device 200 according to embodiments of the present invention will be described. The packet control unit 231 may include a reception control unit 2311, a control information request unit 2312, a control information reception unit 2313, a packet processing unit 2314, and a backup unit 2315.

The node device 200 according to the embodiments of the present invention requests the control device 100 connected to the first network with information related to control without processing itself in connection with the processing of the packet upon receiving the packet And determines whether to receive or block the packet according to the information received in response to the request. In the case of node devices that provide a conventional cloud service, network information, for example, a physical address and a subnet mask, which are included in a predetermined range, are allocated to virtual machines allocated to the same user, , The node device 200 according to the embodiments of the present invention receives and processes control information from the control device 100 so that packets can be shared with each other. Thus, the node device 200 can dynamically allocate the virtual machine to the users. More specifically, the control device 100 can change the control information for the virtual machine, thereby allocating the virtual machine assigned to the first user to a user other than the first user.

The reception control unit 2311 determines whether the source apparatus of the packet is connected to the first network or a network other than the first network in consideration of the source IP address included in the packet received through the communication interface unit 210 It is possible to judge whether or not it is connected.

The information request unit 2312 generates a first signal for requesting control information when the received packet is received from the node device 200 connected to the first network and transmits the first signal to the control device 100 do.

When the received packet is received from the terminal device 400 that is not connected to the first network, the information requesting unit 2312 generates a second signal for requesting firewall information, and transmits the second signal to the control device .

The information receiving unit 2313 receives control information or firewall information related to the received packet from the control device 100. [

The packet processing unit 2314 determines whether to receive the received packet according to the control information received through the information receiving unit 2313, and receives the packet according to whether the received packet is received. The packet processor 2314 blocks the received packet according to the firewall information received through the information receiver 2313.

The backup unit 2315 performs a function of backing up and storing control information or firewall information for a packet received through the information receiving unit 2313. [ Through the backup unit 2315, the node device 200 according to the embodiments of the present invention transmits a signal requesting control information or firewall information for processing a packet received from the same source apparatus as the previously received packet There is no need to transmit redundantly. The node device 200 according to the embodiments of the present invention receives or blocks the current packet in the same way as the previously received packet.

6 to 7 are flowcharts of a packet processing method according to embodiments of the present invention.

The flow chart of Figure 6 is for a method of processing packets between node devices connected to a first network. When the first node device 201 transmits the first packet to the second node device 202 (S601), that is, when the packet from the first node device 201 connected to the first network device 201 to the second node device 202 When transmission / reception occurs, the second node device 202 as a destination transmits a signal for requesting control information to the control device 100 for processing the first packet (S602). The controller 100 searches the control information based on the source address and the destination address included in the signal for requesting the control information for the first packet, and when the retrieved control information exists, (Step S603). And the second node device 202 receives the first packet according to the control information. More specifically, the second node device 202 receives the first packet if there is control information for the first packet, or receives the first packet if the control information does not exist . Or the second node device 202 analyzes the physical addresses included in the control information for the first packet to determine whether the virtual machines 232 corresponding to the source address and the destination address of the first packet are allocated to the same user Whether the first packet is received or not can be determined based on whether the first packet is received (S604). That is, the second node device 202 analyzes the physical addresses included in the control information for the first packet to determine whether the virtual machines 232 corresponding to the source address and the destination address of the first packet are the same user or share When the first packet is allocated to a user having a space to be used for the first packet. Or the control information may include whether or not the first packet is modulated. The node devices 200 may determine whether to modulate based on the network information of the first packet. By acquiring the network information in which the modulation packet is generated from the control apparatus 100, the node devices 200 can determine whether to drop the packet. Subsequent to step S604, the control device 100 generates or modifies control information associated with the processing of the first packet. That is, the control device 100 generates and stores control information in which the source address and the destination address of the first packet are coupled in pairs.

The flowchart of FIG. 7 is for a method in which a node device 200 processes a packet received from a terminal device 400 connected to a network rather than a first network.

When the terminal device 400 transmits a second packet to the node device 200 (S701), the receiving node device 200 generates a signal for inquiring firewall information for the second packet, (S702). The control device 100 searches for firewall information based on the network information corresponding to the terminal device 400 serving as the second packet transmission device and transmits the network information of the terminal device 400, If there is firewall information corresponding to at least one of the network information, the mask, and the physical address, the firewall information is transmitted to the node device 200 (S703). The node device 200 blocks the second packet according to the received firewall information (S704). In step S704, the controller 100 generates or modifies firewall information related to the processing of the second packet. That is, the control apparatus 100 can generate and store network information of the second packet as firewall information. 8 is a view for explaining dynamic allocation of a virtual machine of a network system according to embodiments of the present invention.

A first node device 201, a second node device 202, and a third node device 203, as shown in Fig. 8, and includes a control device 100, a first node device 201, a second node device 202, Assume that there is a network system 10 that provides services. Here, the first node device 201 includes a first virtual machine VM1, a second virtual machine VM2, a third virtual machine VM3, and the second node device 202 includes a fourth virtual machine VM4), and the third node device 203 includes a fifth virtual machine VM5 and a sixth virtual machine VM6. The first virtual machine VM1 and the fourth virtual machine VM4 are assigned to the first user and the second virtual machine VM2 is assigned to the second user and the third virtual machine VM3 , The control device 100 generates control information FC1 for connecting the physical address (VM1_phy_addr) of the first virtual machine and the physical address (VM4_phy_addr) of the fourth virtual machine allocated to the first user Storage management. In this way, the number of virtual machines allocated to the node devices 200 included in the network system 10 may be different from each other. While the node devices included in the conventional network system have a fixed number of virtual machines, the network system 10 according to the embodiments of the present invention additionally includes an unallocated area existing in each of the node devices 200 You can create virtual machines without restrictions.

Since the network system 10 according to the embodiments of the present invention can add virtual machines or allocate them to other users in a manner that only the control information of the control device 100 is changed or newly added, After that, the fifth virtual machine VM5 can be assigned to the first user and the sixth virtual machine VM6 can be assigned to the third user. C2, the control device 100 controls the first virtual machine VM1 and the fourth virtual machine VM4 to connect with the fifth virtual machine VM5 allocated to the first user 1 control information for connecting the physical addresses between the first virtual machine VM1 and the fifth virtual machine VM5 and control information FC2 for connecting physical addresses between the fourth virtual machine VM4 and the fifth virtual machine VM5 Can be generated. In addition, the control device 100 is connected between the third virtual machine VM3 and the sixth virtual machine VM6 so as to be able to connect the third virtual machine VM3 to the sixth virtual machine VM6 allocated to the third user. Lt; RTI ID = 0.0 > FC3 < / RTI >

The embodiments of the present invention described above can be embodied in the form of a computer program that can be executed on various components on a computer, and the computer program can be recorded on a computer-readable medium. At this time, the medium may be a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, an optical recording medium such as CD-ROM and DVD, a magneto-optical medium such as a floptical disk, , A RAM, a flash memory, and the like, which are specifically configured to store and execute program instructions. Further, the medium may include an intangible medium that is implemented in a form that can be transmitted over a network, and may be, for example, a medium in the form of software or an application, which can be transmitted and distributed through a network.

Meanwhile, the computer program may be specifically designed and configured for the present invention or may be known and used by those skilled in the computer software field. Examples of computer programs may include machine language code such as those produced by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like.

The specific acts described in the present invention are, by way of example, not intended to limit the scope of the invention in any way. For brevity of description, descriptions of conventional electronic configurations, control systems, software, and other functional aspects of such systems may be omitted. Also, the connections or connecting members of the lines between the components shown in the figures are illustrative of functional connections and / or physical or circuit connections, which may be replaced or additionally provided by a variety of functional connections, physical Connection, or circuit connections. Also, unless explicitly mentioned, such as "essential "," importantly ", etc., it may not be a necessary component for application of the present invention.

The use of the terms "above" and similar indication words in the specification of the present invention (particularly in the claims) may refer to both singular and plural. In addition, in the present invention, when a range is described, it includes the invention to which the individual values belonging to the above range are applied (unless there is contradiction thereto), and each individual value constituting the above range is described in the detailed description of the invention The same. Finally, the steps may be performed in any suitable order, unless explicitly stated or contrary to the description of the steps constituting the method according to the invention. The present invention is not necessarily limited to the order of description of the above steps. The use of all examples or exemplary language (e.g., etc.) in this invention is for the purpose of describing the present invention only in detail and is not to be limited by the scope of the claims, It is not. It will also be appreciated by those skilled in the art that various modifications, combinations, and alterations may be made depending on design criteria and factors within the scope of the appended claims or equivalents thereof.

10: Network system
100: Control device
200: Node device
300: Second network
400: terminal device

Claims (11)

A node device comprising one or more virtual machines assigned different physical addresses,
A packet receiver for receiving a first packet from a first node device connected to a first network;
A control information requesting unit for transmitting a signal requesting control information associated with the processing of the first packet to a control apparatus connected to the first network;
A control information receiving unit that receives a response of the signal from the control device and determines whether to receive the packet according to control information included in a response of the signal;
And a packet processor for receiving the packet according to whether the packet is received or not, and for transmitting the packet to a virtual machine to which a destination address is allocated.
The method according to claim 1,
And a backup unit for backing up the control information,
The packet processing unit
Wherein when the second packet is received from the first node device in succession to the first packet by the packet receiving unit, the control information is not requested to the control device according to the control information stored in the backup unit, And transmits the second packet to the virtual machine to which the destination address is assigned.
The method according to claim 1,
The control information requesting unit
When the third packet is received from the terminal device connected to the second network different from the first network by the packet receiving unit, transmits a signal requesting the control device for firewall information related to the processing of the third packet,
The control information receiver
Receiving a response of the signal from the control device, determining whether to block the packet according to the firewall information included in the response signal of the signal,
The packet processing unit
Receives the packet according to whether the packet is blocked or not, and transmits the packet to a virtual machine to which a destination address is allocated.
A packet receiving unit for receiving a first packet from a first node device connected to a first network, the packet receiving unit including a plurality of virtual machines assigned different physical addresses;
A control information requesting unit for transmitting a signal requesting control information associated with the processing of the first packet to a control apparatus connected to the first network;
A control information receiving unit that receives a response of the signal from the control device and determines whether to receive the packet according to control information included in a response of the signal;
And a packet processing unit for receiving the packet according to whether the packet is received and for transmitting the packet to a virtual machine to which a destination address is assigned,
And a control information processor for generating and storing control information related to a process for a packet based on a relation between physical addresses of one or more virtual machines connected to the first network.
5. The method of claim 4,
The control information processing unit
When a first virtual machine and a second virtual machine connected to the first network are assigned to a first user, transmission and reception of packets between the physical address of the first virtual machine and the physical address of the second virtual machine are enabled And generates the control information.
5. The method of claim 4,
The control device
And a firewall information processor for generating and storing firewall information arranged in the order of size of an IP address or a subnet mask included in network information to be blocked for processing packets received from a network different from the first network, Network system.
6. The method of claim 5,
The control information processing unit of the control device
Assigning a physical address of a second virtual machine included in the second node device and assigning control information according to a relationship between a physical address of the second virtual machine and a physical address of one or more virtual machines assigned to the first user Creating, network system.
A packet processing method of a node device including one or more virtual machines assigned different physical addresses,
The node device receiving a first packet from another node device connected to the first network;
Transmitting, by the node device, a signal requesting control information associated with processing of the first packet to a controller connected to the first network;
The node device receiving a response of the signal from the control device and determining whether to receive the packet according to control information contained in a response of the signal;
Receiving the packet according to whether the node device receives the packet, and transmitting the packet to a virtual machine to which a destination address is allocated;
Generating and storing control information that couples the source address and the destination address of the packet received by the control device to the node device;
/ RTI >
9. The method of claim 8,
Further comprising the step of the node device backing up the control information,
Wherein when the node device receives the second packet from the first node device subsequent to the first packet, the control device does not request control information related to the processing of the packet to the control device, And sending the second packet to a virtual machine to which a destination address is assigned.
9. The method of claim 8,
The step of requesting the control information
When the node device receives the third packet from the terminal device connected to the second network different from the first network, transmits a signal requesting the control device for firewall information related to the processing of the third packet,
The step of receiving the control information
Receiving a response of the signal from the control device, determining whether to block the packet according to the firewall information included in the response signal of the signal,
The step of transmitting to the virtual machine
Receiving the packet according to whether the packet is blocked, and transmitting the packet to a virtual machine to which a destination address is allocated.
A computer program stored on a medium for carrying out the method of any one of claims 8 to 10 using a computer.

Images