KR20180129376A - Smart gateway supporting iot and realtime traffic shaping method for the same - Google Patents

Abstract

An IoT gateway smart gateway according to an embodiment of the present invention includes multiple queues which temporarily buffer inbound or outbound packets in a virtual private network (VPN) tunneling interval for connecting a remote network through a VPN, and output them according to a predefined priority; a monitoring part which monitors and analyzes a network state including a traffic load on the VPN tunneling interval and a traffic load on each queuing of the multiple queues; and a packet allocation part which adaptively allocates the inbound or outbound packets to the multiple queues based on the analysis result of the network state and controls the traffic of the VPN tunneling interval. It is possible to support stable and seamless IoT connection.

Description

TECHNICAL FIELD [0001] The present invention relates to an Internet-enabled smart gateway and a VPN tunneling method for real-

Embodiments of the present invention relate to a VPN tunneling real-time speed control method for a smart Internet gateway supporting a Smart Internet and a Smart Internet Gateway.

In recent years, a variety of service technologies based on information communication such as cloud, smart device, and Internet have been rapidly developed. Platform technologies such as routers, smart gateways, switches, and firewalls, which are necessary for this, are also developing. The development of this information and communication technology can overcome the time and space limitations of using smart devices and can keep doing what they are doing in office, home, school, outside, It becomes possible to provide a network environment.

The technology that can configure multiple remote networks into one local network can be implemented with well-known network-to-network VPN (Virtual Private Network) equipment. In the case of commercial VPN equipment, it has evolved to provide intelligent firewall such as IDS (Intrusion Detection System) and IPS (Intrusion Protection System), QoS (Quality of Service) technology, multi-line support, load balancing (Load Balancing) and so on.

However, in the case of commercial VPN equipment, it is utilized as a specialist support in a private line environment constructed with a high-performance product, and it is difficult to guarantee inter-device compatibility due to the characteristics of technology by expensive dedicated equipment. In addition, since VPN tunneling technology requires a high introduction cost and a stable and expensive dedicated line, it is difficult to operate in an Internet environment used in general households or corporations.

In order to secure this, a router supporting the network-to-network VPN has been developed in the general internet environment. However, most of them provide only the function of the VPN server so that the network-to-network VPN connection is not possible. The usability is poor, and the devices to be supported are limited. In addition, VPN tunneling speed is only 5Mbps, commercial VPN dedicated equipment is not economical to popularize, and there is a problem that the line condition such as leased line must be guaranteed to operate.

Related Prior Art Korean Patent Application No. 10-2004-0039909 entitled " Method for improving communication quality in virtual private network using transmission layer tunneling, public date: 2004.05.12. &Quot;

According to an embodiment of the present invention, a CPU load, a packet drop rate, and a queuing priority are applied to a real-time traffic shaping algorithm of VPN tunneling to implement a smart gateway capable of supporting stable and seamless Internet connection even in low- And its VPN tunneling real time speed control method.

The problems to be solved by the present invention are not limited to the above-mentioned problem (s), and another problem (s) not mentioned can be clearly understood by those skilled in the art from the following description.

The Internet gateway smart gateway according to an embodiment of the present invention temporarily buffers inbound or outbound packets in a VPN tunneling interval for connecting a remote network through a virtual private network (VPN) Multiple queues to output; A monitoring unit monitoring and analyzing a network state including a traffic load on the VPN tunneling interval and a traffic load on each queuing of the multiple queues; And a packet allocation unit for adaptively allocating the inbound or outbound packet to the multiple queues based on the analysis result of the network state to control the traffic of the VPN tunneling period.

Wherein the monitoring unit calculates a traffic load for each queuing based on a drop rate for each queuing and a bandwidth allocated for each queuing, and calculates a traffic load on the VPN tunneling interval based on the traffic load for each queuing, Loads can be monitored and analyzed.

The packet allocator finds queuing with a relatively small load during multi queuing based on the traffic load for each queuing to reduce the bandwidth and further allocates a bandwidth to another queuing having a relatively high load to transmit the traffic of the VPN tunneling period Can be controlled.

Wherein the monitoring unit calculates a load of the VPN tunneling daemon based on the CPU usage time of the entire system and the usage time of the VPN tunneling daemon to calculate a load of the CPU used in the VPN tunneling, You can monitor and analyze the traffic load on the VPN tunneling section.

The monitoring unit may calculate a CPU usage time for the entire system and a usage time of the VPN tunneling daemon at a predetermined time interval based on Equation (1) below to calculate a CPU load used for VPN tunneling.

[Equation 1]

Where utime is the user mode jiffies, utime_before and utime_after are the time before and after the user mode is generated, user_util is the CPU usage time of the entire system, and stime is the kernel mode jiffies), stime_before, and stime_after are the time before and after the kernel mode delay occurs, and sys_util is the time of kernel mode usage.

The packet allocator selects a traffic shaping algorithm that matches the network condition based on the load of the CPU and allocates the packet to the multiple queues using the selected traffic shaping algorithm to control the traffic of the VPN tunneling interval have.

The monitoring unit may calculate a total packet drop rate based on packet information of the VPN tunneling device and monitor and analyze a traffic load on the VPN tunneling period based on the total packet drop rate.

The monitoring unit may calculate the total packet drop rate by calculating packet information of the VPN tunneling device at a predetermined time interval based on Equation (2).

&Quot; (2) "

Where rx_drop is the number of dropped packets on the transmitting side of the VPN tunneling device, tx_drop is the number of dropped packets on the receiving side of the VPN tunneling device, rx_pkt_tot is the number of transmitting packets on the VPN tunneling device, tx_pkt_tot is the number of dropped packets on the VPN tunneling device Lt; / RTI >

The packet allocator selects a traffic shaping algorithm that matches the network condition based on the total packet drop rate and allocates the packet to the multiple queues using the selected traffic shaping algorithm to control traffic in the VPN tunneling interval have.

The packet assigning unit may classify the packets according to service ports and IP addresses, and adaptively allocate the divided packets to the multiple queues based on an analysis result of the network state.

The smart gateway supporting the Internet of objects according to an embodiment of the present invention may further include a queue controller for adjusting or changing at least one of the number, priority, and bandwidth of the multiple queues.

Wherein the multiple queues have a type of service (ToS) and a queue having SFQ (Stochastic Fair Queuing) logic for outputting packets according to a priority order; And a queue with Hierarchical Token Bucket (HTB) logic that limits the effective or maximum rate of the packet through bandwidth throttling.

The multiple queues may multi-queue the packet based on the SFQ logic or the HTB logic.

The VPN tunneling real-time rate control method of the Internet-enabled smart gateway according to an embodiment of the present invention includes a traffic load on a VPN tunneling period for connecting a remote network through a virtual private network (VPN) Monitoring or analyzing a network state including a traffic load for each queuing of multiple queues buffering outbound packets for a while and outputting according to a predefined priority; And controlling the traffic of the VPN tunneling period by adaptively allocating the inbound or outbound packets to the multiple queues based on the analysis result of the network status.

Wherein the step of monitoring and analyzing the network status comprises: calculating a traffic load for each queuing based on a drop rate for each queuing and a bandwidth allocated for each queuing; And monitoring and analyzing a traffic load on the VPN tunneling period based on the traffic load for each queuing.

The step of controlling the traffic of the VPN tunneling interval may include a step of finding a queuing having a relatively small load during multiple queuing based on the traffic load for each queuing to reduce a bandwidth of the queuing; And controlling the traffic of the VPN tunneling period by further allocating a bandwidth to another queuing having a relatively large load.

Wherein the step of monitoring and analyzing the network status comprises: calculating a load of the CPU used in the VPN tunneling by calculating a load of the VPN tunneling daemon based on a CPU usage time of the entire system and a usage time of the VPN tunneling daemon; And monitoring and analyzing a traffic load on the VPN tunneling period based on the load of the CPU.

Wherein monitoring and analyzing the network conditions comprises: calculating an overall packet drop rate based on packet information of the VPN tunneling device; And monitoring and analyzing the traffic load on the VPN tunneling interval based on the overall packet drop rate.

The details of other embodiments are included in the detailed description and the accompanying drawings.

According to an embodiment of the present invention, the CPU load, the packet drop rate, and the queuing priority are applied to the real-time traffic shaping algorithm of the VPN tunneling, so that it is possible to support stable and smooth Internet connection even in low-quality Internet .

According to an embodiment of the present invention, it is possible to efficiently calculate the multi-queuing bandwidth and to change the multi-queuing internal traffic to an optimum state in real time. That is, it can be operated in an optimal state without a pre-designed multi-queuing scenario.

According to an embodiment of the present invention, a speed control error generated by simply applying a predetermined queuing algorithm can be prevented, and real-time queuing and related queuing can be controlled in detail.

FIG. 1 is a diagram illustrating a network configuration of a smart Internet gateway supporting objects according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 2 is a block diagram illustrating an Internet gateway smart gateway according to an embodiment of the present invention. Referring to FIG.
3 is a diagram showing an example of remote control monitoring.
4 is a diagram illustrating an example of traffic shaping through multiple queuing for a VPN tunnel.
FIG. 5 is a table showing performance analysis results between a system to which traffic shaping is applied and an existing system according to an embodiment of the present invention.
6 to 9 are flowcharts for explaining a VPN tunneling real time speed control method of a smart gateway supporting object Internet according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and / or features of the present invention, and how to accomplish them, will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. It should be understood, however, that the invention is not limited to the disclosed embodiments, but is capable of many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. The configuration is omitted as much as possible, and a functional configuration that should be additionally provided for the present invention is mainly described. Those skilled in the art will readily understand the functions of components that have been used in the prior art among the functional configurations that are not shown in the following description, The relationship between the elements and the components added for the present invention will also be clearly understood.

In the following description, terms such as "transmission", "communication", "transmission", "reception", and the like of a signal or information means that a signal or information is directly transmitted from one component to another As well as being transmitted via other components. In particular, "transmitting" or "transmitting" a signal or information to an element is indicative of the final destination of the signal or information and not a direct destination. This is the same for "reception" of a signal or information.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating a network configuration of a smart Internet gateway supporting objects according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIG. 1, a smart Internet gateway 100 according to an exemplary embodiment of the present invention includes a remote network (office, remote site) physically separated from a remote location by using a virtual network VPN system, it is possible to maintain the optimal tunneling speed during VPN tunneling and to provide excellent Internet line quality.

Here, the VPN system may be connected through two gateways 110 and 120 between two private networks (offices, remote sites). Two private networks (office, remote) are separated from each other by the Internet and can not transmit traffic to each other because of difficult access to the outside world.

However, since the gateways 110 and 120 for transmitting traffic to the Internet can be connected to the private network (office, remote site), and each gateway 110 and 120 has a public IP, , A remote site) can be connected through the gateways 110 and 120. [

At this time, a bridge or a routing connection can be established through a VPN in a tunneling period between the gateways 110 and 120. For reference, the gateway 110 is an OpenVPN Server Access Gateway, and the Gateway 120 may be an OpenVPN Client Gateway.

When the bridge system is connected, the VPN system does not require routing between two networks, and has the same address system. Since the VPN system operates as the same network, it can exchange Ethernet packets and access all equipment. Therefore, a program running on the same network, such as DLNA (Digital Living Network Alliance) or Intranet, can be used as it is.

When connected by the routing scheme, the VPN system can be used by explicitly setting routing because all devices have different address systems and operate like other networks.

The VPN system can control the operation of the OpenVPN Client Gateway 120 through the OpenVPN Client Gateway control system 130. The Smart Internet gateway 100 according to an embodiment of the present invention may include the OpenVPN Client Gateway 120 and the OpenVPN Client Gateway control system 130.

The OpenVPN Client Gateway control system 130 may include the OpenVPN Client Gateway 120 or may be implemented separately from the OpenVPN Client Gateway 120. When the OpenVPN Client Gateway 120 is implemented as a wireless router, the OpenVPN Client Gateway control system 130 may be installed in a wireless router as an application program.

The Internet gateway 100 supports the VPN tunneling period in multiple queuing and when the packet is transmitted through the multi-queuing, the OpenVPN Client Gateway control system 130 is controlled according to the network conditions It is possible to adaptively allocate a packet to perform traffic shaping.

For example, according to an embodiment of the present invention, a DLNA (Digital Living Network Alliance) video stream may be streamed through the multi-queuing in the VPN tunneling period, while a file transfer protocol (ftp) Shell) connection smoothly.

For reference, the traffic shaping refers to a method of smoothly limiting / shaping a traffic flow, and is a traffic control management technique for preventing traffic congestion by adjusting the amount and speed of traffic flowing into or out of a network.

Although the OpenVPN Client Gateway control system 130 is shown only as controlling the OpenVPN Client Gateway 120 on the client side as shown in the drawing, the OpenVPN Client Gateway control system 130 may be implemented on the server side OpenVPN Server Access Gateway 110 side And can be applied to both inbound and outbound packet transmission.

Meanwhile, the Internet-enabled smart gateway 100 according to an embodiment of the present invention can securely connect to the sensor network equipments in a bidirectional manner by using a VPN to securely connect to the network of the office as a virtual network.

As shown in FIG. 3, the VPN tunneling thus implemented can be controlled and monitored by connecting the sensor network device of the office through the web through the PC or smart phone screen of the remote site. Looking at the camera, you can safely control the sensor network devices as if they were right next to you. 3 is a diagram showing an example of remote control monitoring.

FIG. 2 is a block diagram illustrating an Internet gateway smart gateway according to an embodiment of the present invention. Referring to FIG.

2, the Internet-enabled smart gateway 100 includes a plurality of queues 210, a queue control unit 220, a packet allocation unit 230, and a monitoring unit 240 can do.

The multiple queues 210 may temporarily buffer inbound or outbound packets in a VPN tunneling interval for connecting a remote network through a virtual private network (VPN), and output the buffered packets according to a predetermined priority order. In other words, the multi-queue 210 serves as a buffer for temporarily buffering a packet and outputting a packet according to a predefined traffic control rule.

The multiple queues 210 may not be a memory space for storing actual packets, but may have pointer information continuously indicating a location of a memory in which packets are waiting. Queuing refers to the operation of arranging the pointer addresses of the packets waiting to be transmitted to the outbound or inbound interface using the multiple queues 310 according to the predefined scheduling.

The multi-queue 210 includes a queue having ToS (Type of Service) and a Stochastic Fair Queuing (SFQ) logic for outputting packets according to a priority, and a queue having an HTB Lt; RTI ID = 0.0 > (Hierarchical Token Bucket) < / RTI > logic.

The multiple queues 210 may multi-queue packets that are inbound or outbound in the VPN tunneling interval based on the SFQ logic or the HTB logic.

The queue control unit 220 may adjust or change at least one of the number, priority, and bandwidth of the multiple queues 210. To this end, the queue controller 220 may control the multiple queues 210 using the SFQ logic and / or the HTB logic.

That is, the queue control unit 220 may control the number, priority, bandwidth, and the like of the multiple queues 210 according to the network state or occupancy rate of system resources. Here, although the number of the multiple queues 210 increases, the packet transmission rate is excellent and the packet drop rate is low. However, the buffering delay increases and the system load increases. Therefore, the queue control unit 220 can control optimal multi-queuing according to the network state or the occupancy rate of system resources.

The queue control unit 220 may divide the multiple queues 210 into individual queues according to service ports and IP addresses, and may adjust the priority or bandwidth of the individual queues. Here, the service port may include a port connected through the ftp, htb, ssh, telnet, www, tcmp protocols.

Through the operation of the queue control unit 220, the priority according to the ToS and the QoS can be assigned to the multiple queues 210. However, it is also possible to assign priority to each queue arranged for each IP address and service port And the bandwidth of each queue can also be set and changed according to the network status, system resource occupancy, and the like.

The packet allocating unit 230 may adaptively allocate the inbound or outbound packet to the multi-queue 210 based on the analysis result of the network state by the monitoring unit 240, which will be described later, The traffic of the VPN tunneling period can be controlled.

In addition, the packet allocating unit 230 can allocate the packets by service port and IP address. That is, the packet assigning unit 230 may classify the packets according to service ports and IP addresses, and adaptively allocate the classified packets to the multiple queues based on the analysis result of the network state.

In this case, the network status of the VPN tunneling period may be analyzed through the monitoring unit 340. The packet allocating unit 230 may be configured to perform an optimal traffic shaping algorithm And may allocate a packet according to the selected traffic shaping algorithm.

The packet allocator 230 may perform the selection of the traffic shaping algorithm every time packet allocation is required, but may be performed at a predetermined period of time to analyze the network status in the monitoring unit 240 regardless of the packet allocation time And to operate with the selected traffic shaping algorithm during the period.

The traffic shaping algorithm can be variously shaped according to multiple queuing. The traffic shaping algorithm can be used to control inbound and outbound traffic levels used by IDCs (Internet Data Centers), traffic control for each service port, IP address, IP network, or ether packet level Can be implemented. Also, since the traffic shaping algorithm can implement packet inspection used in TAP (Test Access Port) equipment through packet queuing, it is possible to control the traffic against the increasingly intelligent hacking attacks.

The monitoring unit 240 can monitor and analyze a network state including a traffic load on the VPN tunneling interval and a traffic load on each queuing of the multiple queues.

For this, the monitoring unit 240 calculates the load of the VPN tunneling daemon based on the CPU usage time of the entire system and the usage time of the VPN tunneling daemon, and calculates the load of the CPU used for the VPN tunneling And monitor and analyze the traffic load on the VPN tunneling period based on the load of the CPU.

At this time, the monitoring unit 240 calculates the CPU usage time for the entire system and the usage time of the VPN tunneling daemon at intervals of a predetermined time (1 second to 10 seconds) based on Equation (1) It is possible to calculate the load of the CPU to be used.

[Equation 1]

Where utime is the user mode jiffies, utime_before and utime_after are the time before and after the user mode is generated, user_util is the CPU usage time of the entire system, and stime is the kernel mode jiffies), stime_before, and stime_after are the time before and after the kernel mode delay occurs, and sys_util is the time of kernel mode usage.

Accordingly, the packet allocator 230 selects a traffic shaping algorithm suitable for the network condition based on the load of the CPU, allocates the packet to the multiple queues using the selected traffic shaping algorithm, The traffic of the interval can be controlled.

In another embodiment, the monitoring unit 240 calculates a total packet drop rate based on packet information of the VPN tunneling device, monitors a traffic load on the VPN tunneling period based on the total packet drop rate Can be analyzed.

At this time, the monitoring unit 240 may calculate the total packet drop rate by calculating packet information of the VPN tunneling device at intervals of a predetermined time (1 second to 10 seconds) based on Equation (2).

&Quot; (2) "

Where rx_drop is the number of dropped packets on the transmitting side of the VPN tunneling device, tx_drop is the number of dropped packets on the receiving side of the VPN tunneling device, rx_pkt_tot is the number of transmitting packets on the VPN tunneling device, tx_pkt_tot is the number of dropped packets on the VPN tunneling device Lt; / RTI >

Accordingly, the packet allocating unit 230 selects a traffic shaping algorithm according to the network condition based on the total packet drop rate, allocates the packet to the multiple queues using the selected traffic shaping algorithm, The traffic of the interval can be controlled.

In yet another embodiment, the monitoring unit 240 may calculate the traffic load for each queuing based on the drop rate for each queuing and the bandwidth allocated for each queuing, The traffic load on the VPN tunneling period can be monitored and analyzed.

Accordingly, the packet allocating unit 230 finds queuing having a relatively small load during multiple queuing based on the traffic load for each queuing to reduce the bandwidth, and further allocates a bandwidth to another queuing having a relatively large load The traffic of the VPN tunneling period can be controlled.

That is, when the packet amount and the drop amount are calculated for each queuing in the multi-queuing through the monitoring unit 240, the packet allocating unit 230 searches for the traffic induced queuing based on the calculation result, Can be controlled to be optimized.

The CPU load and the packet drop rate described above in Equations 1 and 2 are calculated by the Linux kernel with real-time system information. That is, it calculates the network traffic load without additional load.

Here, the packet drop rate is a drop of all the packets of all kinds. The problem here is that the network packet is overloaded, but it is dropping due to some services.

To solve this problem, the network traffic is multi-queued for each detailed service, and the packet drop per each queuing, that is, the service is grasped to determine which service is larger than the designated queuing width. That is, by calculating the packet drop per queuing and calculating the allocated queuing bandwidth, the load can be calculated in detail for each service.

These calculations are possible in real time per queuing. Based on this, it is possible to find a queuing having a small load among a plurality of queuing to reduce the bandwidth, and to allocate more bandwidth to the queuing having a heavy load.

This method has the same advantage of not adding an additional load when measuring the network load with only a full packet drop rate, and it is a way to find out what kind of service packet is the cause.

Therefore, according to the above method, the multi-queuing internal traffic can be calculated in detail in real time, thereby efficiently changing the multi-queuing bandwidth to an optimal state in real time. That is, it can be operated in an optimal state without a pre-designed multi-queuing scenario. In other words, it is possible to prevent speed control errors caused by simply applying a predetermined queuing algorithm and to control in detail real-time queuing and related queuing.

4 is a diagram illustrating an example of traffic shaping through multiple queuing for a VPN tunnel.

ToS, QoS, most wired and wireless gateways operate in single queuing. QoS can be controlled based on ToS, so performance improvement can be expected to some extent, but problems occur when there are multiple service types of the same ToS. A way to solve this is the multi-queuing support kernel.

In order to support multi-queuing, the kernel kernel must be modified to support CBQ, SFQ, etc. in the network kernel of OS. Therefore, it is desirable to apply appropriate tuning technology to guarantee stability and performance.

In one embodiment of the present invention, the kernel can be modified to support multi-queuing and tunneling optimized for sensor control and VPN access, and a program can be implemented. In addition, SFQ and HTB queues having different characteristics can be configured, and each queue can be assigned to each service port and each IP address to operate.

Particularly, although there is a priority according to ToS and QoS, it is possible to assign priority to each queue arranged according to IP and service port so as to excel in sensor control and VPN tunneling. Can be specified.

Specifically, referring to FIG. 4, first, an HTB qdisc is assigned to tap0 as a handle 1: name, and all default packets are transmitted as 1:20. Class 1: 20 sends packets through the SFQ qdisc 20: queue. Class 1: 1 classifies packets by service port and IP address. By classifying packets by service port (ssh, ftp, telnet) 192.168.2.118, 192.168.2.248, 192.168.2.200, 192.162.2.110, 192.168.2.112,113,119,120,121) to the queue matched with each class. Each class performs multiple queuing according to the priority set by service port and IP address.

Here, an example is shown in which multiple queuing is performed with the highest priority only for the ssh connected service port and specific IP addresses (192.168.2.112,113,119,120,121), and multi-queuing is performed with the lowest priority for the ftp connection.

According to traffic shaping according to an exemplary embodiment of the present invention, a traffic shaping algorithm that performs a desired operation according to a varying network situation is implemented, and an appropriate algorithm is selected according to a network situation Can be executed.

FIG. 5 is a table showing performance analysis results between a system to which traffic shaping is applied and an existing system according to an embodiment of the present invention.

As shown in FIG. 5, the results of this study show that the performance of the present invention is superior to that of the H / W equipments of the related art in all fields, and the performance, compatibility, and excellent performance in traffic shaping . In particular, multi-queuing real-time traffic shaping technology can be applied to general Internet line instead of leased line.

The performance of this study can be considered in two ways.

First, through quantitative performance enhancement, kernel tuning and VPN tunneling algorithm optimization can measure performance improvement over 3 times compared with H / W of same class.

Second, it is a qualitative improvement. According to real-time network situation, the priority and speed applied to multi-queuing are adjusted to individual queuing (service-specific), so that the total speed is the same but the more the priority is allocated according to the priority, Distribution is possible.

Particularly, in the case of a smart gateway supporting the Internet of things according to an embodiment of the present invention, performance is improved so that the performance can be improved so that the priorities are increased for object Internet related packet queuing rather than other services.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, controller, arithmetic logic unit (ALU), digital signal processor, microcomputer, field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing apparatus may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

6 to 9 are flowcharts for explaining a VPN tunneling real time speed control method of a smart gateway supporting object Internet according to an embodiment of the present invention.

The VPN tunneling real-time rate control method described herein is only one embodiment of the present invention. In addition, various steps may be added according to need, and the following steps may also be performed by changing the order. Is not limited to each step and the order described below.

Referring first to FIG. 6, in step 610, the smart gateway may monitor and analyze network conditions including traffic load on a VPN tunneling interval and traffic load for each queuing of multiple queues.

7, the smart gateway calculates a drop rate for each of the queues and a bandwidth allocated for each queuing (710), and calculates a drop rate for each queuing and a drop rate for each queuing, The traffic load for each queuing may be calculated based on the bandwidth allocated for each queuing (720). Then, the smart gateway may monitor and analyze the traffic load on the VPN tunneling period based on the traffic load for each queuing (730).

8, the smart gateway calculates a load of the VPN tunneling daemon based on the CPU usage time of the entire system and the usage time of the VPN tunneling daemon (810), and the VPN tunneling A load of the CPU used in the VPN tunneling may be calculated based on the load of the daemon (820). Then, the smart gateway may monitor and analyze 830 the traffic load on the VPN tunneling period based on the load of the CPU.

In another embodiment, the smart gateway calculates (910) an overall packet drop rate based on packet information of a VPN tunneling device, as shown in FIG. 9, The traffic load on the tunneling interval can be monitored and analyzed (920).

6, in step 620, the smart gateway adaptively allocates the inbound or outbound packets to the multiple queues based on the analysis result of the network status to control the traffic of the VPN tunneling interval can do.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CDROMs, DVDs, magneto-optical media such as floptical disks, Magneto-optical media, and hardware devices specifically configured to store and perform program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

110: OpenVPN Server Access Gateway
120: OpenVPN Client Gateway
130: OpenVPN Client Gateway Control System
210: Multiple queues
220:
230:
240:

Claims (18)

A multi-queue for temporarily buffering inbound or outbound packets in a VPN tunneling interval for connecting a remote network through a virtual private network (VPN), and outputting the packet in accordance with a predefined priority;
A monitoring unit monitoring and analyzing a network state including a traffic load on the VPN tunneling interval and a traffic load on each queuing of the multiple queues; And
And a packet allocation unit for adaptively allocating the inbound or outbound packet to the multiple queues based on the analysis result of the network state to control traffic of the VPN tunneling period,
Wherein the smart gateway is a smart gateway.
The method according to claim 1,
The monitoring unit
Calculating a traffic load for each queuing based on a drop rate for each queuing and a bandwidth allocated for each queuing, and monitoring a traffic load on the VPN tunneling period based on the traffic load for each queuing And analyzing the Internet gateways.
3. The method of claim 2,
The packet assigning unit
The traffic of the VPN tunneling period is controlled by allocating a bandwidth to another queuing having a relatively large load by finding a queuing having a relatively small load during multiple queuing based on the traffic load for each queuing, Things to do with Internet-enabled smart gateways.
The method of claim 3,
The monitoring unit
Calculating a load of the VPN tunneling daemon based on the CPU usage time of the entire system and the usage time of the VPN tunneling daemon to calculate a load of the CPU used in the VPN tunneling, Monitoring and analyzing traffic load on the Internet.
5. The method of claim 4,
The monitoring unit
Wherein the CPU usage time of the entire system and the usage time of the VPN tunneling daemon are calculated at predetermined time intervals based on Equation (1), and the load of the CPU used in the VPN tunneling is calculated Smart gateway.

[Equation 1]

Where utime is the user mode jiffies, utime_before and utime_after are the time before and after the user mode is generated, user_util is the CPU usage time of the entire system, and stime is the kernel mode jiffies), stime_before, and stime_after are the time before and after the kernel mode delay occurs, and sys_util is the time of kernel mode usage.
5. The method of claim 4,
The packet assigning unit
Selecting a traffic shaping algorithm that matches the network condition based on the load of the CPU and allocating the packet to the multiple queues using the selected traffic shaping algorithm to control traffic of the VPN tunneling interval Internet-enabled smart gateway.
The method according to claim 3 or 6,
The monitoring unit
Computing a total packet drop rate based on packet information of the VPN tunneling device and monitoring and analyzing a traffic load on the VPN tunneling interval based on the total packet drop rate.
8. The method of claim 7,
The monitoring unit
Wherein the total packet drop rate is calculated by calculating packet information of the VPN tunneling device at predetermined time intervals based on the following equation (2).
&Quot; (2) "

Where rx_drop is the number of dropped packets on the transmitting side of the VPN tunneling device, tx_drop is the number of dropped packets on the receiving side of the VPN tunneling device, rx_pkt_tot is the number of transmitting packets on the VPN tunneling device, tx_pkt_tot is the number of packets dropped on the VPN tunneling device Lt; / RTI >
8. The method of claim 7,
The packet assigning unit
Selects a traffic shaping algorithm that matches the state of the network based on the total packet drop rate and allocates the packet to the multiple queues using the selected traffic shaping algorithm to control the traffic of the VPN tunneling period Internet-enabled smart gateway.
The method according to claim 1,
The packet assigning unit
Wherein the packet is divided according to service ports and IP addresses, and the divided packets are adaptively allocated to the multiple queues based on an analysis result of the network state.
The method according to claim 1,
A queue controller for adjusting or changing at least one of the number, priority,
Further comprising: an Internet-based smart gateway.
The method according to claim 1,
The multi-
A queue having ToS (Type of Service) and Stochastic Fair Queuing (SFQ) logic for outputting packets according to priority; And
A queue with Hierarchical Token Bucket (HTB) logic that limits the effective or maximum rate of packets through bandwidth throttling
Wherein the smart gateway comprises:
13. The method of claim 12,
The multi-
Wherein the packet is multi-queued based on the SFQ logic or the HTB logic.
A traffic load on a VPN tunneling interval for connecting a remote network through a virtual private network (VPN), and a buffer for temporarily buffering inbound or outbound packets in the VPN tunneling interval and outputting the packets according to a predefined priority Monitoring and analyzing network conditions including traffic loads for each queue of queues; And
Controlling the traffic of the VPN tunneling period by adaptively allocating the inbound or outbound packet to the multiple queues based on the analysis result of the network state
Wherein the VPN tunneling real time speed control method of the Internet gateway supporting smart gateway.
15. The method of claim 14,
The step of monitoring and analyzing the network condition
Calculating a traffic load for each queuing based on a drop rate for each queuing and a bandwidth allocated for each queuing; And
Monitoring and analyzing a traffic load on the VPN tunneling period based on the traffic load for each queuing step
Wherein the VPN tunneling real time speed control method of the Internet gateway supporting smart gateway.
16. The method of claim 15,
The step of controlling traffic in the VPN tunneling interval
Determining a queuing having a relatively small load during the multiple queuing based on the traffic load for each queuing to reduce the bandwidth; And
Allocating a bandwidth to another queuing having a relatively large load to control traffic of the VPN tunneling period
Wherein the VPN tunneling real time speed control method of the Internet gateway supporting smart gateway.
17. The method of claim 16,
The step of monitoring and analyzing the network condition
Calculating a load of the VPN tunneling daemon by calculating a load of the VPN tunneling daemon based on a CPU usage time of the entire system and a usage time of the VPN tunneling daemon; And
Monitoring and analyzing a traffic load on the VPN tunneling period based on the load of the CPU
Wherein the VPN tunneling real time speed control method of the Internet gateway supporting smart gateway.
17. The method of claim 16,
The step of monitoring and analyzing the network condition
Calculating an overall packet drop rate based on packet information of the VPN tunneling device; And
Monitoring and analyzing a traffic load on the VPN tunneling interval based on the total packet drop rate
Wherein the VPN tunneling real time speed control method of the Internet gateway supporting smart gateway.

Images