WO2007019757A1

WO2007019757A1 - A communication system and method based on forwarding and control element separation

Info

Publication number: WO2007019757A1
Application number: PCT/CN2006/001137
Authority: WO
Inventors: Shaowei Liu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-08-12
Filing date: 2006-05-29
Publication date: 2007-02-22
Also published as: CN1913500A; CN100459594C

Abstract

A communication system and method based on Forwarding and Control Element Separation(ForCES). The core of the present invention includes: set the control element agent apparatus in the ForCES-based protocol system, receive the message sent from the private-based protocol control element using said control element agent apparatus, and convert it into the ForCES-based protocol message, send it to the ForCES protocol system; in the meantime, receive the message sent from ForCES protocol system using the control element agent apparatus, and convert it into the private-based protocol message and send it to the private-based protocol control element. Therefore, the invention solves effectively the problem that some simple CE and the old CE can not support the ForCES protocol, accordingly it provides a feasible technical proposal for the device transition to the ForCES.

Description

TECHNICAL FIELD The present invention relates to the field of network communication technologies, and in particular, to a communication system and a communication method based on a forwarding control separation protocol.

Background Art Generally, an IP network element (NE: Network Element) is composed of a plurality of logically isolated entities that cooperate to provide a function (such as routing or IP switching) as a whole. The network unit mainly includes two types: a control plane component and a forwarding plane component, and isolation between the control plane component and the forwarding plane component is required.

The ForCES (Forward Control Separation) protocol was introduced to standardize the exchange of information between the control and forwarding planes, that is, to standardize the exchange of information between the isolated control units and the forwarding units.

ForCES will enable the control and forwarding planes to quickly gain technological advancement while remaining interoperable. It also makes the scalability of the device very easy, and the forwarding and control capabilities can be flexibly added to an NE without the need for large-scale hardware software upgrades as they are now, resulting in business impact.

Figure 1 shows the structure of a board-level physical isolation router. As shown in Figure 1, an example of a board-level physical isolation router is shown. The router has two control boards and multiple forwarding boards, all connected to the switching network backplane. Among them, the control board is CE (control unit), the router board is FE (forwarding unit), and the switching network backplane provides physical connection of all boards. Control board A can be the primary CE, and control board B is the backup CE to provide redundant backup capabilities. For high reliability, there can also be a redundant switching network board. The goal of the ForCES protocol is to exchange information between CEs and FEs using standard protocols. Thus, for the control board from the manufacturer X and the forwarding board from the manufacturer Y, it is possible to seamlessly connect the two in one rack.

At present, there is also a physical separation of CE and FE, that is, separation at the chassis level. Figure 2 shows the structure of the CE and FE physically isolated at the chassis level. As shown in Figure 2, all CEs and FEs are physically separate chassis that are connected to each other via a high-speed LAN (such as Gigabit Ethernet). If each CE and FE communicate with each other by running ForCES, the effect described with respect to Figure 2 will also occur. 3 is a schematic structural view of E. As shown in FIG. 3, main components of the NE frame include: CE, FE, and internal interconnection protocols. The CE is responsible for operations such as signaling, protocol processing, and management protocol applications. The control plane indicates the packet forwarding behavior of the forwarding plane based on the information generated by the processing. For example, the control plane can implement control of an FE by operating an operation forwarding table, port status, adding or removing a NAT (Network Address Translation) connection.

FEs can be generic or private, such as NAT, firewall, encapsulation, etc. In Figure 3, an NE consists of a CE and two FEs. Two FEs and one CE require minimal configuration as a pre-configuration, which can be done separately by the FE manager and the CE manager.

The ForCES architecture defines the components of the ForCES NE, including several subsidiary components. These components can be connected through different topologies for flexible packet processing. Figure 4 shows the structure of the ForCES frame. As shown in Figure 4, the figure includes:

Fp: CE-FE interface;

Fi: FE-FE interface;

Fr: CE-CE interface;

Fc: CE Manager and CE interface;

Ff: FE Manager and FE interface;

Fl: CE Manager and FE Manager interface;

Fi/f: FE eve interface.

Figure 4 includes two components: the control component CE and the forwarding component FE. The ForCES framework allows the NE to contain multiple instances of CE and FE. Each FE contains one or more physical interfaces, and the physical interface is used to pack the hand outside of E. These FE interfaces are aggregated into an external interface. In addition to the external interface, there must be some kinds of interconnections within the NE, so that CE and FE can communicate with each other, and FE can forward packets to another FE. Also shown in Figure 4 are two entities outside of ForCES NE: CE Manager (CE Manager) and FE Manager (FE Manager). These two additional entities provide a configuration corresponding to CE or FE during the pre-combination phase.

In the actual ForCES framework, the functions of the control plane may be completed using CEs with different functions, and some of the CEs may be very simple. Still taking a router as an example, FIG. 5 is a schematic diagram of a router structure in the existing ForCES framework. As shown in FIG. 5, n FEs are connected together through a switching network to form a data plane, and the control plane is composed of two chipsets of the control board. Cheng: One is the CPU for routing calculation and signaling, one is a dedicated ASIC chip for device management. The device management is responsible for controlling the switching of the switching network and the control board (in the case of backup), and the environmental alarms of the device (such as excessive temperature, excessive humidity, abnormal voltage, stable voltage on the FE, etc.), restart of the board, and code issue. Load instructions and other functions. Since these functions are relatively fixed and simple, they are implemented in an ASIC.

In future ForCES architecture applications, there may also be a CE similar to a device management. Such a CE may also be very simple. It is a dedicated ASIC chip. For such a chip, support a complex protocol such as ForCES. It is very difficult, therefore, how to adapt this special CE to the ForCES architecture is a problem that needs to be solved.

In addition, in the future ForCES architecture equipment, since many manufacturers already have very mature CEs, in the future equipment expansion and vendor integration, some CEs may support the ForCES protocol, and some existing mature CEs cannot. Support for the ForCEs protocol. Figure 6 shows the structure of the system including CE and FE in the ForCES architecture. As shown in Figure 6, CE3 is a previously existing chassis that can perform certain CE functions, such as a specific protocol. In the newly formed NE node, the system integrator hopes to use it. The CE3 as a separate chassis cannot support the ForCES protocol. Even if CE3 can be modified, for some mature network operating systems, if the CE is modified to support the ForCES protocol, the amount of modification required is large, and the previous system has its own proprietary communication method, which is very mature. And stable, therefore, such modifications can pose significant risks.

In summary, there is currently no way to meet the above two requirements. Summary of the invention

The present invention provides a system and a communication method based on a forwarding control separation protocol, which solves the problem that the CE of the cartridge and the past CE cannot support the ForCES protocol, and provides a feasible technical solution for the transition of the network device to the ForCES.

The invention is achieved by the following technical solutions:

The communication system based on the forwarding control separation protocol provided by the present invention comprises: a control unit (CE) and a forwarding unit (FE) based on the ForCES protocol;

The control unit proxy device is configured to perform protocol conversion processing on the message exchanged between the control unit based on the private protocol and the forwarding unit based on the forwarding control separation protocol. The control unit based on the private protocol also communicates with the control unit based on the forwarding control separation protocol in the system by the control unit proxy device.

The mixture of the control unit proxy device and the physical control unit constitutes a logical control unit entity, and one control unit agent can proxy at least one physical CE.

The control unit proxy device is a CPU, a dedicated component supporting the ForCES protocol, or a general control unit supporting the ForCES protocol.

Correspondingly, the communication method based on the forwarding control separation protocol provided by the present invention includes: (1) the control unit proxy device receives the message sent by the control unit based on the private protocol, and converts the message into a message based on the ForCES protocol, and sends the message to the ForCES. Protocol system

(2) The control unit proxy device receives the message sent by the ForCES protocol system and converts the message into a proprietary protocol based message to the control unit based on the private protocol.

The method further includes: the control unit proxy device securely authenticates the private protocol based control unit to which it is connected, and only allows access by the authenticated private protocol based control unit.

The method further includes: the control unit proxy device simultaneously proxies a plurality of agents

At the time of the CE, the control unit proxy device determines, according to the received message from the forwarding control separation protocol system, the control unit that receives the message based on the private protocol, and sends the protocol-converted message to the corresponding private-based control unit. The control unit of the protocol implements the correct splitting of the message.

The method further includes: performing, by the control unit proxy device, a configuration management of the private protocol-based control unit connected to the control unit proxy device by the control unit manager in the forwarding control separation protocol system.

The method further includes the control unit proxy device determining, by communication with the control unit manager in the forwarding control separation protocol system, the associated network element, and the forwarding unit in communication therewith, in the pre-combination phase.

Correspondingly, a control unit proxy device provided by the present invention includes:

Forwarding control separation protocol module: used for interaction with a forwarding unit based on a forwarding control separation protocol;

Proxy control unit private protocol module: for private use with the proxy control unit There is a protocol for message interaction;

The protocol conversion module is connected between the private control protocol module of the proxy control unit and the separation control protocol module, and is used for performing conversion processing between the private protocol and the forwarding control separation protocol, and implementing the private protocol module and forwarding by the proxy control unit. Controls message interaction between separate protocol modules.

The device further includes:

The function control module: a destination control unit for identifying the received traffic flow based on the forwarding control separation protocol, and controlling to send the service flow to the corresponding controlled control unit.

The device further includes:

Communication module between control units: for performing interaction with messages based on the forwarding control separation protocol with other control units based on the forwarding control separation protocol in the system;

with

Control unit manager communication module: used to interact with the control unit manager in the system to implement configuration management operations on the agent's control unit;

and / or,

A control unit module supporting the ForCES protocol for implementing the functions of a common ForCES-based control unit;

with

Backup/load sharing module: Used to cooperate with the backup and load sharing processing function entities in the forwarding control separation protocol system to implement corresponding backup and/or load sharing processing.

The device is built into the control unit based on the forwarding control separation protocol in the system or is independently installed in the system.

The device is disposed in a different chassis than the controlled control unit.

The apparatus also includes a security processing module for performing a validity check on the accessed proxy control unit and allowing only the proxyed control unit that passes the validity check to interact with the device.

It can be seen from the technical solution provided by the present invention that the CE that does not support the ForCES protocol implements the ForCES protocol-based information exchange with the FE through the CE proxy supporting the Foi'CES protocol. Therefore, the implementation of the present invention is effective. Solved some simple CE can not support The problem of holding the ForCES protocol; at the same time, it also solves the problem that the past CE can not join the Foi'CES, providing a feasible technical solution for the transition of the device to ForCES.

DRAWINGS

Figure 1 is a schematic structural diagram of a board-level physical isolation router;

Figure 2 is a schematic diagram of the CE and FE of the chassis-level physical isolation;

Figure 3 is a schematic structural view of the NE;

Figure 4 is a schematic diagram of the structure of the ForCES framework;

FIG. 5 is a schematic structural diagram of a router in an existing ForCES framework;

Figure 6 is a schematic diagram of the system structure of the ForCES architecture including CE and FE;

7 is a schematic structural diagram of a first embodiment of a ForCES communication system according to the present invention;

8 is a schematic structural diagram of a second embodiment of a ForCES communication system according to the present invention; FIG. 9 is a schematic structural diagram of a third embodiment of a ForCES communication system according to the present invention; FIG. 10 is a schematic structural diagram of a CE proxy device provided by the present invention.

detailed description

In order to solve the problems existing in the prior art, the core of the present invention is to propose a CE Proxy.

The concept and method of (CE agent) is a useful complement to the ForCES framework. That is to say, the purpose of the present invention is to adopt a case where the physical CE cannot directly apply the ForCES protocol, for example, due to the lack of a general-purpose CPU, or the old CE is expected to be used as a CE in the new ForCES architecture. A CE proxy is used to terminate the control point of the Fp (interface between the CE and the FE), so that the physical communication between the CE and the FE that cannot support the ForCES protocol is performed based on the ForCES protocol.

That is, the FE can communicate with the physical CE (ie, the proxyed CE) through a CE agent based on the ForCES protocol, and the physical CE of the proxy still uses its own proprietary protocol (ie, private communication mode) to pass the CE proxy with the CE proxy. FE communication, the private communication method includes: non-ForCES protocol or DMA (direct memory access) communication mode, or other private methods existing by the original CE. That is, the application of the present invention does not require any modification to the original physical CE.

In the application provided by the present invention, a mixture of a CE proxy and a physical CE constitutes a logical CE entity. Moreover, in the present invention, a CE proxy may also proxy multiple physical CEs at the same time.

In the present invention, the CE proxy may be a CPU and a support for the ForCES protocol. A dedicated component, or it can be a general CE that supports the ForCES protocol. In order to further understand the present invention, the present invention will be further described with reference to the accompanying drawings.

The communication system based on the ForCES protocol provided by the present invention is shown in Fig. 7, Fig. 8, and Fig. 9, respectively. 7 is a schematic structural diagram of a first embodiment of a ForCES communication system according to the present invention; FIG. 8 is a schematic structural view of a second embodiment of a ForCES communication system according to the present invention; and FIG. 9 is a schematic structural diagram of a third embodiment of a ForCES communication system according to the present invention. The ForCES-based protocol system of the present invention includes: a control unit (CE) and a forwarding unit (FE) based on the Foi'CES protocol, and further includes a control unit proxy device (CE proxy) through which the control unit based on the private protocol proxy The device is in communication with the forwarding unit, and the control unit proxy device is configured to perform protocol conversion processing on a message exchanged between the control unit based on the private protocol and the forwarding unit based on the ForCES protocol; in addition, the control based on the ForCES protocol The unit also establishes communication with the control unit based on the ForCES protocol in the system through the control unit proxy device.

For the CE proxy shown in Figure 7, Figure 8, and Figure 9, it is required to support the ForCES protocol; the ForCES protocol can be translated into a private format that can be received by a CE that does not support the ForCES protocol. The CE agent has the function of connecting to the CE Manager. In the Pre-association Phase of ForCES, the CE Manager determines whether or not to join the NE. The CE proxy and other CEs must have the communication functions specified by the ForCES architecture. The specific communication protocol conforms to the future ForCES architecture. Currently, it can be an extension of many existing protocols, such as protocols established over TCP/IP. The CE proxy must conform to the ForCES architecture and protocol requirements, be able to identify the FE model, and be able to obtain FE topology information through the FE manager, CE manager, or internal topology discovery. The CE agent needs to know the function of the actual physical CE that it is acting on, and can start or not start the function of the CE agent according to the requirements of CE Manager.

When a CE agent is acting on multiple real CEs, as shown in Figure 8, it is necessary to provide the function of configuring the CE to be authenticated or automatically discovering different CEs to implement correct traffic distribution.

When the agent's CE and agent are in two chassis or a network, some security mechanisms must be specified to prevent spoofing and attacks. The security mechanism can be all existing authentication and authorization protocol mechanisms, and needs to be determined according to the degree of CE support for the proxy. If the CE proxy itself has some CE functions, such as a CE that supports ForCES, as shown in Figure 9, the CE proxy can also be set in an existing common CE, such as CE2. At this time, CE2 It can be used as a proxy for CE3, CE4, and CE5. That is, CE3, CE4, and CE5 can communicate with each FE through a proprietary protocol through CE2. CE2 needs to be able to distinguish its own functions from the functions of the CEs it is acting on. It needs to pass the received packets and control messages to the subsequent CEs. It needs to be processed by itself and must be guaranteed. Processing proceeds in the correct order.

The invention also provides a communication method based on a forwarding control separation protocol. The method can connect a control unit based on a private protocol to a communication system of the ForCES protocol, and the method includes:

(1) The control unit CE proxy device receives the message sent by the control unit based on the private protocol, and converts it into a message based on the ForCES protocol, and sends the message to the ForCES protocol system;

(2) Control unit The CE proxy device receives the message sent by the ForCES protocol system and converts it to a private protocol based message to the control unit based on the private protocol.

That is, the CE proxy device can convert the ForCES protocol message into a private format message that the CE based on the private protocol can receive and pass it to the ForCES protocol system, and vice versa.

In order to ensure the legitimacy of the proxyed CE of the access control unit proxy device, the control unit proxy also needs to perform secure authentication on the private protocol-based control unit (ie, the proxyed CE) connected thereto, and only allows the authentication to pass based on The control unit of the private protocol accesses the control unit proxy device. For example, when the agent's CE and the agent are in two chassis or one network, the corresponding security mechanism must be specified to prevent spoofing and attack; the security mechanism can adopt all existing authentication and authorization protocol mechanisms. The specific needs are determined according to the degree of CE support for the agent.

In addition, in the method of the present invention, when the control unit proxy device, that is, the proxy CE, simultaneously proxies a plurality of proxy CEs, the proxy CE further needs to determine to receive the message according to the received message sent by the ForCES protocol system. The control unit based on the private protocol of the message, and sends the protocol-converted message to the corresponding control unit based on the private protocol, specifically: when the CE proxy itself has the function of the CE, for example, it is a support for ForCES of CE, at this time, it needs to be able to distinguish its own function from the function of the proxy CE, that is, to divide the received packet and control message, and pass the message that needs to be delivered to the proxy CE to the proxy. CE, will need to process the messages themselves to handle, and to ensure that the relevant processing in the correct order. That is, when a CE agent is acting on multiple CEs at the same time, it is required to provide the function of configuring the CE, or to automatically discover the CEs that are being proxied. Accurately distributed to the corresponding proxy CE.

In the method of the present invention, the control unit manager CE Manager in the ForCES protocol system can also configure and manage the control unit based on the private protocol connected to the control unit proxy device through the CE proxy device, thereby controlling the ForCES protocol system. The unit manager can implement configuration management for a control unit based on a proprietary protocol. At the same time, the CE proxy device also determines the associated network element NE and the forwarding unit with which it communicates by communicating with the CE Manager in the ForCES protocol system in the pre-association phase to facilitate the corresponding forwarding. The unit establishes communication.

In the method of the present invention, the CE proxy may also have a communication function defined by the ForCES architecture with other CEs, and the specific communication protocol conforms to the provisions of the future ForCES architecture, and may be an extension of various existing protocols, such as establishing Protocol over TCP/IP.

Finally, the structure of the CE proxy device provided by the present invention will be described. FIG. 10 is a schematic structural diagram of the CE proxy device provided by the present invention. As shown in FIG. 10, the CE proxy device 10 of the present invention specifically includes the following functional modules: ForCES protocol module 100: used to communicate with the FE through the ForCES protocol, and supports the standard ForCES protocol, that is, based on the ForCES protocol and the FE. Performing the interaction of the message; function control module 110: When the CE proxy (CE Proxy) includes part of the CE function, the function control module needs to distribute the messages corresponding to different functions in the CE and the CE Proxy to avoid conflicts; If the proxy does not contain the CE function, it may proxy multiple CEs behind the CE Proxy. In this case, you need to consider distributing the function corresponding message to the correct proxy CE through the function control module. For example, OSPF from the FE ( Open shortest path first) message, if the OSPF protocol is on one of the CEs, it needs to identify and distribute such messages to the corresponding CE;

Communication module 120 between CE Manager: CE Manager is used to initialize the CE 2006/001137

—10—

Configuration, the communication module completes communication with the CE Manager, and transmits the information to the function control module, and is distributed by the function control module to the corresponding functional entity in the CE or CE Proxy, thereby implementing corresponding configuration management. Operation

Communication module between CEs 130: There is also communication between CEs, so this module is required to support the corresponding communication in the ForCES framework;

The protocol conversion module 140: for the message and the message sent to the proxy CE, in this module, the ForCES message is converted to the non-Force standard CE that is being proxyed; at the same time, the proxy CE is also proxyed. The private protocol-based message sent by the CE private protocol module is converted into a standard ForCES message and sent to the ForCES protocol module, so as to be sent to the corresponding FE;

The module that is proxyed by the CE private protocol module 150: communicates with the proxy CE, and emulates the CE Proxy into a peer of the proxy CE to implement communication. The module further includes: a security processing module, configured to ensure that no attack is performed by using a security authentication mechanism when the proxyed CE and the CE Proxy are in the two chassis, and the security processing module may also be independent of The module is set, but the functions are the same; the prerequisite for implementing the secure authentication mechanism is that the CE being supported by the proxy supports these functions;

The device may also optionally include a CE module 160 supporting the ForCES protocol for implementing the functions of a common ForCES protocol-based CE, that is, the device according to the present invention may be configured with an existing CE-body. Of course, it can also be set independently.

In the present invention, the CE proxy conforms to the ForCES architecture and protocol, and can identify the FE model, and can obtain the FE topology information through the FE manager, the CE manager, or the internal topology discovery. Moreover, the CE agent knows the function of the actual physical CE that it is acting on, and can start or not activate the function of the CE agent according to the requirements of the CE Manager. In addition, the CE proxy also includes a backup/load sharing module, which is used to implement the CE backup, distributed CE, and CE load sharing functions supported by the ForCES framework.

In summary, the implementation of the present invention solves the problem that the simple CE cannot support the ForCES protocol; at the same time, it also solves the problem that the old CE cannot join the ForCES in the past, and provides a feasible technology for the device to transition to the ForCES. Program.

The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention It is not limited thereto, and any modifications or substitutions that can be easily conceived within the scope of the present invention are intended to be included within the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Rights request

1. A communication system based on a forwarding control separation protocol, comprising:

Control unit (CE) and forwarding unit (FE) based on ForCES protocol;

And a control unit proxying device, configured to perform protocol conversion processing on a message exchanged between the control unit based on the private protocol and the forwarding unit based on the forwarding control separation protocol.

2. The system according to claim 1, wherein: the control unit based on the private protocol further communicates with the control unit based on the forwarding control separation protocol in the system by the control unit proxy device.

3. A system according to claim 2, characterized in that the mixture of the control unit proxy device and the physical control unit constitutes a logical control unit entity, and a control unit agent can proxy at least one physical CE.

4. The system according to claim 3, wherein: the control unit proxy device is a CPU, a dedicated component supporting the ForCES protocol, or a general control unit supporting the ForCES protocol.

5. A communication method based on a forwarding control separation protocol, comprising:

(1) The control unit proxy device receives the message sent by the control unit based on the private protocol, and converts it into a message based on the ForCES protocol, and sends the message to the ForCES protocol system;

6. The method according to claim 5, wherein the method further comprises: the control unit proxy device performs security authentication on the control unit based on the private protocol connected thereto, and only allows authentication based on proprietary protocol. Unit access.

The method according to claim 5, wherein the method further comprises: when the control unit proxy device simultaneously proxies a plurality of proxy CEs, the control unit proxy device controls according to the received forwarding Separating the message sent by the protocol system, determining the control unit based on the private protocol that receives the message, and sending the message converted by the protocol to the corresponding control unit based on the private protocol to implement correct packet splitting.

The method according to claim 5, wherein the method further comprises: controlling, by the control unit, the control unit manager in the forwarding control separation protocol system The private unit-based control unit connected to the unit proxy device performs configuration management.

The method according to claim 5, wherein the method further comprises: the control unit proxy device determining, by the control unit manager in the forwarding control separation protocol system, the network element to be associated in the pre-combination phase, And the forwarding unit with which to communicate.

10. A control unit proxy device, comprising:

Proxy control unit private protocol module: for interacting with the proxy control unit based on a private protocol;

The control unit proxy device according to claim 10, wherein the device further comprises:

The control unit proxy device according to claim 10 or 11, wherein the device further comprises:

with

and / or,

with

Backup/load sharing module: used to cooperate with the forwarding control to separate backup and negative in the protocol system The load sharing processing function entity implements corresponding backup and/or load sharing processing.

13. The control unit proxy device according to claim 12, wherein: the device is built in a control unit based on a forwarding control separation protocol in the system or is independently disposed in the system.

14. The control unit proxy device according to claim 10 or 11, wherein: the device and the controlled control unit are disposed in different chassis.

The control unit proxy device according to claim 14, wherein: the device further comprises a security processing module, wherein the security processing module is configured to perform a legality check on the accessed proxy control unit, and only The proxyed control unit that allows for legality checks interacts with the device with the message.