WO2015184586A1 - 开放流通信方法、系统、控制器和业务网关 - Google Patents

开放流通信方法、系统、控制器和业务网关 Download PDF

Info

Publication number
WO2015184586A1
WO2015184586A1 PCT/CN2014/079084 CN2014079084W WO2015184586A1 WO 2015184586 A1 WO2015184586 A1 WO 2015184586A1 CN 2014079084 W CN2014079084 W CN 2014079084W WO 2015184586 A1 WO2015184586 A1 WO 2015184586A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual switch
data packet
flow table
action
service gateway
Prior art date
Application number
PCT/CN2014/079084
Other languages
English (en)
French (fr)
Inventor
朱韧
周伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2014/079084 priority Critical patent/WO2015184586A1/zh
Priority to EP14894130.5A priority patent/EP3142306B1/en
Priority to KR1020167036645A priority patent/KR101938623B1/ko
Priority to CN201480078716.1A priority patent/CN106464596B/zh
Priority to JP2016571162A priority patent/JP6395867B2/ja
Publication of WO2015184586A1 publication Critical patent/WO2015184586A1/zh
Priority to US15/369,191 priority patent/US10148565B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/76—Routing in software-defined topologies, e.g. routing between virtual machines
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/12—Avoiding congestion; Recovering from congestion
    • H04L47/125—Avoiding congestion; Recovering from congestion by balancing the load, e.g. traffic engineering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/30—Peripheral units, e.g. input or output ports
    • H04L49/3009—Header conversion, routing tables or routing tags
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches

Definitions

  • the present invention relates to the field of communications, and in particular, to an open stream communication method, system, controller, and service gateway.
  • the new network switching model Openflow which is supported by Stanford University in the United States, has gradually improved its protocol and successfully applied it to the actual network, and its application in the data center network is particularly prominent.
  • the OpenFlow network topology includes an Openflow controller 11, an Openflow switch 12, a terminal 13, and a link connecting them.
  • the Openflow controller 11 stores the topology of the entire network, generates a flow table for the data stream to be forwarded, and delivers the flow table to the corresponding switch; and the Openflow switch 12 stores the flow table information sent by the Openflow controller 11, and Data forwarding between Openflow switches 12 and between Openflow switch 12 and terminal 13 is performed based on flow table information.
  • the data center network topology is often a tree structure.
  • the enterprise service gateway serves as the entry (tree root) of the data center.
  • it In addition to being responsible for network forwarding, it also needs to process certain data.
  • data is encrypted and decrypted.
  • DPI Deep Packet Inspection, (7), in addition to data compression and decompression, etc. Specifically, including:
  • the enterprise service gateway receives the client request and performs security check on the data (IPSEC). (InternetProtocolSecurity, Internet Protocol Security), DPI) and other data processing.
  • IPSEC InternetProtocolSecurity, Internet Protocol Security
  • DPI Internet Protocol Security
  • the data processing is completed, and the pending data packet is forwarded to the backend server according to the requested service type.
  • the server processes and forwards the processing result to the enterprise service gateway.
  • the enterprise service gateway receives the service data, performs certain processing, and forwards the encapsulated data packet to the client.
  • the existing enterprise service gateway serves as the entrance of the entire data center.
  • the amount of data to be processed exceeds its capacity, it becomes the bottleneck of the entire system, while the back-end server has a large amount of computing resources. So you need to find a way to solve this bottleneck.
  • the embodiments of the present invention provide an OpenFlow communication method, a system, a controller, and a service gateway, which can implement load balancing of each network element in the system, improve system utilization and throughput, and improve performance of the entire system.
  • the first aspect provides an open flow communication method, the method includes: receiving a transfer processing request sent by a service gateway, where the transfer processing request includes an action to be transferred; selecting a server as a virtual switch according to the action required to be transferred and the network topology; Delivering a first flow table to the service gateway, where the first flow table is used by the service gateway to forward the data packet to the virtual switch; the second flow table is sent to the virtual switch, where the second flow table includes an instruction for instructing the virtual switch to perform an action on the data packet. So that the virtual switch performs an action on the data packet, and sends the data packet after the action is sent to the destination server of the data packet.
  • the method further includes: if the virtual switch does not send the data packet to the flow table of the destination server of the data packet, receiving the data packet sent by the virtual switch The processing rule message of the request packet; the third flow table is sent to the virtual switch, and the third flow table is used by the virtual switch to send the data packet after the action is performed to the destination server of the data packet.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the second aspect provides a controller, including: a receiving module, configured to receive a transfer processing request sent by a service gateway, where the transfer processing request includes an action that needs to be transferred; and a selection module, configured to perform an action according to the need to transfer and a network topology selection
  • a server is configured as a virtual switch.
  • the first flow table is sent by the first flow table, and the first flow table is used to forward the data packet to the virtual switch.
  • the second flow table is sent to the virtual switch.
  • the switch delivers a second flow table, where the second flow table includes instructions for instructing the virtual switch to perform an action on the data packet, so that the virtual switch performs an action on the data packet, and sends the data packet after performing the action to the data packet. server.
  • the controller further includes a third flow table sending module, and the receiving module receives the data packet sent by the virtual switch.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the third aspect provides an open flow communication method, including: when a load exceeds a preset threshold, sending a transfer processing request to a controller, where the transfer processing request includes an action that needs to be transferred so that the controller selects one server as a virtual switch; and receiving control The flow table delivered by the device; the data packet is forwarded to the virtual switch according to the flow table so that the virtual switch performs an action on the data packet and sends it to the destination server of the data packet.
  • the data packet is forwarded to the virtual switch according to the flow table, and specifically, the data packet encapsulated by using the IP_IN_IP manner is forwarded to the virtual switch according to the flow table.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the fourth aspect provides a service gateway.
  • the method includes: a sending module, configured to send a transfer processing request to the controller when the load exceeds a preset threshold, where the transfer processing request includes an action that needs to be transferred, so that the controller selects one server as a virtual switch; and the receiving module is configured to receive the controller.
  • the flow table delivered; the forwarding module is configured to forward the data packet to the virtual switch according to the flow table, so that the virtual switch performs an action on the data packet and sends the data packet to the destination server of the data packet.
  • the forwarding module is specifically configured to forward the data packet encapsulated by using the IP_IN_IP manner to the virtual switch according to the flow table.
  • the action includes at least one of data packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • a fifth aspect provides a controller, including: a receiver, a processor, a transmitter, and a memory, where: the receiver is configured to receive a transfer processing request sent by the service gateway, where the transfer processing request includes an action that needs to be transferred; and the memory is configured to:
  • the program code is connected to the receiver, and the program code for calling the memory store performs the following method: selecting a server as a virtual switch according to the action to be transferred and the network topology; and the transmitter is also used to deliver the service to the service gateway.
  • the first flow table is used by the service gateway to forward the data packet to the virtual switch; the sender is further configured to deliver the second flow table to the virtual switch, where the second flow table includes instructions for instructing the virtual switch to perform an action on the data packet.
  • the virtual switch In order for the virtual switch to perform an action on the data packet, and send the data packet after the action is performed to the destination server of the data packet.
  • the receiver is further configured to receive a processing rule message of the request packet for the data packet sent by the virtual switch;
  • the sender delivers a third flow table to the virtual switch, and the third flow table is used by the virtual switch to send the data packet after the action is performed to the destination server of the data packet.
  • the action includes at least one of data packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • a sixth aspect provides a service gateway, including: a transmitter, a receiver, a processor, and a memory, wherein: when the load exceeds a preset threshold, the sender sends a transfer processing request to the controller, where the transfer processing request includes a transfer request
  • the action is such that the controller selects a server as the virtual switch; the receiver is configured to receive the flow table delivered by the controller; the memory is configured to store the program code; and the program code used by the processor to call the memory store performs the following method: the data packet is according to the flow table Forwarded to the virtual switch for the virtual switch to act on the packet and send it to the destination server of the packet.
  • the data packet is forwarded to the virtual switch according to the flow table, specifically, the data packet encapsulated by using the IP_IN_IP manner according to the flow table. Forwarded to the virtual switch through the first data channel.
  • the action includes at least one of data packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • a seventh aspect provides an OpenFlow communication system, including: a controller, a service gateway, and at least one server, wherein: the service gateway sends a transfer processing request to the controller, where the transfer processing request includes an action that needs to be transferred; and the controller transfers the information according to requirements.
  • the action and the network topology select one of the at least one server as the virtual switch; the controller delivers the first flow table to the service gateway; the service gateway forwards the data packet to the virtual switch according to the first flow table; the controller delivers the data to the virtual switch
  • the second flow table includes an instruction for instructing the virtual switch to perform an action on the data packet; the virtual switch performs an action on the data packet according to the second flow table and sends the action to the destination server of the data packet.
  • the virtual switch is further configured to send the request data packet to the controller.
  • the controller is further configured to send a third flow table to the virtual switch, where the third flow table is used by the virtual switch to send the data packet after the action is performed to the destination server of the data packet.
  • the action includes at least one of data packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the service gateway is configured to forward the data packet to the virtual switch according to the first flow table, specifically, the IP_IN_IP manner is used according to the first flow table. The packet is forwarded to the virtual switch.
  • the present invention receives a transfer processing request that needs to be transferred by the service gateway, and includes an action that needs to be transferred; selects a server as a virtual switch according to the action of the transfer and the network topology; and delivers the first flow table to the service gateway for the service gateway. Forwarding a data packet to the virtual switch; delivering a second flow table to the virtual switch, including instructions for instructing the virtual switch to perform a processing action on the data packet, so that the virtual switch performs a processing action on the data packet, and performs a processing action
  • the data packet is sent to the destination server of the data packet to implement load balancing of each network element in the system, improve system utilization and throughput, and thereby improve the performance of the entire system.
  • FIG. 3 is a schematic diagram of a message format reported by the service gateway in FIG. 2;
  • FIG. 4 is a schematic diagram of each message format sent by the controller in FIG. 2;
  • FIG. 5 is a schematic diagram of a message format of a second flow table sent by the controller in FIG.
  • FIG. 6 is a schematic flow chart of an OpenFlow communication method according to a first embodiment of the present invention.
  • Figure 7 is a schematic structural view of a controller according to a first embodiment of the present invention.
  • FIG. 8 is a schematic flow chart of an OpenFlow communication method according to a second embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a service gateway according to a first embodiment of the present invention.
  • Figure 10 is a schematic structural view of a controller according to a second embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a service gateway according to a second embodiment of the present invention.
  • Figure 12 is a block diagram showing the structure of an OpenFlow communication system in accordance with a first embodiment of the present invention.
  • FIG. 2 is a network topology diagram of the OpenFlow of the present invention.
  • the open flow network topology includes a service gateway 22, a controller 21, a virtual switch 23, a destination server 24, and a router 25.
  • the service gateway 22 receives the packet decryption request, it checks the system load. If the load exceeds a given threshold, that is, the processing capability of the service gateway 22 is insufficient, referring to FIG. 2, the following process is performed:
  • the service gateway 22 reports the request resource that needs to be transferred to the controller 21.
  • the request resource to be transferred corresponds to an action, where the action is a process waiting for processing or an operation to be performed. Assuming that the action here is a decryption action, the requested resource to be transferred is related to the decryption, and the service gateway 22 reports the request resource to be transferred to the controller 21 in the form of a resource request message.
  • the format of the specific resource request message is as shown in the figure.
  • IP Internet
  • the protocol the network interconnection protocol, includes the source IP address and the destination IP address
  • the source IP address is the IP address of the service gateway 22
  • the destination IP address is the IP address of the controller 21
  • TCP Transmission Control
  • the protocol indicates that the resource request message is transmitted through the port of the TCP protocol.
  • the port 6633 is preferred.
  • the OF indicates that the resource request message transmission process strictly follows the openflow (open flow) protocol, and the value of S_req is 1.
  • the representative message is a resource request, and Req_type represents a type of resource request, and the data length is 4 bytes.
  • 1 is an encrypted resource
  • 2 is a decrypted resource
  • 3 is a compressed resource.
  • DPI decompression action
  • DPI Decompression action
  • Packet Inspection deep packet inspection technology scanning and more.
  • the request resources for the required transfer corresponding to different actions are different.
  • the service gateway 22 sends a resource request message to the controller 21, indicating that the resource request is performed according to the openflow protocol, and the resource is requested to be decrypted.
  • the controller 21 selects a suitable server as the virtual switch 23 in the cluster of the backend switch according to the required resources and the network topology reported by the service gateway 22, and preferably the shortest path from the destination server as possible.
  • the controller 21 delivers the first flow table to establish a first data channel between the service gateway 22 and the virtual switch 23, and the service gateway 22 forwards the data packet to the virtual switch 23.
  • the controller 21 delivers the first flow table to the service gateway 22, and its format is as shown in a) of FIG. 4, where F_add Indicates adding a flow table, Filling in the PUSH_IPHEAD in the Action indicates that the IP header operation is added.
  • the IP, TCP, and OF have the same meanings as the resource request message in FIG. 3, and details are not described herein again.
  • the controller 21 also delivers the first flow table to the virtual switch 23, and its format is as shown in b) of FIG. 4, and the POP_IPHEAD in the Action is indicated as deleting the IP header operation.
  • the service gateway 22 and the virtual switch 23 use IP_IN_IP (IP encapsulated IP) to transmit data, and the data to be transmitted is the data packet of the service gateway 22 before the flow table operation, that is, the original data packet. , as shown in c) of Figure 4.
  • IP_IN_IP IP encapsulated IP
  • the service gateway 22 performs the encapsulation "VGW_IP” operation according to the flow table, and obtains the data packet format of the flow table operation, where "VGW_IP” is the IP of the virtual switch 23, as shown in d) of FIG.
  • the service gateway 22 sends the data packet after the flow table operation to the virtual switch 23, and obtains the data packet format before the virtual switch 23 performs the flow table operation, as shown in e) of FIG.
  • the virtual switch 23 performs a flow table operation to delete the IP header, and obtains a data packet format after the flow table operation, as shown in f) of FIG.
  • other methods may also be used to transmit data, such as directly modifying the MAC (Media Access Control, media access control) address, etc.
  • the controller 21 While the first data channel is established between the service gateway 22 and the virtual switch 23 and the data is transmitted, the controller 21 also delivers the second flow table to the selected virtual switch 23, where the second flow table includes a virtual switch. 23 instructions for performing actions on the data packet.
  • the format of the second flow table delivered by the controller 21 to the virtual switch 23 is as shown in FIG. 5, and the action to be performed is decryption.
  • KEY and KEY_LEN represent the length of the key and the key, respectively.
  • the virtual switch 23 performs a decryption operation to obtain original packet information.
  • the virtual switch 23 forwards the data packet to the destination server 24 based on the original data packet information. If there is no related flow table in the virtual switch 23, the PACKET_IN message for the request packet processing rule of the data packet is sent to the controller 21, and the third flow table is sent by the controller 21 to establish the virtual switch 23 and the destination server 24.
  • the second data channel is used by the virtual switch 23 to send the data packet after performing the action to the destination server 24 of the data packet.
  • the destination server 24 and the virtual switch 23 may be the same server, or may not be the same server.
  • the controller 21 establishes a second data channel between the virtual switch 23 and the destination server 24, the virtual switch 23 can establish a second data channel with the destination server through the router 25.
  • the operation of the service gateway 22 is transferred to the virtual switch 23 by the controller 21. If the service gateway 22 continues to receive the action request and checks that the system load exceeds the given threshold, the above process is repeatedly performed, and the action of the service gateway 22 is migrated to the virtual switch 23 until the service gateway 22 no longer receives the action request. Or the system load is not checked to exceed a given threshold, and the system is stable.
  • the processing capability of the service gateway 22 is insufficient, a part of the data processing service is transferred from the service gateway 22 to the virtual switch 23, which can implement load balancing of each network element in the system, improve system utilization and throughput, and improve the system. The performance of the entire system.
  • FIG. 6 is a schematic flowchart diagram of an OpenFlow communication method according to a first embodiment of the present invention. As shown in FIG. 6, the open stream communication method includes:
  • S10 Receive a transfer processing request sent by the service gateway, where the transfer processing request includes an action that needs to be transferred.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the service gateway checks that the system load exceeds a given threshold, and the action needs to be transferred.
  • the action required to be transferred by the receiving service gateway is to receive the action-related request resource sent by the service gateway, so as to transfer to other network elements to perform the action.
  • S11 Select a server as a virtual switch according to the action to be transferred and the network topology.
  • S12 The first flow table is sent to the service gateway, where the first flow table is used by the service gateway to forward the data packet to the virtual switch.
  • the first flow table is delivered to the virtual switch while the first flow table is delivered to the service gateway.
  • the first flow table delivered to the service gateway indicates that the IP header operation is added, that is, the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet.
  • the first flow table sent to the virtual switch indicates that the IP header operation is deleted, that is, the encapsulated IP is removed on the basis of receiving the data packet forwarded by the service gateway, so that the virtual switch can obtain the original data packet.
  • the second flow table is sent to the virtual switch, where the second flow table includes an instruction for instructing the virtual switch to perform an action on the data packet, so that the virtual switch performs an action on the data packet, and sends the data packet after the action is performed to the virtual switch.
  • the destination server for the packet Preferably, the delivered second flow table further includes resource information corresponding to the action, so that the virtual switch performs an action on the data packet according to the resource information, for example, performing a decryption operation according to the key information related to the decryption.
  • the action includes at least one of data packet encryption, decryption, deep packet inspection, data compression, or data decompression, and the resource information corresponding to the action includes a key or a DPI rule.
  • the processing capability of the service gateway is insufficient, a part of the data processing service is transferred from the service gateway to the virtual server, which can implement load balancing of each network element in the system, improve system utilization and throughput, and thereby improve the entire system. Performance.
  • the PACKET_IN message sent by the virtual switch is received to generate a third flow table, and the third flow table is delivered to the virtual switch, where the virtual switch and the destination server are located.
  • a second data channel is established between the third flow table for the virtual switch to send the data packet after performing the action to the destination server of the data packet.
  • the destination server and the virtual switch may be the same server, or may not be the same server.
  • FIG. 7 is a schematic structural diagram of a controller according to a first embodiment of the present invention.
  • the controller 10 includes a receiving module 101 , a selecting module 102 , a first flow table sending module 103 , a second flow table sending module 104 , and a third flow table sending module 105 .
  • the receiving module 101 is configured to receive a transfer processing request sent by the service gateway, where the transfer processing request includes an action that needs to be transferred.
  • the selection module 102 is connected to the receiving module 101 for selecting a server as a virtual switch according to the action to be transferred and the network topology.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the first flow table sending module 103 is connected to the selecting module 102, and is configured to send a first flow table to the service gateway, and establish a first data channel between the service gateway and the virtual switch, where the first flow table is used by the service gateway to forward data to the virtual switch. package.
  • the first flow table sending module 103 sends the first flow table to the virtual switch while delivering the first flow table to the service gateway.
  • the first flow table delivered to the service gateway indicates that the IP header operation is added, that is, the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet.
  • the first flow table sent to the virtual switch indicates that the IP header operation is deleted, that is, the encapsulated IP is removed on the basis of receiving the data packet forwarded by the service gateway, so that the virtual switch can obtain the original data packet.
  • the second flow table issuing module 104 is connected to the selecting module 102 and the first sending module 103, and is configured to send a second flow table to the virtual switch, where the second flow table includes a virtual flow switch for instructing the virtual switch to perform an action on the data packet. An instruction to cause the virtual switch to perform an action on the data packet and send the data packet after the action is sent to the destination server of the data packet. Further, the second flow table further includes resource information corresponding to the action, including information related to performing an action operation, such as a key or a DPI rule.
  • the receiving module 101 is further configured to receive the PACKET_IN message sent by the virtual switch for the data packet; the third sending flow
  • the table module 105 sends a third flow table to the virtual switch, and establishes a second data channel between the virtual switch and the destination server.
  • the third flow table is used by the virtual switch to send the data packet after the action is performed to the destination server of the data packet.
  • FIG. 8 is a schematic flowchart diagram of an OpenFlow communication method according to a second embodiment of the present invention. As shown in FIG. 8, the open stream communication method includes:
  • S20 When the load exceeds a preset threshold, send a transfer processing request to the controller, where the transfer processing request includes an action that needs to be transferred so that the controller selects one server as the virtual switch.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • S22 Forward the data packet to the virtual switch according to the flow table, so that the virtual switch performs an action on the data packet and sends the data packet to the destination server of the data packet.
  • the data packet encapsulated by the IP_IN_IP method is forwarded to the virtual switch according to the flow table. Specifically, the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet. The virtual switch can obtain the original data packet after receiving the data packet forwarded by the service gateway and removing the encapsulated IP.
  • a part of the data processing service is transferred to the virtual server for execution, which can implement load balancing of each network element in the system, improve system utilization and throughput, and thereby improve The performance of the entire system.
  • FIG. 9 is a schematic structural diagram of a service gateway according to a first embodiment of the present invention.
  • the service gateway 20 includes a sending module 201, a receiving module 202, and a forwarding module 203.
  • the sending module 201 is configured to send a transfer processing request to the controller when the load exceeds a preset threshold, and the transfer processing request includes an action that needs to be transferred so that the controller selects one server as the virtual switch.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the receiving module 202 is connected to the sending module 201, and is configured to receive a flow table sent by the controller.
  • the forwarding module 203 is coupled to the receiving module 202 for forwarding the data packet to the virtual switch according to the flow table so that the virtual switch performs an action on the data packet and sends the packet to the destination server of the data packet.
  • the forwarding module 203 forwards the data packet encapsulated by the IP_IN_IP method to the virtual switch according to the data packet. Specifically, the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet. The virtual switch can obtain the original data packet after receiving the data packet forwarded by the service gateway and removing the encapsulated IP.
  • the sending module 201 sends a transfer processing request to the controller, where the transfer processing request includes an action that needs to be transferred so that the controller selects one server as the virtual switch, and the receiving module 202 receives The flow table delivered by the controller, the forwarding module 203 forwards the data packet to the virtual switch according to the data flow table, so that the virtual switch performs an action on the data packet and sends the data packet to the destination server of the data packet, so that the processing capability on the service gateway is insufficient.
  • the transfer of a part of the data processing service from the service gateway to the virtual server can implement load balancing of each network element in the system, improve system utilization and throughput, and improve the performance of the entire system.
  • FIG. 10 is a schematic structural diagram of a controller according to a second embodiment of the present invention.
  • the controller 30 includes a receiver 301, a processor 302, a transmitter 303, a memory 304, and a data bus 305.
  • the receiver 301, the processor 302, the transmitter 303, and the memory 304 are connected by a data bus 305 to communicate with each other.
  • the receiver 301 is configured to receive a transfer processing request sent by the service gateway, where the transfer processing request includes an action that needs to be transferred.
  • the memory is used to store program code.
  • the program code used by the processor 302 to call the memory store performs the following method: selecting a server as a virtual switch according to the action to be transferred and the network topology.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the sender 303 delivers the first flow table to the service gateway, and establishes a first data channel between the service gateway and the virtual switch.
  • the first flow table is used by the service gateway to forward the data packet to the virtual switch.
  • the transmitter 303 sends the first flow table to the virtual switch while delivering the first flow table to the service gateway.
  • the first flow table delivered to the service gateway indicates that the IP header operation is added, that is, the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet.
  • the first flow table sent to the virtual switch indicates that the IP header operation is deleted, that is, the encapsulated IP is removed on the basis of receiving the data packet forwarded by the service gateway, so that the virtual switch can obtain the original data packet.
  • the transmitter 303 further sends a second flow table to the virtual switch, where the second flow table includes an instruction for instructing the virtual switch to perform an action on the data packet, so that the virtual switch performs an action on the data packet, and the action packet is executed.
  • the second flow table may further include resource information corresponding to the action, and the resource information corresponding to the action includes a key or a DPI rule.
  • the memory 304 is further configured to store a network topology, a first flow table sent by the transmitter 403 to the service gateway, a second flow table sent to the virtual switch, and the like.
  • the receiver receives the PACKET_IN message sent by the virtual switch; the sender sends a third flow table to the virtual switch, and the third flow table is used after the virtual switch sends the execution action to the destination server of the data packet. Packet.
  • load balancing of each network element in the system can be implemented, and the utilization and throughput of the system are improved, thereby improving the performance of the entire system. .
  • FIG. 11 is a schematic structural diagram of a service gateway according to a second embodiment of the present invention.
  • the service gateway 40 includes a receiver 401, a processor 402, a transmitter 403, a memory 404, and a communication bus 405.
  • the receiver 401, the processor 402, the transmitter 403, and the memory 404 are connected via a data bus 405 for mutual communication.
  • the transmitter 403 when the load exceeds a preset threshold, the transmitter 403 is configured to send a transfer processing request to the controller, where the transfer processing request includes an action that needs to be transferred so that the controller selects one server as the virtual switch.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the receiver 401 is configured to receive a flow table sent by the controller.
  • the memory is used to store program code.
  • the memory is also used to store the flow table.
  • the processor 402 calls the program code stored in the memory to perform a method of forwarding the data packet to the virtual switch according to the flow table so that the virtual switch performs an action on the data packet and transmits it to the destination server of the data packet.
  • the method performed by the processor 402 forwards the data packet encapsulated by the IP_IN_IP method to the virtual switch according to the flow table.
  • the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet.
  • the virtual switch can obtain the original data packet after receiving the data packet forwarded by the service gateway and removing the encapsulated IP.
  • the memory 404 stores the actions that need to be transferred and the flow tables that are issued by the controller.
  • a part of the data processing service is transferred from the service gateway to the virtual server to implement load balancing of each network element in the system, thereby improving system utilization and throughput. Quantity, which in turn improves the performance of the entire system.
  • FIG. 12 is a schematic structural diagram of an OpenFlow communication system according to a first embodiment of the present invention.
  • the OpenFlow communication system 50 includes a controller 501, a service gateway 502, and a server 503.
  • the service gateway 502 transmits a transfer processing request to the controller 501, and the transfer processing request includes an action requiring a transfer.
  • the action is a process waiting for processing or an operation to be performed.
  • the action includes at least one of packet encryption, decryption, deep packet inspection, data compression, or data decompression.
  • the controller 501 selects a server 503 as the virtual switch 504 according to the action to be transferred and the network topology.
  • the controller 501 delivers the first flow table to the service gateway 502.
  • the service gateway 502 forwards the data packet to the virtual switch 504 according to the first flow table.
  • the service gateway 502 forwards the data packet encapsulated by the IP_IN_IP method to the virtual switch 504 according to the first flow table.
  • the data packet forwarded by the service gateway to the virtual switch encapsulates the IP of the virtual switch on the basis of the original data packet.
  • the virtual switch can obtain the original data packet after receiving the data packet forwarded by the service gateway and removing the encapsulated IP.
  • the controller 501 sends a second flow table to the virtual switch 504, where the second flow table includes instructions for instructing the virtual switch 504 to perform an action on the data packet.
  • the virtual switch 504 performs an action on the data packet according to the second flow table and transmits it to the destination server 505 of the data packet.
  • the second flow table further includes resource information corresponding to the action, such as decrypting related key information, so that the virtual switch 504 performs an action according to the resource information. If there is no flow table in the virtual switch 504 that sends the data packet to the destination server 505 of the data packet, the virtual switch 504 sends a processing rule of the PACKET_IN message request packet to the controller 501; the controller 501 sends the third to the virtual switch 504.
  • the flow table, the third flow table is used by the virtual switch 504 to send the data packet after the action is performed to the destination server 505 of the data packet.
  • the processing capability of the service gateway 502 is insufficient, a part of the data processing service is transferred from the service gateway 502 to the virtual server to implement load balancing of each network element in the system, thereby improving system utilization and throughput, thereby improving the whole. System performance.
  • the present invention receives a transfer processing request sent by the service gateway, and the transfer processing request includes an action to be transferred; and selects a server as a virtual switch according to the action and network topology required to be transferred; and then delivers the service to the service gateway.
  • the first flow table is used by the service flow gateway to forward the data packet to the virtual switch; the second flow table is sent to the virtual switch, and the second flow table includes an instruction for instructing the virtual switch to perform an action on the data packet, so that the virtual switch Performing an action on the data packet and transmitting the data packet after the action is sent to the destination server of the data packet, and when a processing capability on the service gateway is insufficient, a part of the data processing service is transferred from the service gateway to the virtual server for execution, and the system is implemented.
  • the load balancing of each network element improves the utilization and throughput of the system, thereby improving the performance of the entire system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种开放流通信方法和控制器、虚拟交换机以及业务网关，接收业务网关发送的需要转移的动作；根据需要转移的动作以及网络拓扑结构选择一个合适的虚拟交换机；分别向业务网关和虚拟交换机下发流表，并在业务网关与虚拟交换机之间建立第一数据通道以转送数据包；向虚拟交换机下发带扩展动作流表，以对数据包执行相关扩展动作；将虚拟交换机执行相关扩展动作后的数据包发送至目的服务器。通过以上公开内容，本发明能够在业务网关上处理能力不足时，将一部份数据处理业务从业务网关转移到虚拟服务器执行，实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。

Description

开放流通信方法、系统、控制器和业务网关
【技术领域】
本发明涉及通信领域，特别是涉及一种开放流通信方法、系统、控制器和业务网关。
【背景技术】
随着经济社会全球化，越来越多的企事业组织在全国甚至全球建立分支机构，越来越多的出差员工在非固定场所访问总部业务系统。同时，随着业务持续扩展和应用日益复杂，组织的IT（Information Technology，信息技术）基础架构越来越朝着集中管理的方向发展，建立数据中心和云服务成为IT建设的潮流。而企业业务网关作为数据中心和云服务中心的入口，其吐吞能力直接影响整个数据中心和云服务中心的性能。
美国斯坦福大学提出的支持网络创新研究的新型网络交换模型开放流（Openflow），其协议逐步完善，并成功应用到实际网络中，而其在数据中心网络中的应用尤为突出。如图1所示，开放流网络拓扑结构包括：Openflow控制器11、Openflow交换机12、终端13和将它们进行连接的链路。其中，Openflow控制器11中存储整个网络的拓扑结构，为需要转发的数据流生成流表，并下发到相应的交换机；而Openflow交换机12中存储Openflow控制器11下发的流表信息，并根据流表信息进行Openflow交换机12之间以及Openflow交换机12与终端13之间的数据转发。
数据中心网络拓扑结构往往为树型结构，企业业务网关作为数据中心的入口（树根），除负责网络转发外，还需要对数据进行一定处理，例如在网络安全方面，对数据进行“加解密，DPI (Deep Packet Inspection，深度包检测技术)…”，另外还有数据压缩和解压缩等。具体地，包括：
1. 企业业务网关收到客户端请求，对数据进行安全检测（IPSEC （InternetProtocolSecurity，Internet协议安全性），DPI）等数据处理。
2. 数据处理完成，根据请求服务类型将待处理数据包转发至后端服务器。
3.服务器进行处理，并将处理结果转至企业业务网关。
4.企业业务网关收到服务数据，进行一定处理，将封装好的数据包，转发至客户端。
现有的企业业务网关作为整个数据中心的入口，当待处理数据量超出其能力时，其成了整个系统的瓶颈，而后端服务器大量的计算资源却空闲。如此就需要找到一种能够解决该瓶颈问题的方法。
【发明内容】
有鉴于此，本发明实施例提供了开放流通信方法、系统、控制器和业务网关，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
第一方面提供一种开放流通信方法，该方法包括：接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作；根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；向业务网关下发第一流表，第一流表用于业务网关向虚拟交换机转送数据包；向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器。
结合第一方面的实现方式，在第一种可能的实现方式中，方法还包括：如果虚拟交换机中没有将数据包发送到数据包的目的服务器的流表，则接收虚拟交换机发送的针对数据包的请求数据包的处理规则消息；向虚拟交换机下发第三流表，第三流表用于虚拟交换机向数据包的目的服务器发送执行动作后的数据包。
结合第一方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
第二方面提供一种控制器，包括：接收模块，用于接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作；选择模块，用于根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；第一流表下发模块，用于向业务网关下发第一流表，第一流表用于业务网关向虚拟交换机转送数据包；第二流表下发模块，用于向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器。
结合第二方面的实现方式，在第一种可能的实现方式中，如果虚拟交换机中没有相关流表，则控制器还包括第三流表下发模块，接收模块接收虚拟交换机发送的针对数据包的请求数据包的处理规则消息；第三下发模块向虚拟交换机下发第三流表，第三流表用于虚拟交换机向数据包的目的服务器发送执行动作后的数据包。
结合第二方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
第三方面提供一种开放流通信方法，包括：当负载超过预设阈值时，向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器选择一个服务器作为虚拟交换机；接收控制器下发的流表；根据流表将数据包转送至虚拟交换机以便虚拟交换机对数据包执行动作并发送至数据包的目的服务器。
结合第三方面的实现方式，在第一种可能的实现方式中，根据流表将数据包转送至虚拟交换机，具体为根据流表将使用IP_IN_IP方式封装的数据包转送至虚拟交换机。
结合第三方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
第四方面提供一种业务网关。包括：发送模块，用于当负载超过预设阈值时，向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器选择一个服务器作为虚拟交换机；接收模块，用于接收控制器下发的流表；转送模块，用于根据流表将数据包转送至虚拟交换机以便虚拟交换机对数据包执行动作并发送至数据包的目的服务器。
结合第四方面的实现方式，在第一种可能的实现方式中，转送模块具体用于根据流表将使用IP_IN_IP方式封装的数据包转送至虚拟交换机。
结合第四方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
第五方面提供一种控制器，包括：接收器、处理器、发送器以及存储器，其中：接收器用于接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作；存储器，用于存储程序代码；处理器与接收器连接，用于调用存储器存储的程序代码执行如下方法：根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；发送器还用于向业务网关下发第一流表，第一流表用于业务网关向虚拟交换机转送数据包；发送器还用于向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器。
结合第五方面的实现方式，在第一种可能的实现方式中，如果虚拟交换机中没有相关流表，则接收器还用于接收虚拟交换机发送的针对数据包的请求数据包的处理规则消息；发送器向虚拟交换机下发第三流表，第三流表用于虚拟交换机向数据包的目的服务器发送执行动作后的数据包。
结合第五方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
第六方面提供一种业务网关，包括：发送器、接收器、处理器以及存储器，其中：当负载超过预设阈值时，发送器向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器选择一个服务器作为虚拟交换机；接收器用于接收控制器下发的流表；存储器，用于存储程序代码；处理器用于调用存储器存储的程序代码执行如下方法：根据流表将数据包转送至虚拟交换机以便虚拟交换机对数据包执行动作并发送至数据包的目的服务器。
结合第六方面的实现方式，在第一种可能的实现方式中，处理器执行的方法中，根据流表将数据包转送至虚拟交换机，具体为：根据流表将使用IP_IN_IP方式封装的数据包通过第一数据通道转送至虚拟交换机。
结合第六方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
第七方面提供一种开放流通信系统，包括：控制器、业务网关以及至少一个服务器，其中：业务网关向控制器发送转移处理请求，转移处理请求中包含需要转移的动作；控制器根据需要转移的动作以及网络拓扑结构选择至少一个服务器中的一个服务器作为虚拟交换机；控制器向业务网关下发第一流表；业务网关根据第一流表将数据包转送至虚拟交换机；控制器向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令；虚拟交换机根据第二流表对数据包执行动作并发送至数据包的目的服务器。
结合第七方面的实现方式，在第一种可能的实现方式中，如果虚拟交换机中没有将数据包发送到数据包的目的服务器的流表，则虚拟交换机还用于向控制器发送请求数据包的处理规则消息；控制器还用于向虚拟交换机下发第三流表，第三流表用于虚拟交换机向数据包的目的服务器发送执行动作后的数据包。
结合第七方面的实现方式，在第二种可能的实现方式中，动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
结合第七方面的实现方式，在第三种可能的实现方式中，业务网关用于根据所述第一流表将数据包转送至所述虚拟交换机，具体为根据第一流表将使用IP_IN_IP方式封装的数据包转送至虚拟交换机。
本发明通过接收业务网关发送的需要转移的转移处理请求，包含需要转移的动作；根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；向业务网关下发第一流表，用于业务网关向虚拟交换机转送数据包；向虚拟交换机下发第二流表，包含用于指示虚拟交换机对数据包执行处理动作的指令，以使虚拟交换机对数据包执行处理动作，并将执行处理动作后的数据包发送至数据包的目的服务器，实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
【附图说明】
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是现有技术中的开放流的网络拓扑结构图；
图2是本发明的开放流的网络拓扑结构图；
图3 是图2中业务网关上报控制器的消息格式示意图；
图4是图2中控制器下发的各消息格式示意图；
图5 是图2中控制器下发第二流表的消息格式示意图
图6是本发明第一实施例的开放流通信方法的流程示意图；
图7是本发明第一实施例的控制器的结构示意图；
图8 是本发明第二实施例的开放流通信方法的流程示意图；
图9是本发明第一实施例的业务网关的结构示意图；
图10是本发明第二实施例的控制器的结构示意图；
图11是本发明第二实施例的业务网关的结构示意图；
图12是本发明第一实施例的开放流通信系统的结构示意图。
【具体实施方式】
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
请参阅图2 ，图2是本发明的开放流的网络拓扑结构图。如图2 所示，开放流的网络拓扑包括：业务网关22、控制器21、虚拟交换机23、目的服务器24以及路由器25。以解密为例，当业务网关22收到数据包解密请求时，检查系统负载，如果负载超过给定阈值，即业务网关22的处理能力不足，则参照图2，执行以下过程：
1、业务网关22将需要转移的请求资源上报控制器21。其中，所需转移的请求资源与动作（Action）对应，其中，动作为等待处理的处理过程或需要执行的操作等。假设此处的动作为解密动作，则所需转移的请求资源与解密相关，业务网关22以资源请求消息的形式向控制器21上报所需转移的请求资源，具体的资源请求消息的格式如图3所示，其中，IP（Internet Protocol，网络互连协议）包括源IP和目的IP，源IP为业务网关22的IP地址，目的IP为控制器21的IP地址，TCP（Transmission Control Protocol，传输控制协议）表示资源请求消息通过TCP协议的端口进行传送，本实施例中优选为6633端口，OF表示资源请求消息的传送过程严格遵循openflow（开放流）协议，S_req的值为1，代表消息为资源请求，Req_type代表资源请求的类型，其数据长度为4个字节，优选地，1为加密资源，2为解密资源，3为压缩资源等。在本发明的其他实施例中，也可以是其他的动作，如解压缩动作，DPI(Deep Packet Inspection，深度包检测技术)扫描等等。不同的动作对应的所需转移的请求资源也就不同。本处实施例中，业务网关22向控制器21发送资源请求消息，表明按照openflow协议进行资源请求，请求解密资源。
2、控制器21根据业务网关22上报的所需资源以及网络拓扑结构，在后端交换机集群中选择一个合适的服务器作为虚拟交换机23，且优选的尽可能与目的服务器距离为最短的路径。
3、控制器21下发第一流表，以在业务网关22与虚拟交换机23之间，建立第一数据通道，用于业务网关22向虚拟交换机23转送数据包。具体地，控制器21向业务网关22下发第一流表，其格式如图4中的a)所示，其中，F_add 表示添加一条流表， Action中填写PUSH_IPHEAD表示为增加IP头操作，IP、TCP、OF与图3中的资源请求消息中的含义相同，在此不再赘述。控制器21还向虚拟交换机23下发第一流表，其格式如图4中的b)所示，Action中填写POP_IPHEAD表示为删除IP头操作。在本发明实施例中，业务网关22与虚拟交换机23之间，使用IP_IN_IP（IP里面封装IP）方式传输数据，要传输的数据为业务网关22在流表操作前的数据包，即原始数据包，如图4中的c)所示。在此基础上业务网关22根据流表执行封装“VGW_IP”操作，得到的流表操作后的数据包格式，其中“VGW_IP”为虚拟交换机23的IP，如图4中的d)所示。业务网关22将流表操作后的数据包发送到虚拟交换机23，得到虚拟交换机23执行流表操作前数据包格式，如图4中的e)所示。虚拟交换机23执行流表操作删除IP头，得到流表操作后数据包格式，如图4中的f)所示。当然，在本发明的其他实施例中，也可以采用其他的方式来传输数据，如直接修改MAC（Media Access Control，介质访问控制）地址等。在业务网关22与虚拟交换机23之间建立第一数据通道并传输数据的同时，控制器21还下发带第二流表到选中的虚拟交换机23中，第二流表包含用于指示虚拟交换机23对数据包执行动作的指令。控制器21向虚拟交换机23下发的第二流表的格式如图5所示，要执行的动作为解密， KEY和KEY_LEN分别表示密钥和密钥的长度。
4、虚拟交换机23执行解密动作，得到原始数据包信息。
5、虚拟交换机23根据原始数据包信息，将数据包转发至目的服务器24。如果虚拟交换机23中没有相关流表，则向控制器21发送针对数据包的请求数据包处理规则的PACKET_IN消息，由控制器21下发第三流表为虚拟交换机23和目的服务器24之间建立第二数据通道，用于虚拟交换机23向数据包的目的服务器24发送执行所述动作后的数据包。在本发明实施例中，目的服务器24与虚拟交换机23可能是同一个服务器，也可能不是同一个服务器。而控制器21为虚拟交换机23和目的服务器24之间建立第二数据通道时，虚拟交换机23可以通过路由器25与目的服务器建立第二数据通道。
如此完成了在业务网关22检查到系统负载超过给定阈值时，通过控制器21将业务网关22的动作转移到虚拟交换机23执行。后续如果业务网关22继续收到动作请求，并且检查到系统负载超过给定阈值，则重复执行上述过程，将业务网关22的动作迁移到虚拟交换机23执行，直到业务网关22不再收到动作请求或未检查到系统负载超过给定阈值，此时系统稳定。如此在业务网关22处理能力不足时，将一部份数据处理业务从业务网关22转移到虚拟交换机23执行，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
参见图6，图6是本发明第一实施例的开放流通信方法的流程示意图。如图6所示，开放流通信方法包括：
S10：接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作。
其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。在S10中，业务网关检查到系统负载超过给定阈值，需要将动作进行转移。接收业务网关发送的需要转移的动作也就是接收业务网关发送的与动作相关的请求资源，以便转移到其他网元执行该动作。
S11：根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机。
S12：向业务网关下发第一流表，第一流表用于业务网关向虚拟交换机转送数据包。
在S12中，在向业务网关下发第一流表的同时还向虚拟交换机下发第一流表。向业务网关下发的第一流表指示增加IP头操作，即表示由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而向虚拟交换机下发的第一流表指示删除IP头操作，即在接收业务网关转送的数据包的基础上去除封装的IP，如此虚拟交换机即可获得原始的数据包。
S13：向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器。优选的，下发的第二流表还包含与动作对应的资源信息，以使虚拟交换机根据资源信息对数据包执行动作，例如，根据解密相关的密钥信息执行解密操作。
在S13中， 动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一种，与动作对应的资源信息包括密钥或DPI规则等。如此在业务网关上处理能力不足时，将一部份数据处理业务从业务网关转移到虚拟服务器执行，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
如果虚拟交换机中没有将数据包发送到数据包的目的服务器的流表，则接收虚拟交换机发送的PACKET_IN消息，生成第三流表；向虚拟交换机下发第三流表，在虚拟交换机与目的服务器之间建立第二数据通道，第三流表用于虚拟交换机向数据包的目的服务器发送执行所述动作后的数据包。在本发明实施例中，目的服务器与虚拟交换机可能是同一个服务器，也可能不是同一个服务器。而虚拟交换机和目的服务器之间建立第二数据通道时，可以通过路由器在两者之间建立第二数据通道。
请参阅图7，图7是本发明第一实施例的控制器的结构示意图。如图7所示，控制器10包括：接收模块101、选择模块102、第一流表下发模块103、第二流表下发模块104以及第三流表下发模块105。
接收模块101用于接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作。选择模块102与接收模块连接101，用于根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机。其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。第一流表下发模块103与选择模块102连接，用于向业务网关下发第一流表，在业务网关与虚拟交换机之间建立第一数据通道，第一流表用于业务网关向虚拟交换机转送数据包。在本发明实施例中，第一流表下发模块103在向业务网关下发第一流表的同时，还向虚拟交换机下发第一流表。向业务网关下发的第一流表指示增加IP头操作，即表示由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而向虚拟交换机下发的第一流表指示删除IP头操作，即在接收业务网关转送的数据包的基础上去除封装的IP，如此虚拟交换机即可获得原始的数据包。第二流表下发模块104，与选择模块102以及第一下发模块103连接，用于向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器。进一步的，第二流表中还包括与动作对应的资源信息，包括密钥或DPI规则等与执行动作操作相关的信息。在本发明实施例中，如果虚拟交换机中没有将数据包发送到数据包的目的服务器的流表，则接收模块101还用于接收虚拟交换机发送的针对数据包的PACKET_IN消息；第三下发流表模块105向虚拟交换机下发第三流表，在虚拟交换机与目的服务器之间建立第二数据通道，第三流表用于虚拟交换机向数据包的目的服务器发送执行动作后的数据包。如此在业务网关上处理能力不足时，将一部份数据处理业务从业务网关转移到虚拟服务器执行，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
请参阅图8，图8是本发明第二实施例的开放流通信方法的流程示意图。如图8所示，开放流通信方法包括：
S20：当负载超过预设阈值时，向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器选择一个服务器作为虚拟交换机。其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
S21：接收控制器下发的流表。
S22：根据流表将数据包转送至虚拟交换机以便虚拟交换机对数据包执行动作并发送至数据包的目的服务器。在S32中，根据流表将使用IP_IN_IP方式封装的数据包转送至虚拟交换机。具体地，由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而虚拟交换机在接收到业务网关转送的数据包后去除封装的IP，即可获得原始的数据包。
在本发明实施例中，当负载超过预设阈值时，将一部份数据处理业务转移到虚拟服务器执行，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
请参阅图9，图9是本发明第一实施例的业务网关的结构示意图。如图9所示，业务网关20包括：发送模块201、接收模块202以及转送模块203。
发送模块201用于当负载超过预设阈值时，向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器选择一个服务器作为虚拟交换机。其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。接收模块202与发送模块201连接，用于接收控制器下发的流表。转送模块203与接收模块202连接，用于根据流表将数据包转送至虚拟交换机以便虚拟交换机对数据包执行动作并发送至数据包的目的服务器。其中，转送模块203根据数据包将使用IP_IN_IP方式封装的数据包转送至虚拟交换机。具体地，由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而虚拟交换机在接收到业务网关转送的数据包后去除封装的IP，即可获得原始的数据包。
在本发明实施例中，当负载超过预设阈值时，发送模块201向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器以选择一个服务器作为虚拟交换机，接收模块202接收控制器下发的流表，转送模块203根据数据流表将数据包转送至虚拟交换机以便所述虚拟交换机对数据包执行动作并发送至数据包的目的服务器，如此在业务网关上处理能力不足时，将一部份数据处理业务从业务网关转移到虚拟服务器执行，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
请参阅图10，图10是本发明第二实施例的控制器的结构示意图。如图10所示，控制器30包括：接收器301、处理器302、发送器303、存储器304以及数据总线305。接收器301、处理器302、发送器303、存储器304通过数据总线305相连，以进行相互通信。
在本发明实施例中，接收器301用于接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作。存储器用于存储程序代码。处理器302用于调用存储器存储的程序代码执行如下方法：根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机。其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。发送器303向业务网关下发第一流表，在业务网关与虚拟交换机之间建立第一数据通道，第一流表用于业务网关向虚拟交换机转送数据包。在本发明实施例中，发送器303在向业务网关下发第一流表的同时，还向虚拟交换机下发第一流表。向业务网关下发的第一流表指示增加IP头操作，即表示由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而向虚拟交换机下发的第一流表指示删除IP头操作，即在接收业务网关转送的数据包的基础上去除封装的IP，如此虚拟交换机即可获得原始的数据包。
发送器303还向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器。其中第二流表中还可以包括与动作对应的资源信息，与动作对应的资源信息包括密钥或DPI规则等。存储器304还用于存储网络拓扑结构、发送器403向业务网关下发的第一流表以及向虚拟交换机下发的第二流表等。如果虚拟交换机中没有相关流表，则接收器接收虚拟交换机发送的PACKET_IN消息；发送器向虚拟交换机下发第三流表，第三流表用于虚拟交换机向数据包的目的服务器发送执行动作后的数据包。在本发明实施例中，通过将一部份数据处理业务从业务网关转移到虚拟服务器执行，能够实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
请参阅图11，图11是本发明第二实施例的业务网关的结构示意图。如图11所示，业务网关40包括：接收器401、处理器402、发送器403、存储器404以及通信总线405。接收器401、处理器402、发送器403、存储器404通过数据总线405相连，以进行相互通信。
在本发明实施例中，当负载超过预设阈值时，发送器403用于向控制器发送转移处理请求，转移处理请求中包含需要转移的动作以便控制器选择一个服务器作为虚拟交换机。其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。接收器401用于接收控制器下发的流表。存储器用于存储程序代码。存储器还用于存储该流表。处理器402调用存储器存储的程序代码执行如下方法：根据流表将数据包转送至虚拟交换机以便虚拟交换机对数据包执行动作并发送至数据包的目的服务器。其中，处理器402执行的方法中，根据流表将使用IP_IN_IP方式封装的数据包转送至虚拟交换机。具体地，由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而虚拟交换机在接收到业务网关转送的数据包后去除封装的IP，即可获得原始的数据包。存储器404存储需要转移的动作以及由控制器下发的流表。在本发明实施例中，当负载超过预设阈值时，通过将一部份数据处理业务从业务网关转移到了虚拟服务器中执行，实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
请参阅图12，图12是本发明第一实施例的开放流通信系统的结构示意图。如图12所示，开放流通信系统50包括：控制器501、业务网关502以及服务器503。服务器503中有多个，可以选其中之一为虚拟交换机504或目的服务器505。业务网关502向控制器501发送转移处理请求，转移处理请求中包含需要转移的动作。其中，动作为等待处理的处理过程或需要执行的操作等。动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。控制器501根据需要转移的动作以及网络拓扑结构选择一个服务器503作为虚拟交换机504。控制器501向业务网关502下发第一流表。业务网关502根据第一流表将数据包转送至虚拟交换机504。具体地，业务网关502根据第一流表将使用IP_IN_IP方式封装的数据包转送至虚拟交换机504。具体地，由业务网关转送到虚拟交换机的数据包在原始的数据包的基础上封装了虚拟交换机的IP。而虚拟交换机在接收到业务网关转送的数据包后去除封装的IP，即可获得原始的数据包。控制器501向虚拟交换机504下发第二流表，第二流表包含用于指示虚拟交换机504对数据包执行动作的指令。虚拟交换机504根据第二流表对数据包执行动作并发送至数据包的目的服务器505。进一步的，第二流表还包含与动作对应的资源信息，例如解密相关的密钥信息，以便于虚拟交换机504根据资源信息执行动作。如果虚拟交换机504中没有将数据包发送到数据包的目的服务器505的流表，则虚拟交换机504向控制器501发送PACKET_IN消息请求数据包的处理规则；控制器501向虚拟交换机504下发第三流表，第三流表用于虚拟交换机504向数据包的目的服务器505发送执行动作后的数据包。如此在业务网关502上处理能力不足时，将一部份数据处理业务从业务网关502转移到虚拟服务器执行，实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
综上所述，本发明通过接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作；并根据需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；再向业务网关下发第一流表，第一流表用于业务网关向虚拟交换机转送数据包；向虚拟交换机下发第二流表，第二流表包含用于指示虚拟交换机对数据包执行动作的指令，以使虚拟交换机对数据包执行动作，并将执行动作后的数据包发送至数据包的目的服务器，能够在业务网关上处理能力不足时，将一部份数据处理业务从业务网关转移到虚拟服务器执行，实现系统中各网元的负载均衡，提高系统的利用率和吞吐量，进而提高整个系统的性能。
以上所述仅为本发明的实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (22)

  1. 一种开放流通信方法，其特征在于，所述方法包括：
    接收业务网关发送的转移处理请求，所述转移处理请求中包含需要转移的动作；
    根据所述需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；
    向所述业务网关下发第一流表，所述第一流表用于所述业务网关向所述虚拟交换机转送数据包；
    向所述虚拟交换机下发第二流表，所述第二流表包含用于指示所述虚拟交换机对所述数据包执行所述动作的指令，以使所述虚拟交换机对所述数据包执行所述动作，并将执行所述动作后的所述数据包发送至所述数据包的目的服务器。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：如果所述虚拟交换机中没有将所述数据包发送到所述数据包的目的服务器的流表，则
    接收所述虚拟交换机发送的针对所述数据包的请求数据包的处理规则消息；
    向所述虚拟交换机下发第三流表，所述第三流表用于所述虚拟交换机向所述数据包的目的服务器发送执行所述动作后的所述数据包。
  3. 根据权利要求1所述的方法，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  4. 一种控制器，其特征在于，所述控制器包括：
    接收模块，用于接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作；
    选择模块，用于根据所述需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；
    第一流表下发模块，用于向所述业务网关下发第一流表，所述第一流表用于所述业务网关向所述虚拟交换机转送数据包；
    第二流表下发模块，用于向所述虚拟交换机下发第二流表，所述第二流表包含用于指示所述虚拟交换机对所述数据包执行所述动作的指令，以使所述虚拟交换机对所述数据包执行所述动作，并将执行所述动作后的所述数据包发送至所述数据包的目的服务器。
  5. 根据权利要求4所述的控制器，其特征在于，如果所述虚拟交换机中没有将所述数据包发送到所述数据包的目的服务器的流表，则所述控制器还包括第三流表下发模块，
    所述接收模块接收所述虚拟交换机发送的针对所述数据包的请求所述数据包的处理规则消息；
    所述第三下发流表模块向所述虚拟交换机下发第三流表，所述第三流表用于所述虚拟交换机向所述数据包的目的服务器发送执行所述动作后的所述数据包。
  6. 根据权利要求4所述的控制器，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  7. 一种开放流通信方法，其特征在于，所述方法包括：
    当负载超过预设阈值时，向控制器发送转移处理请求，所述转移处理请求中包含需要转移的动作以便所述控制器选择一个服务器作为虚拟交换机；
    接收所述控制器下发的流表；
    根据所述流表将数据包转送至所述虚拟交换机以便所述虚拟交换机对所述数据包执行所述动作并发送至所述数据包的目的服务器。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述流表将数据包转送至所述虚拟交换机，具体为根据所述流表将使用IP_IN_IP方式封装的所述数据包转送至所述虚拟交换机。
  9. 根据权利要求7所述的方法，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  10. 一种业务网关，其特征在于，所述业务网关包括：
    发送模块，用于当负载超过预设阈值时，向控制器发送转移处理请求，所述转移处理请求中包含需要转移的动作以便所述控制器选择一个服务器作为虚拟交换机；
    接收模块，用于接收所述控制器下发的流表；
    转送模块，用于根据所述流表将数据包转送至所述虚拟交换机以便所述虚拟交换机对所述数据包执行所述动作并发送至所述数据包的目的服务器。
  11. 根据权利要求10所述的业务网关，其特征在于，所述转送模块具体用于根据所述流表将使用IP_IN_IP方式封装的所述数据包转送至所述虚拟交换机。
  12. 根据权利要求10所述的业务网关，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  13. 一种控制器，其特征在于，所述控制器包括接收器、处理器、发送器以及存储器，其中：
    所述接收器用于接收业务网关发送的转移处理请求，转移处理请求中包含需要转移的动作；
    所述存储器，用于存储程序代码；
    所述处理器用于调用所述存储器存储的程序代码执行如下方法：根据所述需要转移的动作以及网络拓扑结构选择一个服务器作为虚拟交换机；
    所述发送器还用于向所述业务网关下发第一流表，所述第一流表用于所述业务网关向所述虚拟交换机转送数据包；
    所述发送器还用于向所述虚拟交换机下发第二流表，所述第二流表包含用于指示所述虚拟交换机对所述数据包执行所述动作的指令，以使所述虚拟交换机对所述数据包执行所述动作，并将执行所述动作后的所述数据包发送至所述数据包的目的服务器。
  14. 根据权利要求13所述的控制器，其特征在于，如果所述虚拟交换机中没有相关流表，则
    所述接收器还用于接收所述虚拟交换机发送的针对所述数据包的请求所述数据包的处理规则消息；
    所述发送器向所述虚拟交换机下发第三流表，所述第三流表用于所述虚拟交换机向所述数据包的目的服务器发送执行所述动作后的所述数据包。
  15. 根据权利要求13所述的控制器，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  16. 一种业务网关，其特征在于，所述业务网关包括发送器、接收器、处理器以及存储器，其中：
    当负载超过预设阈值时，所述发送器用于向控制器发送转移处理请求，所述转移处理请求中包含需要转移的动作以便所述控制器选择一个服务器作为虚拟交换机；
    所述接收器用于接收所述控制器下发的流表；
    所述存储器，用于存储程序代码；
    所述处理器用于调用所述存储器存储的程序代码执行如下方法：根据所述流表将数据包转送至所述虚拟交换机以便所述虚拟交换机对所述数据包执行所述动作并发送至所述数据包的目的服务器。
  17. 根据权利要求16所述的业务网关，其特征在于，所述处理器执行的方法中，根据所述流表将数据包转送至所述虚拟交换机，具体为：
    根据所述流表将使用IP_IN_IP方式封装的数据包通过所述第一数据通道转送至所述虚拟交换机。
  18. 根据权利要求16所述的业务网关，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  19. 一种开放流通信系统，其特征在于，所述系统包括控制器、业务网关以及至少一个服务器，其中：
    所述业务网关向所述控制器发送转移处理请求，所述转移处理请求中包含需要转移的动作；
    所述控制器根据所述需要转移的动作以及网络拓扑结构选择所述至少一个服务器中的一个服务器作为虚拟交换机；
    所述控制器向所述业务网关下发第一流表；
    所述业务网关根据所述第一流表将数据包转送至所述虚拟交换机；
    所述控制器向所述虚拟交换机下发第二流表，所述第二流表包含用于指示所述虚拟交换机对所述数据包执行所述动作的指令；
    所述虚拟交换机根据所述第二流表对所述数据包执行所述动作并发送至所述数据包的目的服务器。
  20. 根据权利要求19所述的系统，其特征在于，如果所述虚拟交换机中没有将所述数据包发送到所述数据包的目的服务器的流表，则
    所述虚拟交换机还用于向所述控制器发送请求数据包的处理规则消息；
    所述控制器还用于向所述虚拟交换机下发第三流表，所述第三流表用于所述虚拟交换机向所述数据包的目的服务器发送执行所述动作后的所述数据包。
  21. 根据权利要求19所述的系统，其特征在于，所述动作包括数据包加密、解密、深度包检测、数据压缩或数据解压缩中的至少一个。
  22. 根据权利要求19所述的系统，其特征在于，所述业务网关用于根据所述第一流表将数据包转送至所述虚拟交换机，具体为根据所述第一流表将使用IP_IN_IP方式封装的所述数据包转送至所述虚拟交换机。
PCT/CN2014/079084 2014-06-03 2014-06-03 开放流通信方法、系统、控制器和业务网关 WO2015184586A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
PCT/CN2014/079084 WO2015184586A1 (zh) 2014-06-03 2014-06-03 开放流通信方法、系统、控制器和业务网关
EP14894130.5A EP3142306B1 (en) 2014-06-03 2014-06-03 Openflow communication method, system, controller, and service gateway
KR1020167036645A KR101938623B1 (ko) 2014-06-03 2014-06-03 오픈 플로우 통신 방법, 시스템, 제어기 및 서비스 게이트웨이
CN201480078716.1A CN106464596B (zh) 2014-06-03 2014-06-03 开放流通信方法、系统、控制器和业务网关
JP2016571162A JP6395867B2 (ja) 2014-06-03 2014-06-03 ＯｐｅｎＦｌｏｗ通信方法及びシステム、制御部、並びにサービスゲートウェイ
US15/369,191 US10148565B2 (en) 2014-06-03 2016-12-05 OPENFLOW communication method and system, controller, and service gateway

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/079084 WO2015184586A1 (zh) 2014-06-03 2014-06-03 开放流通信方法、系统、控制器和业务网关

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/369,191 Continuation US10148565B2 (en) 2014-06-03 2016-12-05 OPENFLOW communication method and system, controller, and service gateway

Publications (1)

Publication Number Publication Date
WO2015184586A1 true WO2015184586A1 (zh) 2015-12-10

Family

ID=54765928

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/079084 WO2015184586A1 (zh) 2014-06-03 2014-06-03 开放流通信方法、系统、控制器和业务网关

Country Status (6)

Country Link
US (1) US10148565B2 (zh)
EP (1) EP3142306B1 (zh)
JP (1) JP6395867B2 (zh)
KR (1) KR101938623B1 (zh)
CN (1) CN106464596B (zh)
WO (1) WO2015184586A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110933118A (zh) * 2020-02-20 2020-03-27 深圳市城市交通规划设计研究中心股份有限公司 边缘计算网关安全通信方法、系统、终端设备及服务器

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9820316B2 (en) * 2013-03-15 2017-11-14 Aerohive Networks, Inc. Preventing asymmetric routing using network tunneling
CN106713182B (zh) * 2015-08-10 2020-10-09 华为技术有限公司 一种处理流表的方法及装置
US10489275B2 (en) * 2016-10-20 2019-11-26 Cisco Technology, Inc. Agentless distributed monitoring of microservices through a virtual switch
CN107800696B (zh) * 2017-10-23 2020-07-03 国云科技股份有限公司 一种云平台虚拟交换机上通信伪造源识别方法
US11190458B2 (en) * 2017-11-15 2021-11-30 Vmware, Inc. Network functions support for serverless and granular computing environments
CN109450811B (zh) * 2018-11-30 2022-08-12 新华三云计算技术有限公司 流量控制方法、装置及服务器
CN111327437B (zh) * 2018-12-14 2023-04-07 中国电信股份有限公司 流表处理方法、流表处理装置以及sdn网络系统
US11360798B2 (en) * 2019-11-25 2022-06-14 Nutanix, Inc. System and method for internal scalable load service in distributed object storage system
US20230213903A1 (en) * 2022-01-03 2023-07-06 Johnson Controls Tyco IP Holdings LLP Building management system with adaptive edge processing for gateways
CN115460155A (zh) * 2022-07-25 2022-12-09 新华三技术有限公司 Sdwan应用流量控制方法、装置、设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102884763A (zh) * 2012-06-30 2013-01-16 华为技术有限公司 跨数据中心的虚拟机迁移方法、服务控制网关及系统
US20130055257A1 (en) * 2011-08-25 2013-02-28 Fujitsu Limited Communication method and communication apparatus
CN103329488A (zh) * 2011-01-13 2013-09-25 日本电气株式会社 网络系统和路由控制方法
US8640127B2 (en) * 2010-09-21 2014-01-28 International Business Machines Corporation Relocating guest machine using proxy tool having multiple virtual machines where one virtual machines provides host route for relocation
CN103621027A (zh) * 2011-05-30 2014-03-05 日本电气株式会社 通信路由控制系统和通信路由控制方法

Family Cites Families (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4466188B2 (ja) * 2003-07-16 2010-05-26 株式会社デンソー 車両用制御装置
KR100818977B1 (ko) 2004-05-20 2008-04-07 프리비트 가부시키가이샤 클라이언트 기기에 대한 접속을 라우팅 하기 위한서버
US20060187838A1 (en) * 2005-02-24 2006-08-24 Utstarcom, Inc. Method and system for load balancing in a network platform
US20060277303A1 (en) * 2005-06-06 2006-12-07 Nikhil Hegde Method to improve response time when clients use network services
US7693073B2 (en) * 2006-10-13 2010-04-06 At&T Intellectual Property I, L.P. System and method for routing packet traffic
KR100914430B1 (ko) * 2007-05-02 2009-08-28 인하대학교 산학협력단 Ｘｍｌ 전자서명을 이용한 서비스 이동 관리 시스템 및관리 방법
CN101635702B (zh) * 2008-07-21 2013-04-03 山石网科通信技术（北京）有限公司 应用安全策略的数据包转发方法
JPWO2011049135A1 (ja) * 2009-10-23 2013-03-14 日本電気株式会社 ネットワークシステムとその制御方法、及びコントローラ
JP5532276B2 (ja) 2010-10-15 2014-06-25 日本電気株式会社 スイッチシステム、及びデータ転送方法
CA2814072A1 (en) 2010-10-15 2012-04-19 Nec Corporation Switch system, and monitoring centralized control method
CN101980490B (zh) * 2010-12-01 2012-09-26 杭州华三通信技术有限公司 虚拟交换机和物理交换机的链路建立方法及其装置
WO2013086204A1 (en) * 2011-12-07 2013-06-13 Citrix Systems, Inc. Controlling a network interface using virtual switch proxying
US8923296B2 (en) * 2012-02-23 2014-12-30 Big Switch Networks, Inc. System and methods for managing network packet forwarding with a controller
US8862883B2 (en) * 2012-05-16 2014-10-14 Cisco Technology, Inc. System and method for secure cloud service delivery with prioritized services in a network environment
EP2853066B1 (en) * 2012-05-23 2017-02-22 Brocade Communications Systems, Inc. Layer-3 overlay gateways
US9710762B2 (en) * 2012-06-06 2017-07-18 Juniper Networks, Inc. Dynamic logging
US9668161B2 (en) * 2012-07-09 2017-05-30 Cisco Technology, Inc. System and method associated with a service flow router
CN103227843B (zh) * 2012-08-31 2016-05-04 杭州华三通信技术有限公司 一种物理链路地址管理方法及装置
CN102843300A (zh) 2012-09-12 2012-12-26 盛科网络（苏州）有限公司 实现Openflow交换机系统中控制器负载平衡的方法及系统
US9787570B2 (en) * 2012-10-17 2017-10-10 Verizon Patent And Licensing Inc. Dynamic feature peer network for application flows
EP2922246B1 (en) * 2012-12-06 2019-04-03 Huawei Technologies Co., Ltd. Method and data center network for cross-service zone communication
CN103179046B (zh) 2013-04-15 2016-03-30 昆山天元昌电子有限公司 基于openflow的数据中心流量控制方法及系统
CN104168184B (zh) * 2013-05-17 2017-07-14 新华三技术有限公司 报文转发方法及设备
CN103338117B (zh) * 2013-05-30 2016-12-28 华为技术有限公司 一种虚拟交换机的管理方法、设备及系统
US9882733B2 (en) * 2013-06-14 2018-01-30 Telefonaktiebolaget Lm Ericsson (Publ) Migrating eMBMS into a cloud computing system
US9467366B2 (en) * 2013-07-03 2016-10-11 Avaya Inc. Method and apparatus providing single-tier routing in a shortest path bridging (SPB) network
US9455901B2 (en) * 2013-10-04 2016-09-27 Nicira, Inc. Managing software and hardware forwarding elements to define virtual networks
US9124536B2 (en) * 2013-12-12 2015-09-01 International Business Machines Corporation Managing data flows in overlay networks
JP2015159500A (ja) * 2014-02-25 2015-09-03 日本電気株式会社 オープンフロー制御装置、経路管理方法およびプログラム
WO2015146355A1 (ja) * 2014-03-28 2015-10-01 株式会社Ｎｔｔドコモ 更新管理システムおよび更新管理方法
CN105262685B (zh) * 2014-07-14 2018-10-09 新华三技术有限公司 一种报文处理方法和装置
CN105812260B (zh) * 2014-12-31 2019-03-19 华为技术有限公司 一种控制mac地址转发表发送的方法、装置及系统
US9853898B1 (en) * 2015-04-29 2017-12-26 Juniper Networks, Inc. Dynamic service chain provisioning
US11005682B2 (en) * 2015-10-06 2021-05-11 Cisco Technology, Inc. Policy-driven switch overlay bypass in a hybrid cloud network environment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8640127B2 (en) * 2010-09-21 2014-01-28 International Business Machines Corporation Relocating guest machine using proxy tool having multiple virtual machines where one virtual machines provides host route for relocation
CN103329488A (zh) * 2011-01-13 2013-09-25 日本电气株式会社 网络系统和路由控制方法
CN103621027A (zh) * 2011-05-30 2014-03-05 日本电气株式会社 通信路由控制系统和通信路由控制方法
US20130055257A1 (en) * 2011-08-25 2013-02-28 Fujitsu Limited Communication method and communication apparatus
CN102884763A (zh) * 2012-06-30 2013-01-16 华为技术有限公司 跨数据中心的虚拟机迁移方法、服务控制网关及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3142306A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110933118A (zh) * 2020-02-20 2020-03-27 深圳市城市交通规划设计研究中心股份有限公司 边缘计算网关安全通信方法、系统、终端设备及服务器

Also Published As

Publication number Publication date
CN106464596A (zh) 2017-02-22
EP3142306A4 (en) 2017-06-14
JP6395867B2 (ja) 2018-09-26
KR101938623B1 (ko) 2019-01-15
KR20170013332A (ko) 2017-02-06
EP3142306A1 (en) 2017-03-15
US20170085473A1 (en) 2017-03-23
EP3142306B1 (en) 2019-01-09
US10148565B2 (en) 2018-12-04
CN106464596B (zh) 2019-08-20
JP2017517220A (ja) 2017-06-22

Similar Documents

Publication Publication Date Title
WO2015184586A1 (zh) 开放流通信方法、系统、控制器和业务网关
CN202206418U (zh) 流量管理设备、系统和处理器
US8473620B2 (en) Interception of a cloud-based communication connection
WO2018227519A1 (zh) 一种实现网络互连的系统、方法及装置
WO2023000935A1 (zh) 一种数据处理方法、网元设备以及可读存储介质
KR101527786B1 (ko) 하이브리드 sdn 네트워크 관리 방법
WO2020063298A1 (zh) 处理tcp报文的方法、toe组件以及网络设备
US9537755B2 (en) Access relay method and access gateway device
CN106713499A (zh) 一种负载均衡方法、设备及系统
CN109088820B (zh) 一种跨设备链路聚合方法、装置、计算装置和存储介质
CN110505244B (zh) 远程隧道访问技术网关以及服务器
JP2004524768A (ja) ネットワークアプリケーション用に保護処理機能を分配するシステム及び方法
CN103391296A (zh) 一种控制器、转发器及通道建立方法和系统
WO2023000940A1 (zh) 数据处理方法、装置、网元设备、存储介质及程序产品
WO2014079335A1 (zh) Ip报文处理方法、装置及网络系统
CN107846365A (zh) 一种基于sdn的负载均衡实现系统及方法
WO2016026089A1 (zh) 软件定义网络与传统网络的融合方法以及装置
CN115473729B (zh) 数据传输方法、网关、sdn控制器及存储介质
JP2020010326A (ja) ＷｉＦｉ管理フレームを利用したデータ送信方法、データ受信方法及びデータ通信方法
CN101355585B (zh) 一种分布式架构数据通信设备的消息保护系统及方法
JP2011176395A (ja) ＩＰｓｅｃ通信方法およびＩＰｓｅｃ通信システム
CN108064441B (zh) 一种加速网络传输优化方法以及系统
CN104168302B (zh) 设备操控实现方法、系统和代理网关
CN101621528B (zh) 基于以太交换机集群管理的会话系统及会话通道实现方法
CN114070606B (zh) 一种基于国产操作系统的网络安全终端装置及工作方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14894130

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2016571162

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014894130

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014894130

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 1020167036645

Country of ref document: KR