WO2016078260A1 - 一种从控制平面和数据平面访问交换机外存的方法 - Google Patents

一种从控制平面和数据平面访问交换机外存的方法 Download PDF

Info

Publication number
WO2016078260A1
WO2016078260A1 PCT/CN2015/074086 CN2015074086W WO2016078260A1 WO 2016078260 A1 WO2016078260 A1 WO 2016078260A1 CN 2015074086 W CN2015074086 W CN 2015074086W WO 2016078260 A1 WO2016078260 A1 WO 2016078260A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
switch
authorized
instruction
operation instruction
Prior art date
Application number
PCT/CN2015/074086
Other languages
English (en)
French (fr)
Inventor
王玲芳
王劲林
齐卫宁
Original Assignee
中国科学院声学研究所
北京中科智网科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国科学院声学研究所, 北京中科智网科技有限公司 filed Critical 中国科学院声学研究所
Priority to EP15862073.2A priority Critical patent/EP3211851B1/en
Priority to JP2017526917A priority patent/JP6378841B2/ja
Priority to US15/528,098 priority patent/US20170310676A1/en
Priority to KR1020177012726A priority patent/KR101907903B1/ko
Publication of WO2016078260A1 publication Critical patent/WO2016078260A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/067—Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0638—Organizing or formatting or addressing of data
    • G06F3/0643—Management of files
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0655—Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices
    • G06F3/0659—Command handling arrangements, e.g. command buffers, queues, command scheduling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38—Information transfer, e.g. on bus
    • G06F13/40—Bus structure
    • G06F13/4004—Coupling between buses
    • G06F13/4022—Coupling between buses using switching circuits, e.g. switching matrix, connection or expansion network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38—Information transfer, e.g. on bus
    • G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
    • G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus

Definitions

  • the present invention relates to the field of network technologies, and in particular, to a method for accessing a switch external memory from a control plane and a data plane.
  • SDN software-defined network
  • OpenFlow involves two entities: controller and switch. OpenFlow is the southbound interface of the controller, communicating with the switch, and transmitting control information, data, and status. Initially, OpenFlow was used in campus networks, enterprise networks, and data center networks to optimize its control processes and data traffic paths and enhance management controls. Later, due to the flexibility of its control network, network researchers used it to conduct research on future network architectures and protocols. Therefore, Huawei's Protocol Non-Aware Forwarding (POF) and the US P4 language led by Nick Mckeown emerged.
  • PPF Protocol Non-Aware Forwarding
  • OpenFlow The research around OpenFlow will probably involve three aspects: controllers, line protocols and switches, where the controller embodies the control plane, the switch is the data plane, and the line protocol is the bridge between the two.
  • controllers embodies the control plane
  • the switch is the data plane
  • the line protocol is the bridge between the two.
  • the core focus of OpenFlow is the programmable nature of the network. The previous emphasis was on the programmable control plane, which is now programmable into the data plane.
  • the focus is on the computational resources of the switch, the utilization of network resources, and the lack of effective methods for storage resources.
  • the switch in the prior art cannot solve the problem of storage resource control, and cannot effectively access the switch external storage from the control plane and the data plane.
  • the present invention provides a method for accessing a switch external storage from a control plane and a data plane, including:
  • Step 1) The control module sends the information of the authorized entity and the authorized operation to the switch, and the switch receives the Some of the authorized information is stored;
  • Step 2) The switch receives the file I/O operation instruction, and determines, according to the instruction and the authorized information obtained in step 1), whether the operating entity has the right of the file I/O operation instruction;
  • Step 3) An operating entity having authority to the file I/O operation instruction, the switch extracting an instruction index and a parameter from the file I/O operation instruction, and performing a file I/O operation.
  • step 1) the authorized entity and the information authorized to be operated are sent to the switch in the manner of the authorized operation list; wherein the authorized operation list adopts the file operation set defined in POSIX.1. achieve.
  • step 2) further includes:
  • the switch After receiving the file I/O operation instruction, the switch extracts the operation entity and the file I/O operation instruction index from the instruction, and compares the information extracted from the instruction with the authorized information stored in the switch in step 1). Determine whether the operating entity has the authority of the file I/O operation instruction. If yes, execute step 3). Otherwise, the operation is rejected, and the reject message is sent, and the sender of the file I/O operation instruction is sent back.
  • the step 3) further includes: the switch extracts a file I/O operation instruction index and a parameter from the received file I/O operation instruction, and invokes a corresponding local file I/O according to the extracted result.
  • the operation instruction generates a corresponding operation result, and finally the operation result is encapsulated into a message and returned to the caller.
  • the invention solves the problem that the current control plane and the data plane cannot access the external storage of the programmable switch.
  • FIG. 1 is a schematic diagram of a connection relationship between a controller and a switch (including external storage);
  • FIG. 2 is a diagram of a file internal I/O module of the switch
  • FIG. 3 is a flow chart of an access authorization process in the method of the present invention.
  • FIG. 4 is a flow chart of a file I/O operation control process in the method of the present invention.
  • Figure 5 is a flow chart showing the execution process of a file I/O operation in the method of the present invention.
  • Figure 6 is a schematic diagram of a forwarding process at an NDN node.
  • the method for accessing the switch external memory from the control plane and the data plane of the present invention involves the following entities: a control module and a switch.
  • the control module may be a controller or an application, wherein the controller and the control in OpenFlow
  • the function is similar in function.
  • the switch In addition to the role assumed by the controller in OpenFlow, it also has the functions of access authorization control of the switch external storage, and the operation of defining a specific protocol to access the external storage of the switch.
  • the switch is similar in function to the switch in OpenFlow.
  • the switch also has an external storage device and has the function of performing an access operation on the external storage device. As shown in Figure 1, the control module communicates with the switch through a line protocol.
  • the switch and the external storage device can communicate by using the IDE such as IDE, SATA, Fibre Channel, and SCSI.
  • the VFS/file system/device identification/device driver method can be used to implement the localization in the switch operating system. Access, VFS can also be directly mapped to device-driven methods for local access. How to communicate between the switch and the external storage device is not the content of the present invention, and will not be described in detail herein.
  • the method for accessing the switch external storage from the control plane and the data plane of the present invention includes:
  • Step 1) Referring to FIG. 3, the control module sends the information of the authorized entity and the authorized operation to the switch, and the switch stores the authorized information and stores it.
  • the authorized entity involved in this step may be an application or protocol executed in the switch, and the authorized operation may be multiple operations including operations such as reading, writing, and deleting.
  • the authorized entity and the information authorized to be operated are sent to the switch in the manner of being authorized to operate the list.
  • the authorized operation list can be implemented by a set of file operations defined in POSIX.1 or customized, and can be a subset or a complete set thereof, and is represented by a binary mapping table. If the corresponding bit is 1 for authorization, if 0, Without authorization, this can greatly reduce the size of the list of authorized operations that the control module delivers to the switch.
  • the list of authorized operations can also use the text string method, but this will increase the overhead.
  • Step 2 Referring to FIG. 4, after receiving the file I/O operation instruction, the switch extracts the operation entity and the file I/O operation instruction index (the index is the binary mapping code corresponding to the instruction) from the instruction, and the slave will execute the instruction.
  • the extracted information is compared with the authorized information stored in the switch in step 1), and it is judged whether the operating entity has the authority of the file I/O operation instruction, and if so, the next step is executed, otherwise the operation is rejected, and the rejection report is generated.
  • the sender of the file I/O operation instruction is sent back.
  • Step 3 the switch extracts the file I/O operation instruction index and parameters from the received file I/O operation instruction, and invokes the corresponding local file I/O operation instruction according to the extracted result to generate a corresponding The result of the operation, and finally the result of the operation is encapsulated into a message and returned to the caller.
  • the Data part of the Content Store table needs Support for external devices, assuming that data is stored as files.
  • the NDN protocol is developed by the SDN method, and it is assumed that the Ethernet packet is used in the switch.
  • the type field Ethertype corresponding to the NDN is 0x8099 (for illustrative purposes only). The method of the present invention will be described below in conjunction with such a scenario.
  • the action request in the matching action table (the table in the SDN southbound interface protocol Openflow, including the field name, value, action, etc.) Write the payload portion of the message to the local file.
  • the switch receives the file write operation, it extracts the operation entity (ie, NDN), the file write operation instruction index, checks the authorized list, and finds that the file read operation instruction of the NDN is permitted, and performs the file I/O operation.
  • the operation entity ie, NDN
  • the file write operation instruction index checks the authorized list, and finds that the file read operation instruction of the NDN is permitted, and performs the file I/O operation.
  • the switch extracts the file write operation instruction index and the message payload, invokes the local file write operation instruction to perform the write operation, and encapsulates the operation result into a message, and returns the action caller in the matching action table.
  • the switch extracts the operation entity (ie, NDN), the directory operation instruction index, checks the authorized list, and finds that the NDN directory creation operation instruction is prohibited, and rejects the directory creation operation. Operation, and generate a reject message, and send back the action caller in the matching action table.
  • NDN operation entity
  • the switch extracts the operation entity (ie, NDN), the directory operation instruction index, checks the authorized list, and finds that the NDN directory creation operation instruction is prohibited, and rejects the directory creation operation. Operation, and generate a reject message, and send back the action caller in the matching action table.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Human Computer Interaction (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明涉及一种从控制平面和数据平面访问交换机外存的方法，包括：控制模块向交换机下发被授权实体与被授权操作的信息，交换机接收这些被授权信息后存储；交换机接收文件I/O操作指令，根据该指令以及被授权信息确定操作实体是否具有该文件I/O操作指令的权限；对所述文件I/O操作指令有权限的操作实体，所述交换机从所述文件I/O操作指令中提取指令索引与参数，执行文件I/O操作。

Description

一种从控制平面和数据平面访问交换机外存的方法 技术领域
本发明涉及网络技术领域，特别涉及一种从控制平面和数据平面访问交换机外存的方法。
背景技术
自2008年以来，网络界围绕SDN(软件定义网络)展开研究，开始了新一轮的创新热潮。SDN的提出，最早的出发点是为了应付网络故障或网络攻击，在互联网的分布式路由架构下，出现网络故障或攻击之后，很难从一个点启动整个网络，而且路由的交换是不受中心控制的，路由收敛时间在分钟量级，这远远不能满足快速响应。因此，就有研究人员提出一个中心控制点向路由交换设备下发控制策略和路由的观点，这就是SDN。
SDN提出之后，就有必要以实际设备/协议/网络/应用作为验证，在此情况下出现了ONF的OpenFlow。OpenFlow涉及到控制器、交换机两种实体，OpenFlow是控制器的南向接口，与交换机通信，传递控制信息、数据和状态等。最初，OpenFlow被用于校园网、企业网、数据中心网络，优化其控制过程和数据流量路径，增强管理控制。后来由于其控制网络的灵活性，网络研究人员用之进行未来网络架构和协议的研究，因此就出现了华为公司的协议无感知转发(POF)和美国以Nick Mckeown为首的P4语言。围绕OpenFlow展开的研究，将可能涉及三个方面：控制器、线协议和交换机，其中控制器体现控制平面，交换机是数据平面，线协议是联系二者的桥梁。OpenFlow的核心重点是网络的可编程，前期强调的是控制平面的可编程，目前开始转入数据平面的可编程。
在数据平面的可编程方面，关注点在交换机的计算资源、网络资源的利用方面，缺乏存储资源方面的有效方法。现有技术中的交换机无法解决存储资源控制的问题，无法有效地从控制平面和数据平面访问交换机外存。
发明内容
本发明的目的在于克服现有技术中无法有效地从控制平面和数据平面访问交换机外存的缺陷，从而提供一种能够从控制平面和数据平面访问交换机外存的方法。
为了实现上述目的，本发明提供了一种从控制平面和数据平面访问交换机外存的方法，包括：
步骤1)、控制模块向交换机下发被授权实体与被授权操作的信息，交换机接收这 些被授权信息后存储；
步骤2)、交换机接收文件I/O操作指令，根据该指令以及步骤1)所得到的被授权信息确定操作实体是否具有该文件I/O操作指令的权限；
步骤3)、对所述文件I/O操作指令有权限的操作实体，所述交换机从所述文件I/O操作指令中提取指令索引与参数，执行文件I/O操作。
上述技术方案中，在步骤1)中，被授权实体与被授权操作的信息通过被授权操作列表的方式下发给交换机；其中，所述被授权操作列表采用POSIX.1中定义的文件操作集合实现。
上述技术方案中，所述步骤2)进一步包括：
交换机接收到文件I/O操作指令后，从该指令中提取操作实体以及文件I/O操作指令索引，将从指令中所提取的信息与步骤1)中交换机所存储的被授权信息进行比较，判断操作实体是否有该文件I/O操作指令的权限，如果有，则执行步骤3)，否则拒绝操作，并生成拒绝报文，发回文件I/O操作指令的发送方。
上述技术方案中，所述步骤3)进一步包括：交换机从所接收到的文件I/O操作指令中提取文件I/O操作指令索引和参数，根据所提取的结果调用对应的本地文件I/O操作指令，生成相应的操作结果，最后将操作结果封装成报文后返回调用方。
本发明的优点在于：
本发明解决了目前控制平面和数据平面不能访问可编程交换机外存的问题。
附图说明
图1是控制器与交换机(含外存)的连接关系示意图；
图2是交换机内部文件I/O模块图；
图3是本发明方法中访问授权过程的流程图；
图4是本发明方法中文件I/O操作控制过程的流程图；
图5是本发明方法中文件I/O操作执行过程的流程图；
图6是在一个NDN节点处的转发进程的示意图。
具体实施方式
现结合附图对本发明作进一步的描述。
本发明的从控制平面和数据平面访问交换机外存的方法涉及如下实体：控制模块、交换机。所述控制模块可以是控制器或应用，其中，所述控制器与OpenFlow中的控制 器在功能上相近似，其除了要承担OpenFlow中的控制器所承担的角色外，还具有交换机外存的访问授权控制、定义特定协议访问交换机外存的动作等功能。所述交换机与OpenFlow中的交换机在功能上相近似，其除了要承担OpenFlow中的交换机所承担的角色外，该交换机还带有外存设备，并具有对外存设备实施访问操作的功能。如图1所示，控制模块与交换机之间通过线协议通信。
交换机与外存设备之间可采用IDE、SATA、光纤通道、SCSI等总线方式进行通信，如图2所示，在交换机操作系统中可采用VFS/文件系统/设备标识/设备驱动的方法实现本地访问，也可采用VFS直接映射到设备驱动的方法实现本地访问。交换机与外存设备之间如何通信不是本发明的内容，此处不再做详细说明。
本发明的从控制平面和数据平面访问交换机外存的方法包括：
步骤1)、参见图3，控制模块向交换机下发被授权实体与被授权操作的信息，交换机接收这些被授权信息后存储。
本步骤中所涉及的被授权实体可以是交换机中所执行的某一应用程序或协议，被授权的操作可以是包括读、写、删除等操作在内的多种操作。作为一种可选的实现方式，所述被授权实体、被授权操作的信息通过被授权操作列表的方式下发给交换机。被授权操作列表可采用POSIX.1中定义的或自定义的文件操作集合实现，可以是其子集或全集，采用二进制映射表的方式加以表示，若相应位为1表示授权，若为0表示没有授权，这可大幅度降低控制模块向交换机下发被授权操作列表的规模。被授权操作列表也可采用文本串的方法，但这样会增加开销。
步骤2)、参见图4，交换机接收到文件I/O操作指令后，从该指令中提取操作实体以及文件I/O操作指令索引(索引为指令所对应的二进制映射码)，将从指令中所提取的信息与步骤1)中交换机所存储的被授权信息进行比较，判断操作实体是否有该文件I/O操作指令的权限，如果有，则执行下一步，否则拒绝操作，并生成拒绝报文，发回文件I/O操作指令的发送方。
步骤3)、参见图5，交换机从所接收到的文件I/O操作指令中提取文件I/O操作指令索引和参数，根据所提取的结果调用对应的本地文件I/O操作指令，生成相应的操作结果，最后将操作结果封装成报文后返回调用方。
为了便于理解，在下面的实施例中，将结合一个具体的实例对本发明的方法做详细说明。
如图6所示，在命名数据联网的NDN节点中，Content Store表中的Data部分需要 外存设备的支持，假定数据以文件方式存储。在这一场景中，假定采用SDN方法开发NDN协议，并假定交换机中采用以太网报文，在以太网报文中NDN对应的类型字段Ethertype为0x8099(仅做举例说明之用)。下面结合这种场景说明本发明的方法。
控制模块将访问被授权实体(即Ethertype＝0x8099)授权对其目录下的文件读、写、删除操作(其他操作默认为禁止)(假定授权映射表为32位，每位对应一项操作，且这三项操作在最高字节，则对应的16进制为0xe0000000)。控制模块将授权信息“Ethertype＝0x8099，PermittedOperation＝0xe0000000”以被授权操作列表的方式通过安全信道传递给交换机，交换机将被授权实体的标识Ethertype＝0x8099和被允许操作码PermittedOperation＝0xe0000000存储。
假定交换机接收到Ethertype＝0x8099的报文，即NDN的报文；同时在匹配动作表(SDN南向接口协议Openflow中的表格，包含字段名、值、动作(action)等信息)中的动作要求将该报文的净荷部分写入本地文件。交换机接到文件写操作时，提取操作实体(即NDN)、文件写操作指令索引，检查被授权列表，发现NDN的文件读操作指令是允许的，则执行文件I/O操作。
交换机提取到文件写操作指令索引和报文净荷，调用本地文件写操作指令执行写操作，并将操作结果封装成报文，返回匹配动作表中的动作调用方。
如果在动作要求中是目录创建操作，则交换机接到目录创建操作时，提取操作实体(即NDN)、目录操作指令索引，检查被授权列表，发现NDN的目录创建操作指令是禁止的，则拒绝操作，并生成拒绝报文，发回匹配动作表中的动作调用方。
最后所应说明的是，以上实施例仅用以说明本发明的技术方案而非限制。尽管参照实施例对本发明进行了详细说明，本领域的普通技术人员应当理解，对本发明的技术方案进行修改或者等同替换，都不脱离本发明技术方案的精神和范围，其均应涵盖在本发明的权利要求范围当中。

Claims (4)

  1. 一种从控制平面和数据平面访问交换机外存的方法，包括：
    步骤1)、控制模块向交换机下发被授权实体与被授权操作的信息，交换机接收这些被授权信息后存储；
    步骤2)、交换机接收文件I/O操作指令，根据该指令以及步骤1)所得到的被授权信息确定操作实体是否具有该文件I/O操作指令的权限；
    步骤3)、对所述文件I/O操作指令有权限的操作实体，所述交换机从所述文件I/O操作指令中提取指令索引与参数，执行文件I/O操作。
  2. 根据权利要求1所述的从控制平面和数据平面访问交换机外存的方法，其特征在于，在步骤1)中，被授权实体与被授权操作的信息通过被授权操作列表的方式下发给交换机；其中，所述被授权操作列表采用POSIX.1中定义的文件操作集合实现。
  3. 根据权利要求1所述的从控制平面和数据平面访问交换机外存的方法，其特征在于，所述步骤2)进一步包括：
    交换机接收到文件I/O操作指令后，从该指令中提取操作实体以及文件I/O操作指令索引，将从指令中所提取的信息与步骤1)中交换机所存储的被授权信息进行比较，判断操作实体是否有该文件I/O操作指令的权限，如果有，则执行步骤3)，否则拒绝操作，并生成拒绝报文，发回文件I/O操作指令的发送方。
  4. 根据权利要求1所述的从控制平面和数据平面访问交换机外存的方法，其特征在于，所述步骤3)进一步包括：交换机从所接收到的文件I/O操作指令中提取文件I/O操作指令索引和参数，根据所提取的结果调用对应的本地文件I/O操作指令，生成相应的操作结果，最后将操作结果封装成报文后返回调用方。
PCT/CN2015/074086 2014-11-19 2015-03-12 一种从控制平面和数据平面访问交换机外存的方法 WO2016078260A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP15862073.2A EP3211851B1 (en) 2014-11-19 2015-03-12 Method for accessing switch external memory
JP2017526917A JP6378841B2 (ja) 2014-11-19 2015-03-12 制御プレーン及びデータプレーンからスイッチの外部メモリへアクセスする方法
US15/528,098 US20170310676A1 (en) 2014-11-19 2015-03-12 Method for accessing switch external memory from control plane and data plane
KR1020177012726A KR101907903B1 (ko) 2014-11-19 2015-03-12 제어 평면 및 데이터 평면으로부터 스위치 외부 메모리를 엑세스하는 방법

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410665938.5 2014-11-19
CN201410665938.5A CN105635086B (zh) 2014-11-19 2014-11-19 一种从控制平面和数据平面访问交换机外存的方法

Publications (1)

Publication Number Publication Date
WO2016078260A1 true WO2016078260A1 (zh) 2016-05-26

Family

ID=56013161

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/074086 WO2016078260A1 (zh) 2014-11-19 2015-03-12 一种从控制平面和数据平面访问交换机外存的方法

Country Status (6)

Country Link
US (1) US20170310676A1 (zh)
EP (1) EP3211851B1 (zh)
JP (1) JP6378841B2 (zh)
KR (1) KR101907903B1 (zh)
CN (1) CN105635086B (zh)
WO (1) WO2016078260A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10324722B2 (en) * 2016-06-24 2019-06-18 Hewlett Packard Enterprise Development Lp Global capabilities transferrable across node boundaries
CN110138690B (zh) * 2018-02-08 2021-10-26 中兴通讯股份有限公司 交换设备功能扩展方法及装置、交换设备及存储介质
CN108881072A (zh) * 2018-06-19 2018-11-23 中国联合网络通信集团有限公司 数据报文处理方法及交换机
CN109309711B (zh) * 2018-08-30 2020-06-16 中国科学院声学研究所 一种虚拟缓存共享方法和系统
CN110135174A (zh) * 2019-04-22 2019-08-16 佛山职业技术学院 一种文件加密方法、电子设备及外接设备
CN113285838B (zh) * 2021-05-28 2022-08-05 之江实验室 一种基于pof的异构标识网络模型及数据包及管理异构标识网络的方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101047594A (zh) * 2006-03-28 2007-10-03 国际商业机器公司 保护交换结构存储区域网络中节点端口访问的方法和装置
CN103283190A (zh) * 2010-12-24 2013-09-04 日本电气株式会社 通信系统、控制装置、策略管理装置、通信方法和程序
CN103297441A (zh) * 2013-06-25 2013-09-11 福建伊时代信息科技股份有限公司 访问控制方法和装置
US20140247751A1 (en) * 2011-09-09 2014-09-04 Nec Corporation Network management service system, control apparatus, method, and program

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4851988A (en) * 1986-03-31 1989-07-25 Wang Laboratories, Inc. Loosely-coupled computer system using global identifiers to identify mailboxes and volumes
JP4977565B2 (ja) * 2007-09-18 2012-07-18 株式会社日立製作所 アクセス制御リストを用いてファイルへのアクセスを制御するアクセスコントローラ
US9619398B1 (en) * 2009-08-20 2017-04-11 Juniper Networks, Inc. Methods and apparatus for improved access to shared memory
JP2013038660A (ja) * 2011-08-09 2013-02-21 Toyota Infotechnology Center Co Ltd 中層のモジュール、記録媒体およびデータ転送方法
JP5784234B2 (ja) * 2012-09-03 2015-09-24 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． 情報中心ネットワークのための一般化デュアルモードデータ転送プレーン
CN103226448B (zh) * 2013-03-21 2016-09-07 华为技术有限公司 固态硬盘的驱动方法及装置
CN104135539B (zh) * 2014-08-15 2018-03-16 华为技术有限公司 数据存储方法、sdn控制器和分布式网络存储系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101047594A (zh) * 2006-03-28 2007-10-03 国际商业机器公司 保护交换结构存储区域网络中节点端口访问的方法和装置
CN103283190A (zh) * 2010-12-24 2013-09-04 日本电气株式会社 通信系统、控制装置、策略管理装置、通信方法和程序
US20140247751A1 (en) * 2011-09-09 2014-09-04 Nec Corporation Network management service system, control apparatus, method, and program
CN103297441A (zh) * 2013-06-25 2013-09-11 福建伊时代信息科技股份有限公司 访问控制方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3211851A4 *

Also Published As

Publication number Publication date
US20170310676A1 (en) 2017-10-26
CN105635086A (zh) 2016-06-01
JP6378841B2 (ja) 2018-08-22
KR101907903B1 (ko) 2018-10-15
JP2017536766A (ja) 2017-12-07
CN105635086B (zh) 2020-02-04
EP3211851B1 (en) 2019-12-18
EP3211851A4 (en) 2017-10-25
KR20170086495A (ko) 2017-07-26
EP3211851A1 (en) 2017-08-30

Similar Documents

Publication Publication Date Title
WO2016078260A1 (zh) 一种从控制平面和数据平面访问交换机外存的方法
RU2628151C2 (ru) Система связи, узел, устройство управления, способ связи и программа
JP6446032B2 (ja) ディレクトリー・サービス間における資格証明ハッシュの同期
WO2017152754A1 (zh) 软件定义网路sdn安全通信的方法及装置
US11595390B2 (en) Self-organizing trusted networks
US10050859B2 (en) Apparatus for processing network packet using service function chaining and method for controlling the same
WO2015101119A1 (zh) 一种流表匹配的方法、装置和OpenFlow交换系统
JP2010541426A (ja) ネットワークを管理する及び安全にするためのネットワークオペレーティングシステム
WO2010003354A1 (zh) 认证服务器及虚拟专用网的移动通信终端接入控制方法
US20170054688A1 (en) Avc bi-directional correlation using an overlay fabric header
WO2021098873A1 (zh) 数据库的权限控制方法、计算机设备及存储介质
US20170279689A1 (en) Software defined network controller for implementing tenant specific policy
CN105812321B (zh) 一种基于用户信息管理文件资源的网络文件系统和处理方法
US20220394010A1 (en) Method, Apparatus, and System for Sending Control Request Based on Key Value Configuration
JP2019057905A (ja) イーサネット（登録商標）スイッチ用のロールベースの自動構成システム及び方法
WO2021098425A1 (zh) 配置业务的服务质量策略方法、装置和计算设备
Fernando et al. Blockchain-powered software defined network-enabled networking infrastructure for cloud management
US10171306B2 (en) Automatic discovery and provisioning of multi-chassis etherchannel peers
CN105530119B (zh) 用于多层网络抽象的控制器到控制器接口
CN114422160A (zh) 一种虚拟防火墙的设置方法、装置、电子设备和存储介质
US11438420B2 (en) Method and device for establishing multi-domain multi-layer connectivity service
WO2023125675A1 (zh) 一种用于网络切片的用户面数据完整性保护方法和系统
WO2016082363A1 (zh) 用户数据管理方法及装置
JP2012074825A (ja) ＱｏＳ保障型ネットワークシステム、集中制御装置、及び集中制御装置の制御方法
US20170155543A1 (en) Control apparatus, communication system, and control method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15862073

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20177012726

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017526917

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 15528098

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015862073

Country of ref document: EP