WO2017107033A1 - 一种基于身份的集中控制式网络体系架构iccn - Google Patents
一种基于身份的集中控制式网络体系架构iccn Download PDFInfo
- Publication number
- WO2017107033A1 WO2017107033A1 PCT/CN2015/098167 CN2015098167W WO2017107033A1 WO 2017107033 A1 WO2017107033 A1 WO 2017107033A1 CN 2015098167 W CN2015098167 W CN 2015098167W WO 2017107033 A1 WO2017107033 A1 WO 2017107033A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- identity
- terminal
- controller
- domain
- iccn
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Images
Definitions
- the present invention relates to the field of network protocols, and in particular, to an identity-based centralized control network architecture ICCN.
- the terminal address that is, the IP address
- the identity communication terminal is used and the address is used to route through the network.
- the ambiguity of IP addresses has caused problems such as route scalability and host mobility.
- Some solutions for separating identity information from location information have been proposed.
- SDN Software Defined Network
- the core idea of SDN is the separation of control and forwarding. That is, SDN strips all control logic, such as routing protocols, firewalls, and load balancing configurations, from the switch into the SDN controller, leaving only the forwarding function in the switch. Thereby achieving separation.
- programmable interfaces like OpenFlow specify a standard way of communicating between controllers and switches, allowing network software to communicate with the hardware and developing and developing on their own.
- the SDN controller makes a quick decision decision after knowing the network topology information, without considering the forwarding process of the data packet in the network. And when deploying the network, there is no need to configure for each hardware, the control program can be deployed directly, and debugging and detection are easier.
- LISP is a protocol proposed by Cisco to implement identity and location separation on network devices.
- IP address uses a part of the IP address as the Endpoint Identifier (EID). Another part of the IP address is used as a routing location identifier (RLOC) in the network communication.
- EID Endpoint Identifier
- RLOC routing location identifier
- the terminal accesses the opposite node through the EID, and the location identifier of the terminal is determined by the border router to which the connection is established.
- LISP was designed with practical considerations for implementation and deployment. On the basis of keeping the network protocol architecture of the existing terminal unchanged, it only changes the working mode of the terminal access router, so the modification of the existing infrastructure is small and easy to deploy gradually.
- the LISP forwards data in the form of a tunnel from the RLOC of the source EID to the RLOC of the destination EID at the core of the Internet.
- the EID is the same as the existing IP address format. It can be a 32-bit IPv4 address or a 128-bit IPv6 address. The difference is that the EID is independent of the network topology and is a flat identifier. It is based on the EID-to-RLOC mapping server. The deployment is assigned. Before communication, the terminal obtains the EID of the peer terminal by DNS query.
- RLOC is an access router IPv4 or IPv6 address used to store and forward data packets in the routing system. The RLOC represents location information and is allocated according to the network topology.
- the router obtains the RLOC corresponding to the terminal EID by querying the EID-to-RLOC database.
- ETR Egress Tunnel Router
- the router adds a LISP header containing the RLOC corresponding to the communication peer EID obtained by querying the database to each data packet, and receives the tunnel.
- the router removes the LISP header and forwards it to the destination EID. In this way, the core Internet does not need to know the local EID, as long as the RLOC is known to be sufficient for packet forwarding.
- the address translation in the LISP communication process that is, the conversion of the identity identifier and the location identifier, is provided by the mapping mechanism to provide a pair of EID and RLOC mapping, and maintains the address reachable state of the RLOC.
- LISP has improved the ambiguity of IP addresses in traditional networks to a certain extent, and simplifies the difficulty of progressive deployment. But LISP still has many problems.
- mapping query and conversion functions need to be completed, and performance requirements for hardware routers are high;
- mapping updates in LISP and the algorithm used by which mapping queries can affect the efficiency of terminal communication in the network
- each terminal can send data packets to any terminal in the network.
- LISP encapsulates the terminal identifier into the payload of the data packet in the core network
- the intermediary can still decapsulate and obtain the EID. There will be DDoS attacks.
- the present invention provides an identity-based centralized control network architecture ICCN, which solves the problem of high hardware requirements in the prior art.
- the invention provides an identity-based centralized control network architecture ICCN, which comprises a logic control layer for controlling forwarding behavior, a data layer for forwarding traffic according to control layer logic and topology discovery;
- the control layer is a controller and control Related to the database, all control packet operations are completed by the controller, all information related to the terminal and mapping are stored in the registration database and the mapping database;
- the data layer includes switches and terminals, and the data layer performs packet forwarding.
- the controller establishes the information of the network switch initially in the network establishment, the controller checks the data packet header to verify whether a terminal is legal or correct, and the controller registers the legal terminal to the registration database; the controller performs routing. Strategy.
- the controller modifies the packet header for identity and location separation according to the mapping system.
- the switch does not need to collect the information of the neighbor switch, nor does it need to modify the data packet, and the switch forwards the packet through the action of the flow table.
- the controller actively obtains the switch information in the network, and the network is organized in a domain-level relationship, each controller maintains the topology information in its own domain, the primary domain connects all the domains, and the primary domain controller owns all the domains. Reach the switch information.
- the controller controls the incoming traffic, and in the primary domain, the terminal address identifier is used to forward the route, and the identity of the terminal is public.
- the terminal identity HID is a 64-bit number
- the location identifier LID corresponding to the terminal is a unique representation of the OpenFlow instance DPID on the switch; and one terminal identity HID corresponds to the location identifier LID corresponding to the at least one terminal.
- the controller registers the communication terminal information and saves the terminal identity identifier and the location identifier mapping information, and the controller discovers the target terminal by querying the database, and
- the forwarding packet path is established by the shortest path algorithm, and the forwarding flow table is delivered to the OpenFlow switch.
- the terminal identity HID does not change, that is, the connection is not interrupted; the layering mechanism increases the size of the flow table, and different network mechanisms can be deployed in the domain.
- the invention has the beneficial effects that the invention reduces the time of discovering the target and forwarding the data packet to the communication terminal, greatly improves the communication efficiency, improves the scalability, and enhances the adaptability of the network; and enhances the security of the network to some extent. Sex.
- FIG. 1 is a schematic diagram of a conventional LISP protocol stack format and address translation.
- FIG. 2 is a schematic view showing the structure of an ICCN of the present invention.
- FIG. 3 is a diagram showing an example of a naming mechanism and a database storage of the present invention.
- Fig. 5 is a diagram showing the composition of a data packet at the time of terminal communication in the ICCN of the present invention.
- Figure 6 is a flow chart of terminal communication in the ICCN of the present invention.
- Fig. 7 is a diagram showing the composition of data packets when the terminal moves after the ICCN of the present invention.
- ETR Egress Tunnel Router sends a tunnel router
- An identity-based centralized control network architecture ICCN including a control layer that controls the forwarding behavior, a data layer that forwards traffic according to the control layer logic, and topology discovery;
- the control layer is a controller and a database related to control, All control packet operations are performed by the controller, and all information related to the terminal and mapping is stored in the registration database and the mapping database;
- the data layer includes switches and terminals, and the data layer performs packet forwarding.
- the controller establishes the information of the network switch initially on the network, and the controller checks the packet header to verify whether a terminal is legal or correct, and the controller registers the legal terminal to register. In the database; the controller performs routing policies.
- the controller modifies the packet header according to the mapping system for identity and location separation.
- the switch does not need to collect information about the neighbor switch, nor does it need to modify the data packet.
- the switch forwards the packet through the action of the flow table.
- the controller actively obtains the switch information in the network.
- the network is organized in a domain-level relationship.
- Each controller maintains its own intra-domain topology information.
- the primary domain connects all domains.
- the primary domain controller has all domains to reach the switch information.
- the controller controls the incoming traffic, and in the primary domain, the terminal address identifier is used to forward the route, and the identity of the terminal is public.
- the terminal identity HID is a 64-bit number, and the location identifier LID corresponding to the terminal is a unique representation of the OpenFlow instance DPID on the switch; and one terminal identity HID corresponds to the location identifier LID corresponding to at least one terminal.
- the controller registers the communication terminal information and saves the terminal identity identifier and the location identifier mapping information.
- the controller discovers the target terminal by querying the database, and establishes a forwarding packet path by using the shortest path algorithm, and sends a forwarding flow table to the OpenFlow switch.
- the terminal identity HID does not change, that is, the connection is not interrupted; the layering mechanism increases the size of the flow table, and different network mechanisms can be deployed in the domain.
- the invention combines the idea of identity location separation and SDN forwarding control separation in a harmonious manner, and proposes an identity-based centralized control network architecture ICCN (Identity-based Centralized Control Network), which improves the IP in the traditional network.
- ICCN Identity-based Centralized Control Network
- the invention realizes: centralized management network of each domain controller of the control layer; synchronization and communication technology between controllers of the control layer; storage terminal connection information of each domain database of the control layer, and terminal mapping information; main domain controller of the control layer maintains inter-domain communication Reachability information; control layer main domain database stores terminal mapping information; control layer main domain controller calculates inter-domain communication path; control layer main domain controller issues forwarding flow table to switch; control layer domain controller active topology discovery; control The controller in the layer domain calculates maintenance network reachability information; the controller in the control layer domain verifies the legitimacy of the terminal; the controller in the control layer domain calculates the terminal registration function value; the controller in the control layer domain registers the terminal to the registration database; and the controller in the control layer domain calculates Inter-terminal communication Connect the function value; the controller in the control layer domain stores the terminal communication mapping connection function value to the mapping database; the controller in the control layer domain stores the terminal identity identifier and the location identifier mapping information to the mapping database; the controller in the control layer domain obtains the communication terminal through the
- FIG. 2 gives an overview of the ICCN framework. The following sections explain and define several important concepts and mechanisms in ICCN. All descriptions are based on SDN.
- the control layer can be defined as logic that controls forwarding behavior, such as routing protocols, firewall load balancing configuration, and so on.
- forwarding behavior such as routing protocols, firewall load balancing configuration, and so on.
- ICCN we simplify the control layer for the controller and the database associated with the control.
- the behavior of all control packets takes place in the controller of the ICCN. All information related to the terminal and mapping is stored in the ICCN registration database and mapping database.
- the controller can initially obtain information about the network switch on the network, and the controller can also check the packet header to verify if a terminal is legitimate or what we want.
- the controller registers the legitimate terminal into the registration database. If a terminal is already present in the system, the controller will update the information. Then, after the terminal requests communication, the controller also has to query the mapping system to issue a command to determine how the data packet is forwarded. This step may be referred to as a routing policy.
- the controller modifies the packet header according to the mapping system to achieve identity and location separation.
- the data layer can be interpreted as forwarding traffic such as IP forwarding, Layer 2 switching based on control layer logic.
- the data layer includes switches and terminals. Packet forwarding is the master of the data layer Want to function. That is, when a terminal sends a packet to the switch, the switch that receives the controller command forwards the packet to the destination host. The switch does not need to collect information about neighbor switches or modify packets. The only thing the switch has to do is forward the packet according to the action of the flow table.
- the controller actively obtains the switch information in the network, that is, knows the reachability information of all nodes in the network.
- ICCN assumes that the network is organized in a domain-level relationship. Each controller maintains topology information within its own domain. The primary domain connects all domains, and its controller has all the domain reachable switch information, which ensures that the terminal communicates within the entire network.
- ICCN when an OpenFlow switch receives a packet from a terminal for the first time, the switch sends the packet to the controller because the flow table has no forwarding action.
- the controller will process the packet header and check the registration function value obtained from the terminal identity to verify whether the terminal is a legitimate and desired terminal. Therefore, the controller can control incoming traffic, especially reject unwanted traffic.
- the ICCN uses the terminal address identifier to forward the route, and the identity of the terminal is transparent. Therefore, it is difficult for an attacker to correctly guess the identity of the terminal. Therefore, the attacker does not know where the terminal is. Therefore, the security is improved.
- FIG. 3 shows an example of an ICCN naming mechanism and database storage.
- the terminal identity HID (Host Identity) is a 64-bit number, so an IPv6 address can be used, which is represented by hx in the present invention.
- LID Location identifier
- the OpenFlow instance on each switch has a unique representation of the DPID (datapathid), which is used to indicate the address identifier of the terminal in the domain, represented by dpidx, and the DPID is 64 bits.
- the other is to use the DPID of the OpenFlow instance to represent the address identifier in the primary domain, that is, the domain. It is also represented by lx and is also 64-bit.
- a special switch that connects the domain to the primary domain has two LIDs, dpidx and lx, to ensure that packets can be transmitted between domains and between domains. So we can know to use the address dpidx to forward packets within the domain, and use lx to forward packets in the primary domain, that is, between domains. Since the terminal is mobile, each HID can correspond to many LIDs, that is, a pair of HIDs and lx is a pair of mappings, and a pair of HIDs and dpidx are also a pair of mappings.
- MDx we name each domain Dx and the primary domain is named MDx. We use cx to name the controller, and we use rx and mx to name the database in the network.
- Figure 3 also has two important functions for registering terminal and memory mapping relationships. We show that these two functions are the registration function R ⁇ HID> and the connection identification function C ⁇ HID1, HID2, LID1, LID2>. We assume that the controller and the terminals in the network have negotiated with each other what the R and C functions are. In ICCN, we use MD5 to simplify implementation.
- Tables 1, 2, and 3 give a format for records in the database:
- ICCN In ICCN, when a terminal sends a packet for registration or communicates with the destination terminal, we check the validity of the terminal. If it is valid, it will go to the registration database or communicate with the destination terminal. Table 4 shows the format of the packet header sent by the terminal. Figure 4 shows the ICCN registration procedure.
- the terminal h1 sends a data packet, and the data packet is encapsulated into the format of Table 1, abbreviated as [h1, h2, R ⁇ h1>, Data].
- the switch dpid1 receives the data packet sent from the terminal h1 for the first time, the switch is in the flow table. The matching entries cannot be found, so the traffic will be sent to controller c1.
- the D1 domain controller c1 checks whether there is a record of the terminal h1 in the registration database r1. If there is no record, it means that the terminal h1 is not in this domain or this network before, then the controller c1 will first calculate the registration function value with the registration function MD5 ⁇ h1>; if there is a record, then directly obtain the registration function value in the record.
- C1 takes the calculated value or the value obtained from the database r1 and The values of the registered value fields in the data packet are compared. If they are not equal, the terminal is invalid and the data packet is directly discarded. If they are equal, the record will be written or updated in r1, and c0 must also be controlled to the primary domain.
- C0 report h1 registration information, c0 query database m0, if there is no record, indicating that h1 was not in this network before, then it is necessary to add a [h1,14,D1] record; if there is a record in m0, h1 before In other domains, then c0 sends a message to delete the h1 record to the original domain of h1, and then c0 updates the record of h1 in m0.
- Figure 5 shows the packet composition during the terminal h1 request in domain 1 and the terminal 2 communication in domain 2.
- Figure 6 details the process of communication.
- Tables 5 and 6 show a packet header format for intra-domain and inter-domain (primary), respectively.
- step v If there is no record of h2 in m0, it indicates that h2 is an illegal terminal, go to step v;
- c0 If there is a record of h2 in m0, then c0 returns the information [l5, h2, D2] of record h2 to c1;
- connection function value MD5 is used to calculate the connection function value C ⁇ h1, h2, l4, l5>;
- c1 is a connection information of h1 and h2 communication [C ⁇ h1, h2, l4, l5>, H1, h2, l4, l5] registered to the mapping database m1; c1 sends this record to the controller c2 of the domain D2 where h2 is located;
- e) c2 receives the connection information [C ⁇ h1, h2, l4, l5>, h1, h2, l4, l5], registers it with the mapping database m2, to ensure that the communication can be successfully implemented;
- c1 will modify the packet to [dpid1, dpid2, h1, h2, D1, Data], where dpid1 is the h1 direct switch identifier and dpid2 is the h2 direct connection.
- Switch ID go to step 13;
- h1 and h2 are not in the same domain.
- the packet is first modified to [dpid1, dpid2, h1, h2, D1, Data], where dpid1 is the h1 direct switch identifier and dpid2 is the domain. 1 and the switch identity directly connected to the primary domain (we use dpidx to forward packets in the domain);
- h) c1 calculates the shortest path between the switches dpid1 and dpid2 using the shortest path Dijkstra algorithm according to the network topology information;
- the modified data packet of c1 is [l4, l5, C ⁇ h1, h2, l4, l5>], where l4 is the switch identifier of the domain D1 where h1 is located and the main domain, and l5 is the domain of the domain where h2 is connected to the main domain.
- the switch identifier, C ⁇ h1, h2, l4, l5> is the value of the connection function;
- l) c0 uses the shortest path Dijkstra algorithm to calculate the shortest path between l4 and l5 (we use lx to forward packets between domains);
- n) c2 uses the connection function value C ⁇ h1, h2, l4, l5> to request connection information to m2, if there is no record, go to step v;
- c2 modifies the data packet to [dpid2, dpid1, h1, h2, D2, Data], and forwards the data packet in the D2 domain as in step l;
- LID instance 1 is dpidx for communication within the domain
- LID instance 2 is used for communication between domains.
- Figure 7 shows the process of returning the information from the terminal h2 to the terminal h1 after the terminal h1 moves from the domain 1 to the domain 3. A way of forming a packet is presented.
- controller c3 does not have a record of h1, according to the registration process, c3 recalculates the validity of the registration function verification h1, and then writes the record to the domain registration database r3 after being legal;
- c3 informs c0 to check if there is a record of h1. Since h1 has already been registered in domain D1, there is a record of h1 in c0 [h1, l4, D1];
- c0 informs h1 that the controller c1 of the original domain D1 deletes the record of h1 in r1;
- the registration and mapping update process after the terminal h1 is moved has been given.
- the process of returning the data packet of h2 to h1 is somewhat similar to the terminal communication process of the previous section, so the specific flow chart is no longer given, and the process is as follows:
- Terminal h2 sends a data packet [h2, h1, R ⁇ h2>, Data] to h1.
- the process in domain D2 is similar to the process of sending data packets to h2 in domain D1, regardless of whether h1 is moved or not (intra-domain use) Dpidx forwarding package);
- controller c2 requests h1 information from c0, so c3 gets the new address identifier l6 of h1;
- c2 calculates the new connection function C ⁇ h2, h1, l5, l6> and then the record in the new m2 is [C ⁇ h2, h1, l5, l6>, h1, h2, l6, l5];
- e) c2 sends a record [C ⁇ h2, h1, l5, l6>, h1, h2, l6, l5] to the controller c3 of the current domain D3 of h1;
- h1 receives the packet.
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明涉及网络协议领域，其公开了一种集中式身份网络路由协议CIN：包括应用层、数据链路层和物理层，还包括身份/位置层，所述身份/位置层位于应用层和数据链路层之间；所述身份/位置层解耦IP地址的身份属性和位置属性；所述身份/位置层放入全网身份位置映射数据库ILMD和身份位置映射缓存ILMC。本发明的有益效果是：本发明采用增加Ipv6扩展首部的方式实现身份位置分离网络与当前IPv6网络的兼容，且不需要修改主机协议栈；提出一种不需要汇聚服务器，简单且有效的方法应对移动性问题。
Description
本发明涉及网络协议领域，尤其涉及一种基于身份的集中控制式网络体系架构ICCN。
传统互联网中，终端地址即IP地址同时包含了身份信息和地址信息。身份标识通信终端，而地址用来在网络中路由。IP地址的二义性导致了一些问题，如路由扩展性，主机移动性等问题。为了解决这些问题，并且满足新一代网络的高速效率和普遍性的要求，已经有一些将身份信息和位置信息分离的解决方案被提出。解决方案主要有两种类型，一种基于主机，如HIP和SHIM6，另一种则是基于路由，如LISP。身份位置分离有着明显的优点：例如可在扩展性问题上一定程度的减缓BGP路由表的增长，给予移动性一定的支持。
软件定义网络(SDN)是一种自从美国斯坦福大学Clean Slate研究组提出后，就引起了学术界和工业界众多兴趣的新型网络架构样例。SDN的核心思想是控制和转发分离思想，即SDN将所有控制逻辑，例如路由协议，防火墙，负载均衡配置等都从交换机中剥离出来放入SDN控制器中，只在交换机中留下转发功能，从而实现分离。在实现上，可编程接口像OpenFlow规定了控制器和交换机通信的标准方式，从而允许网络软件与硬件通信，并且各自独自开发发展。而SDN控制器则是在知道网络拓扑信息后会做出快速的决策决定，而无需考虑数据包在网络中的转发过程。并且在部署网络时，无需针对每个硬件进行配置，通过控制程序可以直接部署实现，并且使得调试和检测都更加容易。
LISP是思科公司提出的一种在网络设备上实现身份与位置分离的协议。
它使用一部分IP地址作为终端标识(EID，Endpoint Identifier)，
另一部分IP地址作为网络通信中的路由位置标识(RLOC，Routing Locators)，终端通过EID来访问对端节点，而终端的位置标识RLOC由其连接的边界路由器决定。LISP在设计时考虑了实现与部署的实际问题。它在保持了现有终端的网络协议架构不变的基础上，只改变了终端接入路由器的工作方式，因此对现有基础设施的修改较小，易于渐进部署。
LISP是以隧道的形式在互联网的核心将数据从源EID的RLOC转发到目的EID的RLOC。EID与现有IP地址格式完全相同，可以使32位的IPv4地址，也可以是128位的IPv6地址，区别在于，EID与网络拓扑无关，是扁平化标识，是根据EID-to-RLOC映射服务器的部署进行分配的。通信前，终端由DNS查询获得对端终端的EID。RLOC则是接入路由器IPv4或IPv6地址，用于在路由系统中实现数据包的存储和转发。RLOC代表的是位置信息，按照网络拓扑结构进行分配，通信中，路由器通过查询EID-to-RLOC数据库获得与终端EID对应的RLOC。互联网上两个终端在进行端到端的数据传输时，发送隧道路由器(ETR，Egress Tunnel Router)为每个数据包加上含有通过查询数据库得到的通信对端EID对应的RLOC的LISP报头，接收隧道路由器(ITR,Ingress Tunnel Router)在接收到数据包后去掉LISP报头，在转发给目的EID。用这种方式，核心互联网没有必要知道本地EID，只要知道RLOC就足以满足数据包的转发。
LISP通信过程中的地址转换，即身份标识与位置标识的转换，是由映射机制提供了一对EID和RLOC的映射，并且维护了RLOC的地址可达状态。
LISP的协议栈格式，以及数据包转发过程中的标识转换示意如图1所示。
LISP在一定程度上改善了传统网络中IP地址的二义性问题，并且简化了渐进部署的难度。但是LISP仍存在诸多问题。
1)LISP仍硬件具有较大的依赖性；
2)LISP中，对于路由ETR和ITR而言，需要完成映射查询和转换功能，对于硬件路由器性能要求较高；
3)此外LISP中映射更新的频率以及使用什么样的映射查询的算法都能影响网络中终端通信的效率；
4)最后，当前互联网中，每一个终端可以给网络中任意终端发送数据包，虽然LISP在核心网络中将终端标识封装到了数据包的有效载荷中，但是中间人仍然可以解封装从而得到EID，这就会产生DDoS攻击问题。
【发明内容】
为了解决现有技术中的问题，本发明提供了一种基于身份的集中控制式网络体系架构ICCN，解决现有技术中对硬件要求很高的问题。
本发明提供了一种基于身份的集中控制式网络体系架构ICCN，包括控制转发行为的逻辑的控制层、根据控制层逻辑来转发流量的数据层和拓扑发现；该控制层为控制器以及与控制相关的数据库，所有控制数据包的操作均通过控制器完成，所有与终端和映射相关的信息都存储在注册数据库和映射数据库中；该数据层包括交换机和终端，数据层进行数据包转发。
作为本发明的进一步改进：控制器在网络建立初始获得网络交换机的信息，控制器检查数据包头来验证一个终端是否是合法的或正确的，控制器注册合法终端到注册数据库中；控制器进行路由策略。
作为本发明的进一步改进：控制器根据映射系统来修改数据包包头进行身份与位置分离。
作为本发明的进一步改进：交换机不需要收集邻居交换机的信息，也不需要修改数据包，交换机通过流表的动作来转发包。
作为本发明的进一步改进：拓扑发现中，控制器主动获得网络中交换机信息，网络以域级关系组织，每个控制器维护自己域内拓扑信息，主要域连接所有域，主要域控制器拥有全部域到达交换机信息。
作为本发明的进一步改进：控制器控制传入流量，在主要域中，使用终端地址标识来转发路由，终端的身份标识是公开的。
作为本发明的进一步改进：终端身份标识HID是一个64位的数字,终端对应的位置标识LID为交换机上的OpenFlow实例DPID的唯一表示；一个终端身份标识HID对应至少一个终端对应的位置标识LID。
作为本发明的进一步改进：控制器注册通信终端信息和保存终端身份标识与位置标识映射信息，控制器通过查询数据库发现目标终端，并
通过最短路径算法建立转发包路径，并向OpenFlow交换机下发转发流表。
作为本发明的进一步改进：终端身份标识HID不改变即连接不中断的情况下进行通信；分层机制增大了流表的尺寸，在域内可以部署不同的网络机制。
本发明的有益效果是：本发明减少发现目标并将数据包转发到通信终端的时间，大大提高了通信效率；提高了可扩展性，增强了网络的适应能力；一定程度上增强了网络的安全性。
图1是传统LISP协议栈格式及地址转换示意图。
图2是本发明ICCN结构示意图。
图3是本发明命名机制及数据库存储实例图。
图4是本发明ICCN注册流程图。
图5是本发明ICCN中终端通信时数据包组成图。
图6是本发明ICCN中终端通信流程图。
图7是本发明ICCN中终端移动后通信时数据包组成图。
下面结合附图说明及具体实施方式对本发明进一步说明。
缩略语和关键术语定义
I/LS Identity/Locator Separation 身份位置分离
SDN Software Defined Network 软件定义网络
HIP Host Identity Protocol 主机标识协议
SHIM6 Multihoming Shim Protocol for IPv6 IPv6多宿协议
LISP Locator/ID Separation Protocol 位置与身份分离协议
EID Endpoint Identifier 终端标识
RLOC Routing Locators 路由标识
ETR Egress Tunnel Router 发送隧道路由器
ITR Ingress Tunnel Router 接收隧道路由器
DDoS Distributed Denial-of-service 分布式拒绝服务攻击
OpenFlow 新型网络交换模型
ICCN Identity-based Centralized Control Network
基于身份的集中控制式网络体系架构
HID Host Identity 终端身份标识
LID Locator Identity 位置标识
DPID Datapath Identity OpenFlow交换机实例标识
hx HID Number 身份标识名
lx and dpidx LID Number 位置标识名
cx Controller Number 控制器名
rx Register Database Number 注册数据库名
mx Mapping Database Number 映射数据库名
Dx Domain Number 域名
MD5 Message Digest Algorithm 信息摘要算法第五版
R<> Register Function 注册函数(本发明中均使用MD5函数)
C<> Connection Function 连接函数(本发明中均使用MD5函数)
一种基于身份的集中控制式网络体系架构ICCN，包括控制转发行为的逻辑的控制层、根据控制层逻辑来转发流量的数据层和拓扑发现；该控制层为控制器以及与控制相关的数据库，所有控制数据包的操作均通过控制器完成，所有与终端和映射相关的信息都存储在注册数据库和映射数据库中；该数据层包括交换机和终端，数据层进行数据包转发。
控制器在网络建立初始获得网络交换机的信息，控制器检查数据包头来验证一个终端是否是合法的或正确的，控制器注册合法终端到注册
数据库中；控制器进行路由策略。
控制器根据映射系统来修改数据包包头进行身份与位置分离。
交换机不需要收集邻居交换机的信息，也不需要修改数据包，交换机通过流表的动作来转发包。
拓扑发现中，控制器主动获得网络中交换机信息，网络以域级关系组织，每个控制器维护自己域内拓扑信息，主要域连接所有域，主要域控制器拥有全部域到达交换机信息。
控制器控制传入流量，在主要域中，使用终端地址标识来转发路由，终端的身份标识是公开的。
终端身份标识HID是一个64位的数字,终端对应的位置标识LID为交换机上的OpenFlow实例DPID的唯一表示；一个终端身份标识HID对应至少一个终端对应的位置标识LID。
控制器注册通信终端信息和保存终端身份标识与位置标识映射信息，控制器通过查询数据库发现目标终端，并通过最短路径算法建立转发包路径，并向OpenFlow交换机下发转发流表。
终端身份标识HID不改变即连接不中断的情况下进行通信；分层机制增大了流表的尺寸，在域内可以部署不同的网络机制。
本发明以一种和谐的方式融合了身份位置分离和SDN转发控制分离思想，提出了一种基于身份的集中控制式网络体系架构ICCN(Identity-based Centralized Control Network)，在改进了传统网络中IP地址二义性问题的同时，继承并扩展了身份位置分离思想和SDN转控分离思想的优点。
本发明实现：控制层各个域控制器集中式管理网络；控制层各个控制器间同步与通信技术；控制层各个域数据库存储终端连接信息，以及终端映射信息；控制层主要域控制器维护域间可达性信息；控制层主要域数据库存储终端映射信息；控制层主要域控制器计算域间通信路径；控制层主要域控制器下达转发流表至交换机；控制层域内控制器主动拓扑发现；控制层域内控制器计算维护网络可达性信息；控制层域内控制器验证终端合法性；控制层域内控制器计算终端注册函数值；控制层域内控制器注册终端到注册数据库；控制层域内控制器计算终端间通信连
接函数值；控制层域内控制器存储终端通信映射连接函数值到映射数据库；控制层域内控制器存储终端身份标识与位置标识映射信息到映射数据库；控制层域内控制器通过查询映射数据库得到通信终端位置标识；控制层域内控制器计算终端通信路径；控制层域内控制器下发转发流表至交换机；控制层域内控制器修改数据包头实现身份与位置分离；控制层域内控制器在终端移动后要更新映射数据库的连接信息与映射信息；控制层域内控制器从数据库中删除从本域移动走的终端的信息；数据层交换机查询转发流表；数据层交换机根据流表转发规则转发数据包；各个域内使用DPID转发数据包；域间使用LID转发数据包。
图2给出了ICCN框架的概述，以下详细解释并定义了ICCN中的几个重要概念与机制，所有的描述都是基于SDN的。
1)控制层
控制层可以定义为控制转发行为的逻辑，例如路由协议，防火墙负载均衡配置等。在ICCN中，我们简化控制层为控制器以及与控制相关的数据库。所有控制数据包的行为都发生在ICCN的控制器当中。所有与终端和映射相关的信息都存储在ICCN的注册数据库和映射数据库中。
控制器可以在网络建立初始获得网络交换机的信息，控制器还可以检查数据包头来验证一个终端是否是合法的或我们想要的。控制器注册合法终端到注册数据库中。如果一个终端已经在系统中存在，那么控制器就要更新信息。然后在终端请求通信后，控制器还得查询映射系统之后发出决定数据包怎样转发的命令，这一步骤可称为路由策略。此外，控制器根据映射系统来修改数据包包头以实现身份与位置分离。
2)数据层
数据层可以被解释为根据控制层逻辑来转发流量例如IP转发，2层交换。在ICCN中，数据层包括了交换机和终端。数据包转发是数据层的主
要功能。即，当一个终端发送一个数据包到交换机，接收到控制器命令的交换机会将数据包转发到目的主机。交换机不需要收集邻居交换机的信息，也不需要修改数据包。交换机唯一要做的事情就是根据流表的动作来转发包。
我们将控制层和数据层分开不仅仅是因为软件控制可以独立于硬件开发，也因为更容易调试和检查网络的行为。
3)拓扑发现
在网络建立伊始，控制器主动获得网络中交换机信息，即得知网络中所有节点的可达性信息。ICCN假设网络以域级关系组织。每个控制器维护自己域内拓扑信息。主要域连接所有域，其控制器拥有全部域可达交换机信息，即可以保证终端在全网范围内通信。
4)安全性
在ICCN中，当一个OpenFlow交换机第一次从一个终端接收到数据包时，交换机会因流表无转发动作而将数据包发送到控制器。而控制器将处理数据包头，检查根据终端身份标识而得到的注册函数值，以此来验证此终端是否是合法和想要的终端。因此，控制器可以控制传入流量，尤其拒绝不想要的流量。ICCN在主要域中，使用终端地址标识来转发路由，终端的身份标识是透明的。所以攻击者很难正确的猜测终端的身份标识。因此，攻击者不知道终端在什么位置。因此提高了安全性。
2.2.1本发明实施例一：
1)命名机制
与目前的互联网仅使用IP地址不同，ICCN使用2个命名空间，以此来
实现身份位置分离。图3展示了一个ICCN命名机制及数据库存储的实例。
在ICCN中，终端身份标识HID(Host Identity)是一个64位的数字，因此可以使用IPv6地址，在本发明中用hx代表。终端对应的位置标识LID(Locator Identity)有2种情况。1种在域内，每个交换机上的OpenFlow实例都有一个DPID(datapathid)的唯一表示，用来表示终端在域内的地址标识，用dpidx代表，DPID是64位。另外一种是在主要域即域间，也同样用OpenFlow实例的DPID表示地址标识，用lx代表，也是64位。特别的，连接了域与主要域的特殊交换机，拥有2个LID即dpidx和lx，用来保证数据包可以在域内和域间传输。因此我们可以知道在域内使用地址dpidx转发包，而在主要域，即在域间使用lx转发包。由于终端是可以移动的，所以每一个HID都可以对应于许多LID，即一对HID和lx为一对映射，一对HID与dpidx也是一对映射。我们命名每一个域为Dx，主要域命名为MDx。我们用cx来命名控制器，同时我们用rx和mx来命名网络中的数据库。
图3还有2个重要的函数，用来注册终端和存储映射关系。我们表示这2个函数为注册函数R<HID>和连接标识函数C<HID1,HID2,LID1,LID2>。我们假设，控制器和网络中的终端已经相互协商好了R与C函数是什么。在ICCN中，我们使用MD5来简化实现。
表1、2、3给出了数据库中记录的一种格式：
表1注册数据库中的记录格式
表2域内映射数据库的记录格式
表3主要域映射数据库的记录格式
2)注册机制
在ICCN中，当一个终端发送数据包进行注册或和目的终端通信时，我们会检查终端有效性。如果有效则到注册数据库或是与目的终端通信，表4给出了一种终端发送的数据包包头格式，图4是ICCN注册流程。
表4终端发送的数据包包头格式
终端h1发送数据包，数据包被封装为表1的格式，简写为[h1,h2,R<h1>,Data]，当交换机dpid1首次接收到从终端h1发送来的数据包，交换机在流表中无法查到相匹配的表项，所以流量会被发送至控制器c1处。D1域控制器c1会检查在注册数据库r1中是否有终端h1的记录。如果没有记录，说明终端h1之前没有在此域或者此网络中，那么控制器c1会首先用注册函数MD5<h1>来计算注册函数值；如果有记录，那么就直接取得记录中的注册函数值。c1把计算得来的值或者是从数据库r1中取得的值与
数据包中注册值域的值相比较，如果不相等，那么说明终端不合法，直接丢弃数据包；如果相等，那么就要将在r1中写入或更新记录，同时c0还必须向主要域控制器c0，报告h1的注册信息，c0查询数据库m0，如果没有记录，说明h1此前不在此网络中，那么就要是添加一条，[h1，14，D1]记录；如果m0中有记录，说明h1此前在其他域中，那么c0要向h1的原始域发送删除h1记录的消息，然后c0更新h1在m0中的记录。
3)通信机制
图5展示了域1中的终端h1请求和域2中的终端2通信过程中的数据包组成。图6详细描述了通信的过程。表5、6分别给出了域内和域间(主要域)存在的一种数据包包头格式。
a)是否在映射数据库m0中；
b)如果m0中没有h2的记录，说明h2是非法的终端，转至步骤v；
c)如果m0中有h2的记录，那么c0返回记录h2的信息[l5,h2,D2]给c1；
d)c1接受h2信息后，使用连接函数MD5计算出连接函数值C<h1,h2,l4,l5>；c1将h1与h2通信的一条连接信息[C<h1,h2,l4,l5>,h1,h2,l4,l5]注册到映射数据库m1；c1发送这条记录到h2所在域D2的控制器c2；
e)c2接收到连接信息[C<h1,h2,l4,l5>,h1,h2,l4,l5]，将之注册到映射数据库m2，来保证通信可以成功实现；
f)如果h1与h2在相同的域中，c1会修改数据包为[dpid1,dpid2,h1,h2,D1,Data]，其中dpid1是h1直连交换机标识，dpid2是h2直连
交换机标识，转至步骤13；
g)本例中h1和h2不在相同的域，同步骤k一致，先将数据包修改为[dpid1,dpid2,h1,h2,D1,Data]，其中dpid1是h1直连交换机标识，dpid2是域1和主要域直连的交换机标识(我们在域内使用dpidx转发数据包)；
h)c1根据网络拓扑信息使用最短路径Dijkstra算法计算交换机dpid1和dpid2之间最短路径；
i)c1发送相对应的动作到这条路径上的所有交换机；
j)如果h1和h2不在相同的域，数据包会转发到和主要域直连的交换机dpid2；
k)c1修改数据包为[l4,l5,C<h1,h2,l4,l5>]，其中l4为h1所在域D1和主要域相连的交换机标识，l5是h2所在域D2和主要域相连的交换机标识，C<h1,h2,l4,l5>为连接函数值；
l)c0使用最短路径Dijkstra算法计算l4与l5之间的最短路径(我们在域间使用lx转发数据包)；
m)转发数据包到目的域D2；
n)c2使用连接函数值C<h1,h2,l4,l5>向m2请求连接信息，如果没有记录，转至步骤v；
o)如果有连接记录，c2修改数据包为[dpid2,dpid1,h1,h2,D2,Data]，像步骤l一样在D2域内转发数据包；
p)最终，h2收到数据包；
q)丢弃数据包。
在终端h1和h2通信的过程中，HID和LID是被分开的，LID实例1即dpidx用于在域内通信，而LID实例2即lx用于在域间通信。
表5域内存在的数据包包头格式
表6主要域(即域间)存在的数据包包头格式
2.2.2本发明实施例二
本节中将介绍当主机移动后，通信双方数据包组成，和通信流程，图7给出了当终端h1从域1移动到域3后，终端h2返回信息到终端h1的过程示意，并且给出了一种数据包组成方式。
首先给出终端h1移动后的重新注册过程以及在主要域中映射更新过程。
a)域D3控制器c3接收到的h1发送的数据包；
b)控制器c3没有h1的记录，根据注册流程，c3重新计算注册函数验证h1合法性，合法后将记录写入本域注册数据库r3；
c)同时c3通知c0检查是否有h1的记录，由于此前h1在域D1中已经被注册过，所以c0中有h1的记录[h1,l4,D1]；
d)c0通知h1原始所在域D1的控制器c1删除h1在r1中的记录；
e)同时c0需要在m0更新h1的记录为[h1,l6,D3]；
终端h1移动后的注册及映射更新过程已给出，h2返回给h1的数据包的过程有些类似于上一节终端通信过程，因此不再给出具体流程图，只叙述过程如下：
a)终端h2发送数据包[h2,h1,R<h2>,Data]到h1，在域D2内的过程同h1发送数据包到h2在域D1中的过程类似无论h1移动与否(域内使用dpidx转发包)；
b)当数据包来到D2域直连主要域的交换机dpid2的时候，数据包将要被修改，因为h1移动后，主要域m0中的h1的记录被更新为[h1,l6,
D3]；
c)控制器c2向c0请求h1的信息，所以c3得到了h1的新地址标识l6；
d)c2计算新的连接函数C<h2,h1,l5,l6>然后跟新m2中的记录为[C<h2,h1,l5,l6>,h1,h2,l6,l5]；
e)c2发送记录[C<h2,h1,l5,l6>,h1,h2,l6,l5]到h1当前所属域D3的控制器c3；
f)c3注册记录到m3；
g)c2修改数据包为[l5,l6,C<h2,h1,l5,l6>,Data]；
h)c2转发数据包到主要域；
i)c0通过Dijkstra算法路由数据包到步骤p；
j)c3在m3和r3中找到记录；
k)c3得到目的地身份标识h1所直连交换机的地址标识dpid1；
l)c3修改数据包为[dpid2,dpid1,h2,h1,D3,Data]；
m)c3通过Dijkstra算法转发包到h1；
n)最终，h1收到数据包。
我们给出了h2发送数据包到h1的过程。h2持续的发送数据包而无需更改[h2,h1,R<h2>,Data]的任意部分，所以我们说ICCN可以支持移动性。
以上内容是结合具体的优选实施方式对本发明所作的进一步详细说明，不能认定本发明的具体实施只局限于这些说明。对于本发明所属技术领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本发明的保护范围。
Claims (9)
- 一种基于身份的集中控制式网络体系架构ICCN，其特征在于：包括控制转发行为的逻辑的控制层、根据控制层逻辑来转发流量的数据层和拓扑发现；该控制层为控制器以及与控制相关的数据库，所有控制数据包的操作均通过控制器完成，所有与终端和映射相关的信息都存储在注册数据库和映射数据库中；该数据层包括交换机和终端，数据层进行数据包转发。
- 根据权利要求1所述的基于身份的集中控制式网络体系架构ICCN，其特征在于：控制器在网络建立初始获得网络交换机的信息，控制器检查数据包头来验证一个终端是否是合法的或正确的，控制器注册合法终端到注册数据库中；控制器进行路由策略。
- 根据权利要求1所述的基于身份的集中控制式网络体系架构ICCN，其特征在于：控制器根据映射系统来修改数据包包头进行身份与位置分离。
- 根据权利要求1所述的基于身份的集中控制式网络体系架构ICCN，其特征在于：交换机不需要收集邻居交换机的信息，也不需要修改数据包，交换机通过流表的动作来转发包。
- 根据权利要求1所述的基于身份的集中控制式网络体系架构ICCN，其特征在于：拓扑发现中，控制器主动获得网络中交换机信息，网络以域级关系组织，每个控制器维护自己域内拓扑信息，主要域连接所有域，主要域控制器拥有全部域到达交换机信息。
- 根据权利要求1所述的基于身份的集中控制式网络体系架构ICCN，其特征在于：控制器控制传入流量，在主要域中，使用终端地址标识来转发路由，终端的身份标识是公开的。
- 根据权利要求6所述的基于身份的集中控制式网络体系架构ICCN，其特征在于：终端身份标识HID是一个64位的数字,终端对应的位置标识LID为交换机上的OpenFlow实例DPID的唯一表示；一个终端身份标识HID对应至少一个终端对应的位置标识LID。
- 根据权利要求1所述的基于身份的集中控制式网络体系架构ICCN，其 特征在于：控制器注册通信终端信息和保存终端身份标识与位置标识映射信息，控制器通过查询数据库发现目标终端，并通过最短路径算法建立转发包路径，并向OpenFlow交换机下发转发流表。
- 根据权利要求6所述的集中式身份网络路由协议CIN，其特征在于：终端身份标识HID不改变即连接不中断的情况下进行通信；分层机制增大了流表的尺寸，在域内可以部署不同的网络机制。
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2015/098167 WO2017107033A1 (zh) | 2015-12-22 | 2015-12-22 | 一种基于身份的集中控制式网络体系架构iccn |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2015/098167 WO2017107033A1 (zh) | 2015-12-22 | 2015-12-22 | 一种基于身份的集中控制式网络体系架构iccn |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2017107033A1 true WO2017107033A1 (zh) | 2017-06-29 |
Family
ID=59088832
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2015/098167 Ceased WO2017107033A1 (zh) | 2015-12-22 | 2015-12-22 | 一种基于身份的集中控制式网络体系架构iccn |
Country Status (1)
| Country | Link |
|---|---|
| WO (1) | WO2017107033A1 (zh) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115190086A (zh) * | 2022-09-13 | 2022-10-14 | 之江实验室 | 基于可编程交换机的身份标识网络流量调度方法及装置 |
| CN119743185A (zh) * | 2024-12-11 | 2025-04-01 | 中国电子科技集团公司第五十四研究所 | 一种软件定义卫通地面站的高可用系统及方法 |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101945034A (zh) * | 2009-07-08 | 2011-01-12 | 中兴通讯股份有限公司 | 一种身份标识与位置分离协议数据转发系统及方法 |
| CN102256236A (zh) * | 2011-06-08 | 2011-11-23 | 北京交通大学 | 一种分离映射机制下的移动性管理系统及方法 |
-
2015
- 2015-12-22 WO PCT/CN2015/098167 patent/WO2017107033A1/zh not_active Ceased
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101945034A (zh) * | 2009-07-08 | 2011-01-12 | 中兴通讯股份有限公司 | 一种身份标识与位置分离协议数据转发系统及方法 |
| CN102256236A (zh) * | 2011-06-08 | 2011-11-23 | 北京交通大学 | 一种分离映射机制下的移动性管理系统及方法 |
Non-Patent Citations (1)
| Title |
|---|
| LIU, HUILING ET AL.: "ICCN: Identity-based Centralized Control Network", IEEE /CIC ICCC 2015 SYMPOSIUM ON NEXT GENERATION NETWORKING, 4 November 2015 (2015-11-04), XP032889053 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115190086A (zh) * | 2022-09-13 | 2022-10-14 | 之江实验室 | 基于可编程交换机的身份标识网络流量调度方法及装置 |
| CN115190086B (zh) * | 2022-09-13 | 2023-01-06 | 之江实验室 | 基于可编程交换机的身份标识网络流量调度方法及装置 |
| CN119743185A (zh) * | 2024-12-11 | 2025-04-01 | 中国电子科技集团公司第五十四研究所 | 一种软件定义卫通地面站的高可用系统及方法 |
| CN119743185B (zh) * | 2024-12-11 | 2025-09-16 | 中国电子科技集团公司第五十四研究所 | 一种软件定义卫通地面站的高可用系统及方法 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101958830B (zh) | 一种网络部署系统及其映射和数据转发方法 | |
| JP5579853B2 (ja) | バーチャル・プライベート・ネットワークの実現方法及びシステム | |
| CN102025591B (zh) | 虚拟专用网络的实现方法及系统 | |
| CN109257265B (zh) | 一种泛洪抑制方法、vxlan网桥、网关及系统 | |
| CN101945034B (zh) | 一种身份标识与位置分离协议数据转发系统及方法 | |
| CN102457583B (zh) | 一种虚拟机移动性的实现方法及系统 | |
| CN102075420B (zh) | 基于位置标识和主机标识分离的系统及其移动性管理方法 | |
| CN106572021B (zh) | 一种实现网络虚拟化叠加的方法与网络虚拟化边缘节点 | |
| JP5147995B2 (ja) | ホスト・アイデンティティ・プロトコル・サーバ・アドレス構成 | |
| WO2011069399A1 (zh) | 地址映射方法及接入业务节点 | |
| CN102387068B (zh) | 标识网络的可扩展路由方法和路由器 | |
| WO2016058261A1 (zh) | 一种基于网络的扁平路由的实现方法 | |
| CN104780522B (zh) | 一种lisp标识承载接入网支持终端移动接入的方法 | |
| WO2017107033A1 (zh) | 一种基于身份的集中控制式网络体系架构iccn | |
| Eriksson et al. | Dynamic internetworking based on late locator construction | |
| Zave et al. | The design space of network mobility | |
| CN119583443A (zh) | 报文转发方法、装置、计算机设备和可读存储介质 | |
| WO2013083037A1 (zh) | 更新报文的处理方法及系统、映射服务器和移动节点 | |
| WO2017096565A1 (zh) | 一种集中式身份网络路由协议cin | |
| CN103166856B (zh) | 一种基于lisp协议的动态移动性管理方法及系统 | |
| WO2012083685A1 (zh) | 一种提高映射路由表使用效率的方法及系统 | |
| WO2018230608A1 (ja) | 通信システム、通信制御装置、スイッチ装置、通信制御方法、及び、記録媒体 | |
| CN101383758A (zh) | 多地址空间移动网络架构、路由器及数据发送方法 | |
| Cabellos et al. | RFC 9299 An Architectural Introduction to the Locator/ID Separation Protocol (LISP) | |
| Kafle et al. | ID/Locator split-based mobility scheme for heterogeneous new generation network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15911032 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 15911032 Country of ref document: EP Kind code of ref document: A1 |