WO2020134017A1 - 基于sdn的vpn流量调度方法以及基于sdn的vpn流量调度系统 - Google Patents

基于sdn的vpn流量调度方法以及基于sdn的vpn流量调度系统 Download PDF

Info

Publication number
WO2020134017A1
WO2020134017A1 PCT/CN2019/094985 CN2019094985W WO2020134017A1 WO 2020134017 A1 WO2020134017 A1 WO 2020134017A1 CN 2019094985 W CN2019094985 W CN 2019094985W WO 2020134017 A1 WO2020134017 A1 WO 2020134017A1
Authority
WO
WIPO (PCT)
Prior art keywords
vpn
sdn
address
traffic scheduling
controller
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/094985
Other languages
English (en)
French (fr)
Inventor
袁航
祖立军
吴金坛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to US17/043,237 priority Critical patent/US11296997B2/en
Publication of WO2020134017A1 publication Critical patent/WO2020134017A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/50—Queue scheduling
    • H04L47/60—Queue scheduling implementing hierarchical scheduling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/70—Admission control; Resource allocation
    • H04L47/82—Miscellaneous aspects
    • H04L47/825—Involving tunnels, e.g. MPLS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network

Definitions

  • the invention relates to communication technology, in particular to an SDN-based VPN traffic scheduling method and an SDN-based VPN traffic scheduling system.
  • the controller supports the isolation of routing areas of different tenants through VPN on the edge router, and the dynamic management of VPN instances is realized through the mapping of router ports and VPN instances.
  • cross-central networks often use tunneling to plan traffic paths.
  • the current requirements of users for network traffic are becoming more and more refined, and they are often specific to an application flow.
  • the five-tuple based drainage method inside the VPN is becoming more and more important.
  • tunnel policy diversion and static route diversion can only achieve the overall diversion of the entire VPN traffic, and route dyeing can only conduct diversion based on the destination IP.
  • route dyeing can only conduct diversion based on the destination IP.
  • service level can be refined to five quintuples, the number is only 8, completely Can not meet the actual use needs.
  • the drainage based on the 5-tuple can be realized by means of policy routing.
  • this method is found to be inapplicable after verification: after the traffic is diverted through policy routing, the VPN-related information will be lost in the packet, resulting in the peer end unable to receive it.
  • an SDN-based VPN traffic scheduling method of an aspect of the present invention is characterized by using SDN switching equipment and a controller to implement CE equipment and PE equipment
  • the VPN traffic scheduling between time includes the following steps:
  • An initialization step configuring the SDN switching device to realize the construction of a communication link between the CE device and the PE device;
  • VPN configuration step configure VPN on the controller
  • the controller delivers a phase flow table to the SDN switching device, wherein the flow table is used to perform conversion from a duplicate address in a VPN to a non-conflicting spatial address to distinguish different VPNs flow;
  • the controller configures different traffic scheduling paths for different VPN traffic according to a preset traffic scheduling strategy
  • the controller delivers the traffic scheduling path to the PE device.
  • the flow table uses non-conflicting spatial addresses to convert spatial addresses in the VPN.
  • the spatial address includes one or more of the following combinations:
  • Source IP address source MAC address, destination MAC address, source port, destination port, destination IP address.
  • the mapping relationship between the interface between the VPN and the SDN switching device is managed on the controller and space addresses are allocated based on different VPNs, where the mapping relationship refers to different CEs
  • the devices belong to different VPNs, and the interfaces connected to the SDN switching devices by different CE devices receive different VPN traffic.
  • the step of delivering the address translation flow table includes:
  • the controller obtains the port information of the packet entering the SDN switching device, and then knows which VPN the packet belongs to according to the mapping relationship;
  • a corresponding flow table is generated and delivered to the SDN switching equipment.
  • the first type of routing equipment is the first type of routing equipment
  • the second type of routing device is set separately from the first type of routing device
  • An SDN switching device is provided between the first type of routing device and the second type of routing device to implement a communication link between the first type of device and the second type of device Build;
  • the controller is used to centrally control the SDN switching equipment according to a prescribed protocol to implement scheduling of VPN traffic.
  • the first type of routing device is a CE device
  • the PE device of the second type of routing device is the PE device of the second type of routing device.
  • the controller centrally controls the SDN switching equipment through the Openflow protocol and the NETCONF protocol.
  • the controller delivers a phase flow table to the SDN switching device, where the flow table is used to perform conversion from a duplicate address in the VPN to a non-conflicting spatial address to distinguish different VPN flows.
  • the spatial address includes one or more of the following combinations:
  • Source IP address source MAC address, destination MAC address, source port, destination port, destination IP address.
  • the SDN switching device constructs a one-to-one correspondence communication link between the first type of routing device and the second type of routing device.
  • the controller has:
  • VPN management module used to implement VPN information management, port mapping relationship management, and IP address pool management
  • Forwarding strategy management module used to implement switch request processing, forwarding strategy generation and forwarding strategy delivery
  • Drainage management module used to implement drainage strategy management and delivery of drainage configuration.
  • the computer-readable medium of the present invention has a computer program stored thereon, which is characterized in that
  • the computer device of the present invention includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and is characterized in that the processor implements the computer program to implement the aforementioned SDN-based VPN traffic scheduling method.
  • the source space address (eg, IP address) of the traffic before entering the PE device and after leaving the PE device can be modified so that the Traffic scheduling does not need to consider the existence of VPN, so that it can implement flexible scheduling of traffic based on policy routing, etc., and it is compatible with most manufacturers' devices and breaks through the limitation of the amount of traffic brought by the service quality level.
  • FIG. 1 is a block diagram showing the configuration of the SDN-based VPN traffic scheduling system according to the first embodiment of the present invention.
  • FIG. 2 is a schematic flowchart showing the SDN-based VPN traffic scheduling method according to the first embodiment of the present invention.
  • FIG. 3 is a map showing the relationship between SDN switching equipment ports and VPN.
  • FIG. 4 is a schematic diagram showing a multi-VPN management model.
  • FIG. 5 is a schematic diagram showing a VPN traffic scheduling system of an example of the invention.
  • Virtual private network (virtual private network) is a new type of network innovation architecture of Emulex network and an implementation method of network virtualization. Its core technology, OpenFlow, realizes the network by separating the control surface of the network device from the data surface. The flexible control of the flow makes the network as a pipeline more intelligent.
  • Tunnels are similar to point-to-point connections. In this way, network services from many information sources can be transmitted through different tunnels in the same infrastructure.
  • the operation object is a data packet, which matches the data flow, specifically refers to the various fields in the data packet, commonly used quintuples: source IP, target IP, protocol, source port, and target port.
  • the edge router of the service provider's backbone network it is equivalent to a label edge router (LER).
  • LER label edge router
  • the routers in the entire network are divided into three categories: user edge routers (CE), operator edge routers (PE) and operator backbone routers (P); where PE acts as an IP VPN access router, PE router Connecting CE router and P router is the most important network node.
  • CE user edge routers
  • PE operator edge routers
  • P operator backbone routers
  • PE acts as an IP VPN access router
  • PE router Connecting CE router and P router is the most important network node.
  • User traffic flows into the user network through the PE router, or flows to the MPLS backbone network through the PE router.
  • the CE router provides service access for users by connecting one or more PE routers.
  • the CE router is usually an IP router, which establishes an adjacency relationship with the connected PE router.
  • VPN-INSTANCE VPN instance
  • the principle of the VPN instance is to virtualize a physical device into multiple virtual devices, and allocate the corresponding physical interfaces to the virtual devices for use, so as to achieve complete isolation between each virtual device and the root physical device. And each logical device is independent of each other, using its own independent routing table, independent process, independent access interface.
  • FIG. 1 is a block diagram showing the configuration of the SDN-based VPN traffic scheduling system according to the first embodiment of the present invention.
  • the PE device 20 is connected between the CE device 10 and the P device 30.
  • the feature of the present invention is that the CE device 10 and the PE
  • the device 20 further joins the SDN switching device 40 to implement the scheduling of VPN traffic, and at the same time, under the centralized control of the VPN traffic scheduling controller 50 (hereinafter referred to as "controller"), the VPN traffic is controlled by the SDN switching device 40 Map to a spatial address where IP does not conflict.
  • controller the VPN traffic is controlled by the SDN switching device 40 Map to a spatial address where IP does not conflict.
  • Multiple lines in Figure 1 indicate that there can be more than one interconnected compose line.
  • the traffic scheduling between the PE devices 20 does not need to consider VPN, so that a variety of diversion methods such as policy routing can be flexibly adopted to realize flexible diversion scheduling of cross-data center traffic.
  • the SDN switching device 40 provided between the CE device 10 and the PE device 20 is a key factor of the present invention, which mainly has the following two functions:
  • the number of connections between the CE device 10 and the PE device 30 is the same, so a one-to-one correspondence communication link between the CE device 10 and the PE device 30 can be constructed to transparently forward BGP and other networks between them
  • the protocol data packets are not perceptible by the SDN switching device 40 to the CE device 10 and the PE device 30.
  • FIG. 2 is a schematic flowchart showing the SDN-based VPN traffic scheduling method according to the first embodiment of the present invention.
  • the SDN-based VPN traffic scheduling method of the first embodiment of the present invention will be described below with reference to FIGS. 1 and 2 together.
  • the SDN-based VPN traffic scheduling method includes the following steps:
  • Initialization step S100 Configure the SDN switching device 40 to realize the construction of the communication link between the CE device 10 and the PE device 20;
  • VPN configuration step S200 configure a VPN on the controller 50, including the CE port, SDN controller port, and IP address pool corresponding to each VPN;
  • the address conversion flow table is issued in step S300: the controller 50 sends and receives the corresponding flow table on the SDN switching device 40 to perform the conversion from the duplicate address in the VPN to a non-conflicting spatial address;
  • VPN traffic scheduling step S400 configure a forwarding path on the controller 50 for specific traffic of the VPN;
  • Configuration delivery step S500 The routing rules for the translated addresses are delivered between the PE devices 20 to perform flexible scheduling of traffic.
  • the controller 50 After connecting between the CE device 10 and the PE device 20 through the SDN switching device 40 and establishing a management channel with the controller 50, the controller 50 establishes a control relationship with the SDN switching device 40. Since the SDN switching device 40 does not run any three-layer protocol, a communication link transparent to the CE device 10 and the PE device 20 can be constructed.
  • the controller 50 manages all VPN information in the network. This information is basic data, and all upper-layer functions are implemented based on this data.
  • the mapping relationship is generated on the connection interface with the CE device. Because different CE devices belong to different VPNs, the physical port of the SDN switching device 40 to which the different CE devices 10 are connected receives traffic of different VPNs.
  • FIG. 3 is a map showing the relationship between SDN switching equipment ports and VPN.
  • the first CE device, the second CE device, and the third CE device are illustrated as the CE device 10, where the first CE device belongs to VPN1, the second CE device belongs to VPN2, and the third CE device belongs to VPN3
  • the first CE device is connected to the P1 port of the SDN switching device 40 (that is, receives VPN1 traffic)
  • the second CE device is connected to the P2 port of the SDN switching device 40 (that is, receives VPN2 traffic).
  • the three CE devices are connected to the P3 port of the SDN switching device 40 (that is, receive the traffic of VPN3).
  • FIG. 4 is a schematic diagram showing a multi-VPN management model.
  • FIG. 4 is for explaining the management method under multiple VPNs.
  • each VPN instance has VPN service, IP address and tenant respectively. Because there are multiple VPN instances, it is necessary to ensure that the address pools between the VPN instances do not conflict when dividing the IP address pool.
  • Each VPN has its own independent IP resource.
  • the so-called mapped IP address pool means that after different VPN packets pass through the SDN switching device 40, the source IP addresses of the packets will be mapped to different IP address pools according to certain rules.
  • the IP address pools of each VPN are continuous and do not overlap with the IP address pools of other VPNs.
  • the number of IP address pools is configured and set by the administrator.
  • the switching device 40 When the SDN switching device 40 receives the data message from the VPN, since there is no forwarding flow table logic in the SDN switching device 40 at first, the switching device will forward the message to the controller 50 to request the relevant forwarding strategy. After receiving the relevant message, the controller 50 performs the following calculation processing:
  • the controller 50 reads the message, obtains the port information of its entry into the SDN switching device 40, and then knows which VPN the message belongs to based on the mapping relationship between the port and the VPN;
  • a corresponding flow table is generated and delivered to the SDN switching device 40.
  • the content of the flow table is as follows:
  • port i is the port connected to the CE device 10
  • j is the connection port between the PE device 20
  • IP 1 is the original packet IP address
  • IP 2 is the converted address taken from the IP address pool.
  • Ports m and n are connection ports between the PE device 20 and the CE device 10.
  • the controller 50 In this step, for the traffic scheduling policy configured in step S400, the controller 50 generates the relevant configuration and delivers the traffic scheduling configuration, where the IP address used is the address in the spatial address after conversion.
  • FIG. 5 is a schematic diagram showing a VPN traffic scheduling system of an example of the invention.
  • examples of CE devices include first CE device 101, second CE device 102, third CE device 103, and fourth CE device 104
  • examples of PE devices include The first PE device 201, the second PE device 202, the third PE device 203, and the fourth PE device 204 are examples of the SDN switching device: the first SDN switching device 301 and the second SDN switching device 302.
  • a first SDN switching device 301 is provided between the first CE device 101, the second CE device 102 and the first PE device 201, the second PE device 202, and the third CE device 103, the fourth CE device 104 and the first
  • a second SDN switching device 302 is provided between the third PE 203 and the fourth PE device 204, and uses the first SDN switching device 301, the second SDN switching device 302, and the controller 400 to schedule VPN traffic.
  • the VPN traffic scheduling controller 400 (hereinafter also referred to as "controller” for short) performs centralized control of the first SDN switching device 301 and the second SDN switching device 302 through the Openflow protocol and the NETCONF protocol.
  • the VPN traffic scheduling controller 400 includes: a VPN management module 410 for implementing VPN information management, port mapping relationship management, and IP address pool management; a forwarding strategy management module 420 for implementing switch request processing and forwarding strategies Generating and forwarding policy delivery; and a diversion management module 430, used to implement diversion policy management and delivery of diversion configuration.
  • the VPN traffic scheduling method of this example includes the following steps:
  • the communication links between the third CE device 103, the fourth CE device 104 and the third PE device 203, the fourth PE device 204 are constructed.
  • a VPN is configured on the controller 40, including a CE port, an SDN controller port, and an IP address pool corresponding to each VPN.
  • VPN1 and VPN2 are configured in this example: VPN1 and VPN2.
  • the first CE device 101 and the third CE device 103 of VPN1 are respectively connected to the P1 ports of the first SDN switching device 301 and the second SDN switching device 302, and the second CE device 102 and the fourth CE device 104 of VPN2 are respectively connected to the first SDN
  • the connection ports of the first SDN switching device 301 and the second SDN switching device 302 and the first PE device 201 to the fourth PE device are P3 and P4, respectively.
  • IP address pools for VPN1 and VPN2, VIP1: 1.1.1.1-1.1.1.254; VIP2: 2.2.2.1-2.2.2.254.
  • the source IP of the first CE device 101 is 192.168.1.1
  • the destination IP is 192.168.2.1
  • the port number 100 is sent to the first SDN switching device 301, since the first SDN switching device 301 has no forwarding policy At this time, the first SDN switching device 301 sends a request to the controller 400.
  • the controller 400 After receiving the request, the controller 400 first judges that the packet belongs to VPN1 according to the entry p1, and then goes to VIP1 to extract a mapped IP: 1.1.1.1 according to a certain logic (random, sequential, etc.), and then marks the IP as used.
  • the forwarding strategy management module 410 in the controller 400 generates the Openflow flow table using the forwarding strategy generation function as follows:
  • the first SDN switching equipment 301 The first SDN switching equipment 301:
  • the first SDN switching device 301 and the second SDN switching device 302 forward the data packet. Due to the role of the Openflow flow table, the source IP of the data packet received by the first PE device 201 and the second device 202 Has become 1.1.1.1.
  • the source IP address of the data packet is reversely converted due to the action of the openflow flow table, and the original IP address 192.168.1.1 is restored and sent to the third CE device 103. This completes the transparent transmission of the data packets within the VPN across the enterprise's cross-center network.
  • the traffic it sends is all traffic in the global state, so in the area of the PE node, the traffic scheduling in the enterprise wide area network can be completed by means of SR-based 5-tuple drainage.
  • the second CE device 102 also sends a data packet with the same IP element, the source IP is 192.168.1.1, the destination IP is 192.168.2.1, and the port number is 100. Also, since the first SDN switching device 301 has no forwarding strategy, the first SDN switching device 301 will send a request to the controller 400 at this time.
  • the controller 400 After receiving the request, the controller 400 also first judges that the packet belongs to VPN2 according to the entry p2, and then goes to VIP2 to take out a mapped IP according to a certain logic (random, sequential, etc.): 2.2.2.1, and then marks the IP as used .
  • the forwarding strategy management module 410 of the controller 400 uses the forwarding strategy generation function to form an Openflow flow table as follows:
  • the first SDN switching equipment 301 The first SDN switching equipment 301:
  • the first SDN switching device 301 and the second SDN switching device 302 forward the data packet. Due to the role of the Openflow flow table, the source of the data packet received by the third PE device 203 and the fourth second device 204 The IP has changed to 2.2.2.1.
  • the two data packets received by the first PE device 201 and the second device 202 and the third PE device 203 and the fourth second device 204 are no longer packets of the same IP element. Since its source address has changed, the two data packets will not collide during transmission. At this time, the administrator can use policy routing to perform five-tuple-based drainage on the data packets.
  • the policy is expressed as follows:
  • the routing rules for the converted address are delivered between the first PE device 201 and the fourth PE device 204 to perform flexible scheduling of traffic.
  • the VPN traffic is mapped to the spatial address where the IP does not conflict through the first SDN switching device 301 and the second SDN switching device 302, and, in the first The traffic scheduling between the PE device 201 and the fourth PE device 204 does not need to consider VPN, so that a variety of diversion methods such as policy routing can be flexibly adopted to realize flexible diversion scheduling of traffic across data centers.
  • the VPN traffic is mapped to the spatial address where the IP does not conflict through the first SDN switching device 301 and the second SDN switching device 302, and, in the first The traffic scheduling between the PE device 201 and the fourth PE device 204 does not need to consider VPN, so that a variety of diversion methods such as policy routing can be flexibly adopted to realize flexible diversion scheduling of traffic across data centers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明涉及一种基于SDN的VPN流量调度方法及其调度系统。该方法包括：配置所述SDN交换设备以实现所述CE设备和所述PE设备之间的通信链路构建；在控制器上进行VPN的配置；所述控制器向所述SDN交换设备下发相流表，其中，流表用于进行VPN内重复地址到一个不冲突空间地址的转换以区分不同的VPN流量；控制器按照预先设定的流量调度策略，对不同的VPN流量配置不同的流量调度路径；以及控制器将流量调度路径下发到PE设备。根据本发明，通过SDN交换设备把VPN流量映射到IP不冲突的地址空间，PE设备之间流量调度不需要考虑VPN从而可以灵活采用策略路由等多种引流方式实现跨数据中心流量的灵活调度。

Description

基于SDN的VPN流量调度方法以及基于SDN的VPN流量调度系统 技术领域
本发明涉及通信技术，尤其涉及基于SDN的VPN流量调度方法以及基于SDN的VPN流量调度系统。
背景技术
在一个跨数据中心基础网络上承载多个不同用户，不同用户之间的流量严格隔离。当不同用户的流量在网络上传输时，使用VPN技术进行区分，控制器支持在边缘路由器上通过VPN隔离出不同租户的路由区域，并通过路由器端口与VPN实例的映射实现VPN实例的动态管理。
为实现流量工程，跨中心网络常常采用建立隧道的方式进行流量路径的规划。当前用户对网络流量的要求越来越精细化，往往会具体到对某个应用流进行操作。在这种情况下，在VPN内部基于五元组的引流手段越来越重要。
那么当前在VPN环境中，其引流只能通过隧道策略引流、路由染色和服务等级进行引流。其中隧道策略引流和静态路由引流只能对整个VPN的流量实现整体引流，而路由染色也仅能基于目的IP进行引流，虽然服务等级可以精细化到五元组，但其数量只有8个，完全不能满足实际使用需求。
传统非VPN环境下，可通过策略路由的手段实现基于五元组的引流。但在VPN环境下，该手段经验证发现不适用：在经策略路由引流后，报文会丢失VPN相关信息，导致对端无法接收。
公开于本发明背景部分的信息仅仅旨在增加对本发明的总体背景的理解，而不应当被视为承认或以任何形式暗示该信息构成已为本领域一般技术人员所公知的现有技术。
发明内容
鉴于此，针对上述问题旨在提供一种基于SDN的VPN流量调度方法本发明的一方面的基于SDN的VPN流量调度方法，其特征在于，利用SDN交换设备以及控制器实现CE设备和PE设备之间的VPN流量调度，包括下述步骤：
初始化步骤，配置所述SDN交换设备以实现所述CE设备和所述PE设备之间的通信链路构建；
VPN配置步骤，在所述控制器上进行VPN的配置；
地址转换流表下发步骤，所述控制器向所述SDN交换设备下发相流表，其中，所述流表用于进行VPN内重复地址到一个不冲突空间地址的转换以区分不同的VPN流量；
VPN流量调度步骤，所述控制器按照预先设定的流量调度策略，对不同的VPN流量配置不同的流量调度路径；以及
配置下发步骤，所述控制器将所述流量调度路径下发到PE设备。
可选地，所述流表采用不冲突的空间地址进行VPN内的空间地址的转换。
可选地，所述空间地址包括下述的一项或者多项的组合：
源IP地址、源MAC地址、目的MAC地址、源端口、目的端口、目的IP地址。
可选地，在所述VPN配置步骤中，在所述控制器上管理VPN与SDN交换设备的接口之间的映射关系并且基于不同的VPN分配空间地址，其中所述映射关系是指不同的CE设备属于不同的VPN，不同的CE设备连接到SDN交换设备的接口收到的是不同的VPN流量。
可选地，所述地址转换流表下发步骤包括：
控制器获取报文进入SDN交换设备的端口信息，然后根据所述映射关系得知该报文属于哪个VPN；
获取VPN的IP地址池，顺序或随机获取一个IP地址，并且将该获取的IP地址标记为不可用；
根据获取到的IP，生成相应流表下发到SDN交换设备。
本发明一方面的基于SDN的VPN流量调度系统，其特征在于，具备：
第一类型的路由设备；
第二类型的路由设备，与所述第一类型的路由设备分离设置；
SDN交换设备，设置在所述第一类型的路由设备和所述第二类型的路由设备之间，用于实现所述第一类型的设备和所述第二类型的设备之间的通信链路构建；以及
控制器，用于根据规定协议对于SDN交换设备进行集中控制一实现对VPN流量 的调度。
可选地，所述第一类型的路由设备是CE设备，
所述第二类型的路由设备PE设备。
可选地，所述控制器通过Openflow协议和NETCONF协议对于SDN交换设备进行集中控制。
可选地，所述控制器向所述SDN交换设备下发相流表，其中，所述流表用于进行VPN内重复地址到一个不冲突空间地址的转换以区分不同的VPN流量。
可选地，所述空间地址包括下述的一项或者多项的组合：
源IP地址、源MAC地址、目的MAC地址、源端口、目的端口、目的IP地址。
可选地，所述SDN交换设备构建所述第一类型的路由设备和所述第二类型的路由设备之间的一一对应的通信链路。
可选地，所述控制器具备：
VPN管理模块，用于实现VPN信息管理、端口映射关系管理、以及IP地址池管理；
转发策略管理模块，用于实现交换机请求处理、转发策略生成以及转发策略下发；以及
引流管理模块，用于实现引流策略管理以及引流配置下发。
本发明的计算机可读介质，其上存储有计算机程序，其特征在于，
该计算机程序被处理器执行时实现上述的基于SDN的VPN流量调度方法。
本发明的计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现上述的基于SDN的VPN流量调度方法。
根据本发明，通过在CE设备和PE设备之间接入了SDN交换设备，能够对流量在进入PE设备之前和离开PE设备之后的修改源空间地址(例如IP地址)，使得在PE设备之间的流量调度可以不用考虑VPN的存在，从而可以基于策略路由等实现对流量的灵活调度，而且可以兼容大多数厂商设备并突破服务质量等级所带来的引流数量的限制。
通过纳入本文的附图以及随后与附图一起用于说明本发明的某些原理的 具体实施方式，本发明的方法和装置所具有的其它特征和优点将更为具体地变得清楚或得以阐明。
附图说明
图1是表示本发明的第一实施方式的基于SDN的VPN流量调度系统的结构框图。
图2是表示本发明的第一实施方式的基于SDN的VPN流量调度方法的流程示意图。
图3是表示SDN交换设备端口与VPN的关系映射图。
图4是表示多VPN管理模型的示意图。
图5是表示发明一个示例的VPN流量调度系统的构造示意图。
具体实施方式
下面介绍的是本发明的多个实施例中的一些，旨在提供对本发明的基本了解。并不旨在确认本发明的关键或决定性的要素或限定所要保护的范围。
在说明本发明之前，先对本发明中出现的若干技术用语进行简单说明。
(1)SDN
软件定义网络(Software Defined Network)。
(2)VPN
虚拟专用网络(virtual private network)，是Emulex网络一种新型网络创新架构，是网络虚拟化的一种实现方式，其核心技术OpenFlow通过将网络设备控制面与数据面分离开来，从而实现了网络流量的灵活控制，使网络作为管道变得更加智能。
(3)隧道技术
隧道类似于点到点的连接。这种方式能够使来自许多信息源的网络业务在同一个基础设施中通过不同的隧道进行传输。
(4)策略路由
策略路由是转发层面的行为，操作的对象是数据包，匹配的是数据流，具体是指数据包中的各个字段，常用五元组：源IP、目标IP、协议、源端口、目标端口。
(5)PE(Provider Edge)
即，Provide的边缘设备，服务提供商骨干网的边缘路由器，它相当于标签边缘路 由器(LER)。VPN概念中，把整个网络中的路由器分为三类：用户边缘路由器(CE)、运营商边缘路由器(PE)和运营商骨干路由器(P)；其中，PE充当IP VPN接入路由器，PE路由器连接CE路由器和P路由器，是最重要的网络节点。用户的流量通过PE路由器流入用户网络，或者通过PE路由器流到MPLS骨干网。
(6)CE(Customer Edge)
用户边缘设备，服务提供商所连接的用户端路由器。CE路由器通过连接一个或多个PE路由器，为用户提供服务接入。CE路由器通常是一台IP路由器，它与连接的PE路由器建立邻接关系。
(7)VPN实例(VPN-INSTANCE)
VPN实例的原理是将一台物理设备虚拟成多个虚拟设备，并将相应的物理接口分配至虚拟设备中使用，从而实现每个虚拟设备之间以及和根物理设备之间完全隔离。并且每一个逻辑设备之间都是相互独立的，使用自己独立的路由表、独立进程、独立进出接口。
图1是表示本发明的第一实施方式的基于SDN的VPN流量调度系统的结构框图。
如图1所示，在本发明的第一实施方式的基于SDN的VPN流量调度系统中，PE设备20连接CE设备10和P设备30之间，本发明的特征在于，在CE设备10和PE设备20之间进一步加入SDN交换设备40实现对VPN流量的调度，同时，在VPN流量调度控制器50(在后文中简称为“控制器”)的集中控制下，通过SDN交换设备40把VPN流量映射到IP不冲突的空间地址。图1中的“多根线”表示互联的撰线可以不止一条。
进一步，在本发明中，PE设备20之间的流量调度不需要考虑VPN，从而可以灵活采用策略路由等多种引流方式实现对跨数据中心流量的灵活引流调度。
其中，特别地在于，设置在CE设备10和PE设备20之间的SDN交换设备40是本发明的一个关键因素，其主要有如下两个作用：
(1)充当CE设备10和PE设备30之间的数据转发通道。它到CE设备10和PE设备30之间的连线数量是相同的，因此可以构建CE设备10和PE设备30之间的一一对应的通信链路，从而透明转发他们之间的BGP等网络协议数据包， 对于CE设备10和PE设备30来说SDN交换设备40是感知不到的。
(2)把VPN内IP地址重复的数据包映射到不冲突的一个空间地址内：对于从CE设备10到PE设备30的数据包是把原有IP 1修改为不冲突的IP 2，而对于从PE设备30到CE设备10的数据包则是把IP 2重新还原为IP 1。
图2是表示本发明的第一实施方式的基于SDN的VPN流量调度方法的流程示意图。
以下参照图1和图2一起说明本发明的第一实施方式的基于SDN的VPN流量调度方法。
如图2所示，本发明的第一实施方式的基于SDN的VPN流量调度方法包括下述步骤：
初始化步骤S100：配置SDN交换设备40以实现CE设备10和PE设备20之间的通信链路构建；
VPN配置步骤S200：在控制器50上配置VPN，包括每个VPN对应的CE端口、SDN控制器端口、IP地址池；
地址转换流表下发步骤S300：控制器50在SDN交换设备40上下发相应的流表进行VPN内重复地址到一个不冲突空间地址的转换；
VPN流量调度步骤S400：在控制器50上对VPN的特定流量配置转发路径；
配置下发步骤S500：在PE设备20之间下发针对转换后的地址的路由规则进行流量的灵活调度。
接着，这些步骤进行具体说明。
(1)初始化步骤S100
在通过SDN交换设备40连接CE设备10和PE设备20之间并和控制器50建立管理通道之后，控制器50会对SDN交换设备40建立控制关系。由于SDN交换设备40不运行任何三层协议，因此可以构建一条对于CE设备10和PE设备20来说透明的通信链路。
(2)VPN配置步骤S200
在该步骤中进行VPN的配置工作。VPN的配置工作主要有三个，具体如下：
①管理VPN数据
控制器50管理网络中所有的VPN信息。该信息为基础数据，所有上层功能都基 于该数据来进行实现。
②管理VPN与SDN交换设备接口的映射关系。
该映射关系是在与CE设备的连接接口上产生的。因为不同的CE设备属于不同的VPN，所以不同CE设备10连接到的SDN交换设备40的物理口，收到是不同VPN的流量。
图3是表示SDN交换设备端口与VPN的关系映射图。
如图3所示，作为CE设备10图示了第一CE设备、第二CE设备以及第三CE设备，其中，第一CE设备属于VPN1，第二CE设备属于VPN2，第三CE设备属于VPN3，另一方面，第一CE设备连接到SDN交换设备40的P1端口(即收到VPN1的流量)，第二CE设备连接到SDN交换设备40的P2端口(即收到VPN2的流量)，第三CE设备连接到SDN交换设备40的P3端口(即收到VPN3的流量)。
在控制器50中能够对这些关系数据进行管理，这样后面就知道不同端口收到的数据是属于哪个VPN的。
③为不同VPN分配映射IP地址池图4是表示多VPN管理模型的示意图。图4是为了说明多VPN下的管理方式。如图4所示，在一个VPN主控下面具有多个VPN实例。其中，每个VPN实例分别具备VPN服务、IP地址以及租户。因为存在多个VPN实例，所以在划分IP地址池的时候要保证各VPN实例之间的地址池不冲突，每个VPN都有自己独立的ip资源。
在本发明中，所谓映射IP地址池，就是不同VPN报文经过SDN交换设备40后，会将报文的源IP地址根据一定规则映射到不同的IP地址池中。各VPN的IP地址池都是连续的，且不与其它VPN的IP地址池重叠，IP地址池数量由管理员配置设定。
(3)地址转换流表下发步骤S300
当SDN交换设备40接收到来自VPN的数据报文时，由于一开始SDN交换设备40内并无转发流表逻辑，因此交换设备会将报文转发至控制器50，请求相关转发策略。控制器50接收到相关报文后，进行如下计算处理：
①首先，控制器50读取报文，获取其进入SDN交换设备40的端口信息，然后根据端口与VPN的映射关系，得知该报文属于哪个VPN；
②获取VPN的IP地址池，顺序或随机获取一个IP地址，获取该IP地址后，将该IP地址标记为不可用。如此后续报文将不会采用该IP进行地址转换。
③根据获取到的IP，生成相应流表下发到SDN交换设备40。流表内容如下：
ip,in_port＝i,nw_src＝IP 1,actions＝mod_nw_src＝IP 2,output:j
其中，端口i为与CE设备10连接的端口，j为与PE设备20之间的连接端口,IP 1为原始报文IP地址，IP 2为从IP地址池中取出的转换后的地址。
同时，在对端的SDN交换设备40上，也会下发一条对应的反转换流表，将IP地址复原，内容如下：
ip,in_port＝m,nw_src＝IP 2,actions＝mod_nw_src＝IP 1,output:n
其中端口m和n为PE设备20和CE设备10之间的连线端口。
经过下发这样两个流表之后，就可以实现在PE设备20之间只需要针对空间地址中的地址进行操作即可，而不需要考虑VPN的存在。
(4)VPN流量调度步骤S400
由于在PE设备20之间没有VPN的存在，且不同VPN的流量已通过划分IP地址池的方式进行了切分，因此可以采用策略路由方式进行引流，至此做到了基于五元组引流的目的。
(5)配置下发步骤S500
在该步骤中，针对步骤S400中配置的流量调度策略，控制器50生成相关配置，下发流量调度配置，其中使用的IP地址为转换之后的空间地址中的地址。
接着，对于本发明的一个示例的VPN流量调度系统以及VPN流量调度方法进行说明。
图5是表示发明一个示例的VPN流量调度系统的构造示意图。
如图5所示，在该示例的VPN流量调度系统中，作为CE设备示例有第一CE设备101、第二CE设备102、第三CE设备103、第四CE设备104，作为PE设备示例有第一PE设备201、第二PE设备202、第三PE设备203以及第四PE设备204，作为SDN交换设备示例有第一SDN交换设备301以及第二SDN交换设备302。
其中，在第一CE设备101、第二CE设备102和第一PE设备201、第二 PE设备202之间设置第一SDN交换设备301，在第三CE设备103、第四CE设备104和第三PE 203、第四PE设备204之间设置第二SDN交换设备302，利用第一SDN交换设备301、第二SDN交换设备302以及控制器400对VPN流量的调度。
同时，VPN流量调度控制器400(在后文中也简称为“控制器”)通过Openflow协议和NETCONF协议对于第一SDN交换设备301以及第二SDN交换设备302进行集中控制。具体地，在VPN流量调度控制器400具备：VPN管理模块410，用于实现VPN信息管理、端口映射关系管理、以及IP地址池管理；转发策略管理模块420，用于实现交换机请求处理、转发策略生成以及转发策略下发；以及引流管理模块430，用于实现引流策略管理以及引流配置下发。
该示例的VPN流量调度方法包括以下步骤：
(1)初始化步骤S100
配置第一SDN交换设备301以实现第一CE设备101、第二CE设备102与第一PE设备201、第二PE设备202之间的通信链路构建以及配置第一SDN交换设备302以实现第三CE设备103、第四CE设备104与第三PE设备203、第四PE设备204之间的通信链路构建。
(2)VPN配置步骤
如图5所示，在该示例中，在控制器40上配置VPN，包括每个VPN对应的CE端口、SDN控制器端口、IP地址池。
具体地，在本示例中配置两个VPN：VPN1、VPN2。VPN1的第一CE设备101和第三CE设备103分别连接第一SDN交换设备301和第二SDN交换设备302的P1端口，VPN2的第二CE设备102和第四CE设备104分别连接第一SDN交换设备301和第二SDN交换设备302的P2端口。第一SDN交换设备301和第二SDN交换设备302与第一PE设备201～第四PE设备的连接口分别为P3，P4。
进一步，管理员分别为VPN1和VPN2分配IP地址池，VIP1：1.1.1.1-1.1.1.254；VIP2：2.2.2.1-2.2.2.254。
(3)地址转换流表下发步骤
当第一CE设备101的有源IP为192.168.1.1，目的IP为192.168.2.1，端口号为 100的数据包发送到第一SDN交换设备301上时，由于第一SDN交换设备301无转发策略，此时第一SDN交换设备301会向控制器400发出请求。
控制器400收到请求后，首先根据入口p1判断该报文属于VPN1，然后去VIP1中按照一定逻辑(随机、顺序等)取出一个映射IP：1.1.1.1，然后将该IP标记为已用。
随后控制器400中的转发策略管理模块410中，利用转发策略生成功能生成Openflow流表如下：
第一SDN交换设备301:
ip,in_port＝p1,nw_src＝192.168.1.1,actions＝mod_nw_src＝1.1.1.1,output:p3
第二SDN交换设备302:
ip,in_port＝p3,nw_src＝1.1.1.1,actions＝mod_nw_src＝192.168.1.1,output:p1；
ip,in_port＝p4,nw_src＝1.1.1.1,actions＝mod_nw_src＝192.168.1.1,output:p1
随后下发到第一SDN交换设备301和第二SDN交换设备302上。
第一SDN交换设备301和第二SDN交换设备302接收到该转发策略后，对数据包进行转发，由于Openflow流表作用，第一PE设备201和第二设备202接收到的数据包的源IP已变为1.1.1.1。
数据包穿过PE设备，发送到第二SDN交换机302后，由于openflow流表作用，数据包源IP地址会进行反转换，还原至原始的IP地址192.168.1.1后发送到第三CE设备103，至此完成VPN内部的数据包在企业跨中心网络中的透传。
由于PE节点中没有设置VPN，其发送的流量全部为全局状态下的流量，因此在PE节点的区域内可通过基于SR的五元组引流的手段完成在企业广域网中的流量调度。
此时，第二CE设备102也有相同IP元素的数据包发来，源IP为192.168.1.1，目的IP为192.168.2.1，端口号为100。同样由于第一SDN交换设备301无转发策略，此时第一SDN交换设备301会向控制器400发出请求。
控制器400收到请求后，同样首先根据入口p2判断该报文属于VPN2，然后去VIP2中按照一定逻辑(随机、顺序等)取出一个映射IP：2.2.2.1，然后将该IP标记为已用。
控制器400的转发策略管理模块410中，利用转发策略生成功能成 Openflow流表如下：
第一SDN交换设备301:
ip,in_port＝p2,nw_src＝192.168.1.1,actions＝mod_nw_src＝2.2.2.1,output:p3
第二SDN交换设备302:
ip,in_port＝p3,nw_src＝2.2.2.1,actions＝mod_nw_src＝192.168.1.1,output:p2；
ip,in_port＝p4,nw_src＝2.2.2.1,actions＝mod_nw_src＝192.168.1.1,output:p2
随后下发到第一SDN交换设备301和第二SDN交换设备302上。
第一SDN交换设备301和第二SDN交换设备302接收到该转发策略后，对数据包进行转发，由于Openflow流表作用，第三PE设备203和第四二设备204接收到的数据包的源IP已变为2.2.2.1。
(4)VPN流量调度步骤
如上述这样，，第一PE设备201和第二设备202和第三PE设备203和第四二设备204接收到的两个数据包，已经不再是同一IP元素的报文了。由于其源地址已经发生改变，因此两数据包在传输的时候不会发生冲突。此时管理员就可采用策略路由的方式，对数据包进行基于五元组的引流，策略表示如下：
If源IP＝1.1.1.1目的IP＝192.169.2.1端口＝100
Then数据包从隧道1转发
If源IP＝2.2.2.1目的IP＝192.169.2.1端口＝100
Then数据包从隧道2转发
这样即完成对于不同VPN内部基于五元组进行的引流能力。
(5)配置下发步骤
在第一PE设备201～第四PE设备204之间下发针对转换后的地址的路由规则进行流量的灵活调度。
如此，在本示例中，通过VPN流量调度控制器400的集中控制下，通过第一SDN交换设备301和第二SDN交换设备302把VPN流量映射到IP不冲突的空间地址，而且，在第一PE设备201～第四PE设备204之间的流量调度不需要考虑VPN，从而可以灵活采用策略路由等多种引流方式实现对跨数据中心流量的灵活引流调度。
如此，在本示例中，通过VPN流量调度控制器400的集中控制下，通过 第一SDN交换设备301和第二SDN交换设备302把VPN流量映射到IP不冲突的空间地址，而且，在第一PE设备201～第四PE设备204之间的流量调度不需要考虑VPN，从而可以灵活采用策略路由等多种引流方式实现对跨数据中心流量的灵活引流调度。
以上例子主要说明了本发明的VPN流量调度系统以及VPN流量调度方法。尽管只对其中一些本发明的具体实施方式进行了描述，但是本领域普通技术人员应当了解，本发明可以在不偏离其主旨与范围内以许多其他的形式实施。因此，所展示的例子与实施方式被视为示意性的而非限制性的，在不脱离如所附各权利要求所定义的本发明精神及范围的情况下，本发明可能涵盖各种的修改与替换。

Claims (14)

  1. 一种基于SDN的VPN流量调度方法，其特征在于，利用SDN交换设备以及控制器实现CE设备和PE设备之间的VPN流量调度，包括下述步骤：
    初始化步骤，配置所述SDN交换设备以实现所述CE设备和所述PE设备之间的通信链路构建；
    VPN配置步骤，在所述控制器上进行VPN的配置；
    地址转换流表下发步骤，所述控制器向所述SDN交换设备下发相流表，其中，所述流表用于进行VPN内重复地址到一个不冲突空间地址的转换以区分不同的VPN流量；
    VPN流量调度步骤，所述控制器按照预先设定的流量调度策略，对不同的VPN流量配置不同的流量调度路径；以及
    配置下发步骤，所述控制器将所述流量调度路径下发到PE设备。
  2. 如权利要求1所述的基于SDN的VPN流量调度方法，其特征在于，
    所述流表采用不冲突的空间地址进行VPN内的空间地址的转换。
  3. 如权利要求1所述的基于SDN的VPN流量调度方法，其特征在于，
    所述空间地址包括下述的一项或者多项的组合：
    源IP地址、源MAC地址、目的MAC地址、源端口、目的端口以及目的IP地址。
  4. 如权利要求1所述的基于SDN的VPN流量调度方法，其特征在于，
    在所述VPN配置步骤中，在所述控制器上管理VPN与SDN交换设备的接口之间的映射关系并且基于不同的VPN分配空间地址，其中所述映射关系是指不同的CE设备属于不同的VPN，不同的CE设备连接到SDN交换设备的接口收到的是不同的VPN流量。
  5. 如权利要求4所述的基于SDN的VPN流量调度方法，其特征在于，
    所述地址转换流表下发步骤包括：
    控制器获取报文进入SDN交换设备的端口信息，然后根据所述映射关系得知该报文属于哪个VPN；
    获取VPN的IP地址池，顺序或随机获取一个IP地址，并且将该获取的IP地址 标记为不可用；
    根据获取到的IP，生成相应流表下发到SDN交换设备。
  6. 一种基于SDN的VPN流量调度系统，其特征在于，具备：
    第一类型的路由设备；
    第二类型的路由设备，与所述第一类型的路由设备分离设置；
    SDN交换设备，设置在所述第一类型的路由设备和所述第二类型的路由设备之间，用于实现所述第一类型的设备和所述第二类型的设备之间的通信链路构建；以及
    控制器，用于根据规定协议对于SDN交换设备进行集中控制一实现对VPN流量的调度。
  7. 如权利要求6所述的基于SDN的VPN流量调度系统，其特征在于，
    所述第一类型的路由设备是CE设备，
    所述第二类型的路由设备PE设备。
  8. 如权利要求6所述的基于SDN的VPN流量调度系统，其特征在于，
    所述控制器通过Openflow协议和NETCONF协议对于SDN交换设备进行集中控制。
  9. 如权利要求6所述的基于SDN的VPN流量调度系统，其特征在于，
    所述控制器向所述SDN交换设备下发相流表，其中，所述流表用于进行VPN内重复地址到一个不冲突空间地址的转换以区分不同的VPN流量。
  10. 如权利要求9所述的基于SDN的VPN流量调度系统，其特征在于，
    所述空间地址包括下述的一项或者多项的组合：
    源IP地址、源MAC地址、目的MAC地址、源端口、目的端口、目的IP地址。
  11. 如权利要求6所述的基于SDN的VPN流量调度系统，其特征在于，
    所述SDN交换设备构建所述第一类型的路由设备和所述第二类型的路由设备之间的一一对应的通信链路。
  12. 如权利要求6所述的基于SDN的VPN流量调度系统，其特征在于，所述控制器具备：
    VPN管理模块，用于实现VPN信息管理、端口映射关系管理、以及IP地址池管理；
    转发策略管理模块，用于实现交换机请求处理、转发策略生成以及转发策略下发；以及
    引流管理模块，用于实现引流策略管理以及引流配置下发。
  13. 一种计算机可读介质，其上存储有计算机程序，其特征在于，
    该计算机程序被处理器执行时实现权利要求1～5中任意一项所述的基于SDN的VPN流量调度方法。
  14. 一种计算机设备，包括存储器、处理器以及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现权利要求1～5中任意一项所述的基于SDN的VPN流量调度方法。
PCT/CN2019/094985 2018-12-25 2019-07-08 基于sdn的vpn流量调度方法以及基于sdn的vpn流量调度系统 Ceased WO2020134017A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/043,237 US11296997B2 (en) 2018-12-25 2019-07-08 SDN-based VPN traffic scheduling method and SDN-based VPN traffic scheduling system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811589642.4 2018-12-25
CN201811589642.4A CN110035012B (zh) 2018-12-25 2018-12-25 基于sdn的vpn流量调度方法以及基于sdn的vpn流量调度系统

Publications (1)

Publication Number Publication Date
WO2020134017A1 true WO2020134017A1 (zh) 2020-07-02

Family

ID=67235394

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/094985 Ceased WO2020134017A1 (zh) 2018-12-25 2019-07-08 基于sdn的vpn流量调度方法以及基于sdn的vpn流量调度系统

Country Status (4)

Country Link
US (1) US11296997B2 (zh)
CN (1) CN110035012B (zh)
TW (1) TWI715107B (zh)
WO (1) WO2020134017A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3989512A1 (en) * 2020-10-21 2022-04-27 Huawei Technologies Co., Ltd. Method for controlling traffic forwarding, device, and system

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112468325B (zh) * 2020-11-11 2023-07-11 广州鲁邦通物联网科技股份有限公司 一种可复用的vpn架构和vpn调度方法
CN114019442B (zh) * 2021-10-21 2024-07-23 深圳市科陆电子科技股份有限公司 电能计量误差校准检定方法、装置及存储介质
CN114039917A (zh) * 2021-11-26 2022-02-11 中国电信集团系统集成有限责任公司 一种网络流量调度综合判定方法及系统
US20230291713A1 (en) * 2022-03-09 2023-09-14 Alkira, Inc. Internet facing application
CN119697021B (zh) * 2024-12-11 2025-10-28 国网新疆电力有限公司信息通信公司 一种智能vpn业务自动开通系统及其资源冲突检测方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104158745A (zh) * 2013-05-13 2014-11-19 中兴通讯股份有限公司 一种实现数据包转发的方法及系统
CN106713137A (zh) * 2015-11-13 2017-05-24 中国电信股份有限公司 基于分段路由和sdn技术的vpn方法、装置及系统
CN107026791A (zh) * 2016-01-29 2017-08-08 华为技术有限公司 虚拟专用网络vpn业务优化方法和设备
US20170289027A1 (en) * 2016-03-30 2017-10-05 Juniper Networks, Inc. ROUTING INTER-AS LSPs WITH CENTRALIZED CONTROLLER
CN108322391A (zh) * 2017-12-29 2018-07-24 中国银联股份有限公司 基于流表的数据传送方法

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1254059C (zh) * 2002-12-10 2006-04-26 华为技术有限公司 一种多协议标签交换虚拟专用网的实现方法
US8873398B2 (en) 2011-05-23 2014-10-28 Telefonaktiebolaget L M Ericsson (Publ) Implementing EPC in a cloud computer with openflow data plane
US8955112B2 (en) 2011-08-18 2015-02-10 At&T Intellectual Property I, L.P. Dynamic traffic routing and service management controls for on-demand application services
CN102394828A (zh) * 2011-11-11 2012-03-28 杭州华三通信技术有限公司 一种跨vpn访问时的报文传输方法和设备
US9680870B2 (en) * 2012-12-28 2017-06-13 Verizon Patent And Licensing Inc. Software-defined networking gateway
US9407544B1 (en) * 2013-04-30 2016-08-02 Cisco Technology, Inc. Network virtualization using IP map and encapsulation
CN113542093B (zh) * 2013-05-24 2024-11-29 华为技术有限公司 用于以太虚拟专用网的方法和设备
CN104253751B (zh) * 2014-09-04 2018-04-06 新华三技术有限公司 一种基于多角色主机的报文传输方法和设备
TW201728124A (zh) * 2014-09-16 2017-08-01 科勞簡尼克斯股份有限公司 以彈性地定義之通信網路控制器為基礎之網路控制、操作及管理
CN105791153B (zh) * 2014-12-24 2019-04-30 中国电信股份有限公司 业务流量调度方法和系统及流量控制器和网络边缘设备
US10341379B2 (en) 2016-02-12 2019-07-02 Time Warner Cable Enterprises Llc Apparatus and methods for mitigation of network attacks via dynamic re-routing
CN107360089B (zh) 2016-05-10 2021-03-19 新华三技术有限公司 一种路由建立方法、业务数据转换方法及装置
US10079805B2 (en) * 2016-06-13 2018-09-18 Fujitsu Limited Bypassing a firewall for authorized flows using software defined networking

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104158745A (zh) * 2013-05-13 2014-11-19 中兴通讯股份有限公司 一种实现数据包转发的方法及系统
CN106713137A (zh) * 2015-11-13 2017-05-24 中国电信股份有限公司 基于分段路由和sdn技术的vpn方法、装置及系统
CN107026791A (zh) * 2016-01-29 2017-08-08 华为技术有限公司 虚拟专用网络vpn业务优化方法和设备
US20170289027A1 (en) * 2016-03-30 2017-10-05 Juniper Networks, Inc. ROUTING INTER-AS LSPs WITH CENTRALIZED CONTROLLER
CN108322391A (zh) * 2017-12-29 2018-07-24 中国银联股份有限公司 基于流表的数据传送方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3989512A1 (en) * 2020-10-21 2022-04-27 Huawei Technologies Co., Ltd. Method for controlling traffic forwarding, device, and system
US12068955B2 (en) 2020-10-21 2024-08-20 Huawei Technologies Co., Ltd. Method for controlling traffic forwarding, device, and system

Also Published As

Publication number Publication date
TW202025813A (zh) 2020-07-01
CN110035012A (zh) 2019-07-19
CN110035012B (zh) 2021-09-14
US11296997B2 (en) 2022-04-05
TWI715107B (zh) 2021-01-01
US20210021537A1 (en) 2021-01-21

Similar Documents

Publication Publication Date Title
TWI715107B (zh) 基於ｓｄｎ的ｖｐｎ流量調度方法以及基於ｓｄｎ的ｖｐｎ流量調度系統
JP6491241B2 (ja) クラウドベースのサービス交換
CN102546351B (zh) openflow网络和现有IP网络互联的系统和方法
US8488491B2 (en) Compressed virtual routing and forwarding in a communications network
CN117178534A (zh) 存在点中的网络管理服务
EP3731474A1 (en) Path computation element central controllers (pceccs) for network services
CN109039703A (zh) 一种复杂网络模拟环境下业务场景网络快速构建的方法及系统
CN107770062A (zh) 一种数据包发送方法、装置及网络架构
CN107547333B (zh) 用于实现组合虚拟专用网vpn的方法与装置
WO2021007963A1 (zh) 路由分发方法及控制器、信息路由方法及网络节点设备
EP3621243B1 (en) Virtual network creation method, apparatus and transport network system
WO2014121460A1 (zh) 一种网络虚拟化的数据传输的方法、设备和路由系统
CN108111383A (zh) 一种基于sdn的跨域容器虚拟网络组建方法
CN110022262B (zh) 一种基于sdn网络实现平面分离的方法、系统和装置
CN112291252A (zh) 一种南北向流量对称性引流的实现架构及方法
CN115499434A (zh) 跨vpc的流量转发方法
WO2019184653A1 (zh) 链路配置方法和控制器
CN112671650A (zh) Sd-wan场景下的端到端sr控制方法、系统和可读存储介质
WO2018157466A1 (zh) 一种基于sdn的跨数据中心通信方法和网络系统
CN111726253A (zh) 云计算核心网络系统
CN107592259B (zh) 一种vrrp保护场景中流量切换方法
CN108880969B (zh) 一种sdn网络中建立链路的方法和装置
JP2022533224A (ja) ネットワーク制御方法、装置、およびシステム
AU2024326916A1 (en) Tenant-specific virtual tunnel endpoints for vxlans
WO2024113867A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19902977

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19902977

Country of ref document: EP

Kind code of ref document: A1