US20120044935A1 - Relay control unit, relay control system, relay control method, and relay control program - Google Patents
Relay control unit, relay control system, relay control method, and relay control programDownload PDFInfo
- Publication number
- US20120044935A1 US20120044935A1US13/137,926US201113137926AUS2012044935A1US 20120044935 A1US20120044935 A1US 20120044935A1US 201113137926 AUS201113137926 AUS 201113137926AUS 2012044935 A1US2012044935 A1US 2012044935A1
- Authority
- US
- United States
- Prior art keywords
- packet
- unit
- relay
- allow
- communication
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034methodMethods0.000titleclaimsabstractdescription191
- 238000004891communicationMethods0.000claimsabstractdescription195
- 230000008569processEffects0.000claimsabstractdescription175
- 230000005540biological transmissionEffects0.000claimsdescription40
- 230000009471actionEffects0.000description103
- 238000010586diagramMethods0.000description31
- 230000003068static effectEffects0.000description28
- 230000000875corresponding effectEffects0.000description20
- 230000001276controlling effectEffects0.000description10
- 230000006870functionEffects0.000description6
- OTMSDBZUPAUEDD-UHFFFAOYSA-NEthaneChemical compoundCCOTMSDBZUPAUEDD-UHFFFAOYSA-N0.000description5
- 230000006399behaviorEffects0.000description4
- 230000000694effectsEffects0.000description3
- NRNCYVBFPDDJNE-UHFFFAOYSA-NpemolineChemical compoundO1C(N)=NC(=O)C1C1=CC=CC=C1NRNCYVBFPDDJNE-UHFFFAOYSA-N0.000description3
- 230000008859changeEffects0.000description2
- 230000003044adaptive effectEffects0.000description1
- 230000003247decreasing effectEffects0.000description1
- 230000001747exhibiting effectEffects0.000description1
- 230000012447hatchingEffects0.000description1
- 230000004044responseEffects0.000description1
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
- H04L12/462—LAN interconnection over a bridge based backbone
- H04L12/4625—Single bridge functionality, e.g. connection of two networks over a single bridge
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
- H04L41/0816—Configuration setting characterised by the conditions triggering a change of settings the condition being an adaptation, e.g. in response to network events
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/02—Topology update or discovery
- H04L45/028—Dynamic adaptation of the update intervals, e.g. event-triggered updates
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/38—Flow based routing
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0263—Rule management
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0894—Policy-based network configuration management
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0254—Stateful filtering
Definitions
- the present inventionrelates to a relay control unit, a relay control system, and a relay control program for controlling processing performed by a packet relay unit, and a packet relay unit, a packet relay method, and a packet relay program applied to the relay control system.
- NPL 1 and NPL 2each describe a network architecture according to Ethane.
- Ethaneis a network architecture including a controller that determines behaviors of packets transmitted and switches that are under control of the controller and forward packets.
- Each switchincludes a flow table for determining destinations of packets. Upon receiving a packet whose destination is indicated by an entry in the flow table, the switch transmits the packet based on the entry. Upon receiving a packet having no corresponding entry in the flow table, on the other hand, the switch forwards information of the packet to the controller.
- the controllerhas information about a communication network topology, and performs path computation for a packet for which communication is allowed. In detail, upon receiving the information of the packet from the switch, the controller determines whether to allow or not to allow communication of the packet. In the case of determining to allow the communication, the controller computes a path of the packet. The controller then adds a new destination entry to a flow table of each switch on the computed path. The switch subsequently transmits the packet based on the registered destination entry.
- NPL 3describes a network architecture according to OpenFlow (hereafter also referred to as “OF”).
- OpenFlowis a network architecture in which a controller controls switches.
- a packet forwarding function and a path control functionare separated by a flow control protocol, where the controller controls different types of switches using a uniform API (Application Program Interface).
- a uniform APIApplication Program Interface
- packet control in flow granularityis performed for faster datapath and lower control cost.
- Each switch in OFincludes a flow table for storing actions for received packets, and a secure channel through which the switch communicates with the controller.
- the switch and the controllercommunicate with each other on the secure channel, using an OF protocol.
- FIG. 20is an explanatory diagram showing flow entries stored in a flow table.
- the flow tablestores, for each flow, a rule (Rule) against which a packet header is checked, an action (Action) defining a process for the flow, and flow statistic information (Statistics).
- FIG. 21is an explanatory diagram showing fields against which the packet header is checked. The following fields are used as search keys against which the packet header is checked.
- MACMedia Access Control
- MAC SAMAC source address
- VLAN IDVirtual LAN (Local Area Network) ID
- VLAN TYPEpriority of an Ethernet (registered trademark) (Ethernet (registered trademark)) layer
- IP SAIP source address
- IP DAIP destination address
- TCP/UDP source portand/or Destination Port (TCP/UDP destination port) of a TCP (Transmission Control Protocol)/UDP (User Datagram Protocol) layer
- the actionis a process applied to a packet that matches the rule.
- FIG. 22is an explanatory diagram showing actions set for a flow. For example, in the case where “OUTPUT” is set in the action, it means that the switch performs “output to designated port” on the packet that matches the rule. Likewise, in the case where “SET_DL_DST” is set in the action, it means that the switch performs “update MAC DA (destination unit)” to which the packet that matches the rule is transmitted.
- the flow statistic informationincludes the number of packets and the number of bytes of packets that match the rule, an elapsed time (session duration) from reception of a last one of the packets, and the like.
- the flow statistic informationis used for determining whether or not to delete the flow entry.
- the switchUpon receiving a packet, the switch compares a packet header of the received packet with the rule in the flow table. In the case where the received packet does not match the rule, the switch forwards information of the packet to the controller, using a message in the secure channel. The controller computes a transmission path of the packet, based on a communication network topology. The controller then transmits a message for adding a flow entry to the flow table of the switch, to enable the switch to relay the packet along the transmission path. Subsequently, upon receiving a packet corresponding to the added flow entry, the switch performs a corresponding action (forwarding process), without forwarding information of the packet to the controller.
- a corresponding actionforwarding process
- FIG. 23is an explanatory diagram showing messages used on the secure channel.
- the switchtransmits a message “Packet in” to the controller, in the case of notifying the controller of an input packet.
- the switchtransmits a message “Flow Expired” to the controller, in the case of notifying the controller of expiration of a flow (session duration reaching a predetermined time).
- the controllertransmits a message “Packet Out” to the switch, in the case of instructing the switch to output a packet.
- the controllertransmits a message “Flow Mod” to the switch, in the case of requesting the switch to register, change, or delete a flow.
- NPL 1Martin Casado, and five others, “Ethane: Taking Control of the Enterprise”, ACM SIGCOMM Computer Communication Review, Volume 37, Issue 4, SESSION: Enterprise networks, Pages: 1 to 12, October 2007
- NPL 2Martin Casado, and five others, “Architectural Support for Security Management in Enterprise Networks”, Slide 11, [online], [search on Aug. 24, 2009], Internet ⁇ URL: http://www.soi.wide.ad.jp/project/sigcomm2007/pdf/sig11.pdf>
- NPL 3Nick McKeown, and seven others, “OpenFlow: Enabling Innovation in Campus Networks”, [online], [search on Aug. 24, 2009], Internet ⁇ URL:
- the switchIn the case where the switch receives again the packet for which the controller does not allow communication, the switch normally queries the controller again, and the controller determines again whether to allow or not to allow communication for the packet. That is, in the case where the switch repeatedly receives a packet for which communication is not allowed, the switch needs to query the controller each time, and also the controller needs to determine each time whether to allow or not to allow communication. This causes a problem of a high processing load on both the switch and the controller.
- the switchwhen retransmission is repeatedly performed in TCP communication because a packet does not arrive at a destination unit, the switch will end up repeatedly receiving the same packet. In this case, each time the packet arrives at the switch, the switch queries the controller. This causes a problem of an increase in CPU load of both the switch and the controller.
- an exemplary object of the present inventionis to provide a relay control unit, a relay control system, and a relay control program that can reduce a load of processing performed by a packet relay unit on a packet for which communication to a destination unit is not allowed, and a packet relay unit, a packet relay method, and a packet relay program that are applied to the relay control system.
- a relay control unitis a relay control unit for controlling a packet relay unit, the relay control unit comprising: communication allowance determination means for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition.
- a relay control systemcomprises: a packet relay unit; and a relay control unit for controlling the packet relay unit, wherein the relay control unit includes: communication allowance determination means for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition.
- a packet relay unitcomprises: flow storage means for storing a flow which is information associating a process for a received packet with information identifying the packet; and packet relay means for relaying the received packet based on the flow stored in the flow storage means, wherein the packet relay means transmits information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage means, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination
- a relay control methodcomprises: a relay control unit for controlling a packet relay unit determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and the relay control unit setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition.
- a packet relay methodcomprises: relaying a received packet based on a flow stored in flow storage means for storing the flow which is information associating a process for the received packet with information identifying the packet; and transmitting information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage means, and relaying the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not
- a relay control programis a relay control program applied to a computer for controlling a packet relay unit, the relay control program causing the computer to execute: a communication allowance determination process of determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and a rule setting process of setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition in the communication allowance determination process.
- a packet relay programis a packet relay program applied to a computer that includes flow storage means for storing a flow which is information associating a process for a received packet with information identifying the packet, the packet relay program causing the computer to execute a packet relay process of relaying the received packet based on the flow stored in the flow storage means, wherein in the packet relay process, the computer is caused to transmit information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage means, and process the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit
- a load of processing performed by a packet relay unit on a packet for which communication to a destination unit is not allowedcan be reduced.
- FIG. 1is a block diagram showing an example of a relay control system in a first exemplary embodiment.
- FIG. 2is an explanatory diagram showing an example of policies for a Deny packet.
- FIG. 3is a flowchart showing an example of processing in the case of receiving information of a packet.
- FIG. 4is a flowchart showing an example of processing performed by a Deny control unit 17 .
- FIG. 5is a flowchart showing an example of processing caused by updating of a policy.
- FIG. 6is a block diagram showing an example of a relay control system in a second exemplary embodiment.
- FIG. 7is a flowchart showing an example of processing in the case of receiving information of a packet.
- FIG. 8is a block diagram showing an example of a relay control system in a third exemplary embodiment.
- FIG. 9is a flowchart showing an example of processing performed by a Deny control unit 17 b.
- FIG. 10is a block diagram showing an example of a relay control system in a fourth exemplary embodiment.
- FIG. 11is an explanatory diagram showing an example where communication is performed from a source to a destination.
- FIG. 12is an explanatory diagram showing an example where communication is performed from a source to a destination.
- FIG. 13is a flowchart showing an example of processing in the case of receiving information of a packet.
- FIG. 14is a flowchart showing an example of processing performed by an Allow control unit 16 c.
- FIG. 15is a block diagram showing an example of a relay control system in a fifth exemplary embodiment.
- FIG. 16is a flowchart showing an example of processing in the case of receiving a message requesting an action of a flow.
- FIG. 17is a block diagram showing an example of a minimum structure of a relay control unit according to the present invention.
- FIG. 18is a block diagram showing an example of a minimum structure of a relay control system according to the present invention.
- FIG. 19is a block diagram showing an example of a minimum structure of a packet relay unit according to the present invention.
- FIG. 20is an explanatory diagram showing flow entries stored in a flow table.
- FIG. 21is an explanatory diagram showing fields against which a packet header is checked.
- FIG. 22is an explanatory diagram showing actions set for a flow.
- FIG. 23is an explanatory diagram showing messages used on a secure channel.
- OFSOpen Flow Switch
- OFFCOpen Flow Controller
- a network architecture to which the present invention is appliedis not limited to OpenFlow.
- the present inventionis applicable to any other form of network architecture in which a relay control unit controls a packet relay unit.
- FIG. 1is a block diagram showing an example of a relay control system in a first exemplary embodiment of the present invention.
- the relay control system in this exemplary embodimentincludes an OFC 10 and an OFS 30 .
- the OFC 10is a controller that has network topology information and valid communication path information, and controls the OFS 30 in a communication network.
- the OFC 10controls processing performed by the OFS 30 upon receiving a packet.
- the OFS 30is a switch that forwards the received packet based on a set rule, under control of the OFC 10 .
- the OFC 10 and the OFS 30are connected to each other via the communication network, where a form of the communication network is not particularly limited. Though only one OFS 30 is shown in the relay control system in FIG. 1 , the number of OFSs 30 is not limited to one, and may be two or more.
- the OFC 10may have a cluster structure composed of a plurality of computers which collectively achieve functions of the OFC 10 .
- the OFS 30includes a network interface unit 31 , a storage unit 32 , and a control unit 33 .
- the network interface unit 31communicates with the OFC 10 or another switch (not shown).
- the storage unit 32stores a process (hereafter also referred to as “switch action”) for a received packet, in association with information identifying the packet.
- the switch actionincludes a process such as forwarding the received packet to a designated port, discarding (also referred to as “Drop”) the packet, transmitting the packet to the OFC 10 , or the like.
- the storage unit 32may store, for example, a protocol number, a Src (Source) IP address, a Src port, a Dst (Destination) IP address, and a Dst port included in a set of information called 5-tuple. Note, however, that the information identifying the packet is not limited to 5-tuple.
- the storage unit 32may store an input port, a VLAN (Virtual LAN) ID, an Ethertype, a Src MAC address, and a Dst MAC address included in a set of information called 10-tuple, as the information identifying the packet. Moreover, the storage unit 32 may store a VLAN priority included in a set of information called 11-tuple, as the information identifying the packet. Furthermore, the storage unit 32 may store a wildcard indicating arbitrary information, as the information identifying the packet. The storage unit 32 stores at least one pair of identification information and a switch action in association with each other. This identification information is information for determining the switch action, and accordingly is hereafter also referred to as “rule”.
- the storage unit 32can be regarded as a storage unit for storing the flow.
- the storage unit 32is realized by a magnetic disk unit or the like included in the OFS 30 .
- the flow in the storage unit 32is stored by the control unit 33 according to an instruction from the OFC 10 .
- the control unit 33processes the received packet, based on the flow stored in the storage unit 32 .
- the control unit 33compares header information of the packet with the rule in the flow, and executes the switch action of the rule corresponding to the header information. For instance, the control unit 33 may execute the switch action corresponding to the rule, in the case where the header information of the packet matches the identification information indicated by the rule.
- the control unit 33may determine whether or not information identifying the received packet matches the information indicated by the rule.
- the control unit 33may compare an IP address included in the received packet with the prefix to determine whether or not they match.
- the control unit 33transmits information of the received packet to the OFC 10 . Subsequently, upon receiving a flow corresponding to the transmitted information of the packet from the OFC 10 , the control unit 33 stores the received flow in the storage unit 32 , and also executes a switch action indicated by the received flow.
- OpenFlowa packet not corresponding to any flow stored in the storage unit 32 as mentioned above is also referred to as “first packet”.
- the control unit 33may notify the OFC 10 of information (e.g. a Hello message) indicating the connection.
- the control unit 33may also receive identification information and a switch action (i.e. a flow) transmitted together from the OFC 10 , and store these information in the storage unit 32 .
- the control unit 33is realized by a CPU of a computer operating according to a program.
- the programmay be stored in the storage unit 32 in the OFS 30 , with the CPU reading the program and operating as the control unit 33 according to the program.
- the OFC 10includes an OF protocol (hereafter referred to as “OFP”) reception unit 11 , a policy table 12 , a static policy acquisition unit 13 , a dynamic policy acquisition unit 14 , a policy determination unit 15 , an Allow control unit 16 , a Deny control unit 17 , a path computation unit 18 , a Deny log creation unit 19 , an OFS control unit 20 , and an OFP transmission unit 21 .
- OFPOF protocol
- the OFP reception unit 11receives a message based on the OFP, from the OFS 30 .
- the OFP reception unit 11receives a packet having no corresponding flow in the storage unit 32 in the OFS 30 .
- the policy table 12stores information (hereafter referred to as “policy”) that associates information (hereafter referred to as “match condition”) identifying a transmitted packet with communicability information (hereafter simply referred to as “action”) indicating whether to allow or not to allow communication to a destination unit for a packet that meets the match condition.
- policy table 12is realized by a magnetic disk unit or the like included in the OFC 10 .
- the match conditionmay be the same as a rule used by a controller to identify a packet in OpenFlow.
- the same information (i.e. 5 -tuple or 10 -tuple) as the identification information (rule) stored in the storage unit 32may be used as the match condition.
- the policy table 12may store the policy beforehand, or store the policy according to an instruction from another unit or a user.
- the actionis information indicating whether the packet is a packet for which communication to the destination unit is allowed (Allow) or a packet for which communication to the destination unit is not allowed (Deny).
- the actionmay include additional information indicating a process performed for the packet for which communication to the destination unit is not allowed (Deny).
- the policy table 12stores the additional information in association with the action of each individual match condition.
- the additional informationincludes information such as disposing a Deny packet (drop), keeping a log (logging), setting a path to an external specific unit, or the like.
- the process for the packet for which communication to the destination unit is not allowed (Deny)is hereafter also referred to as “Deny process”.
- the Deny processis a process for a packet that is not forwarded, and therefore can be regarded as a process for suppressing forwarding of the packet to the destination unit. Note that, in the case where there is only one type of Deny process, the policy table 12 does not need to store the additional information.
- FIG. 2is an explanatory diagram showing an example of policies for the packet for which communication to the destination unit is not allowed (Deny).
- FIG. 2( a )is an explanatory diagram showing an example where Deny is set in a last policy of set policies. In the example shown in FIG. 2( a ), the packet is compared with the policies in the order in which the policies are set, and determined as Deny in the case where the packet does not match any of the policies preceding “All Deny”.
- FIG. 2( b )is an explanatory diagram showing an example of policies in the case of determining, based on information set in a payload of the packet, whether or not the packet is a Deny packet.
- IP 192.168.0.1 ⁇ Denyshown as an example in FIG. 2( b ) indicates that access from an IP address “192.168.0.1” is not allowed (determined as Deny).
- IP 192.168.0.0/0.0.7.255 ⁇ Deny” shown as an example in FIG. 2( b )indicates that access from an IP address other than “192.168.0.0/255.255.248.0” is not allowed (determined as Deny).
- the information used as the identification information of the policyis not limited to an IP address.
- An ID identifying a terminalsuch as a MAC (Media Access Control) address, may be used as the identification information of the policy.
- information of a field identifying a protocol or an applicationsuch as a protocol number or a port number, may be used as the identification information of the policy.
- a value identifying a networksuch as a VLAN ID or a MPLS (Multi-Protocol Label Switching) label, may be used as the identification information of the policy.
- an input port of a switchmay be used as the identification information of the policy.
- An example of such a policyis “Deny a packet from Porti of switch A”.
- the policymay also include both the information set in the payload and the input port of the switch.
- An example of such a policyis “Deny access from IP 192.168.0.1 of Porti of switch A”.
- the static policy acquisition unit 13acquires a policy stored in the policy table 12 .
- the static policy acquisition unit 13determines whether or not an updated policy is included in the policies stored in the policy table 12 , and reads the updated policy.
- the static policy acquisition unit 13may access the policy table 12 on a regular basis, determine information different from previous access as an updated policy, and read the updated policy.
- the method of determining the updated policyis not limited to the above-mentioned method.
- the policy table 12may create a trigger at a timing of updating a policy and notify the static policy acquisition unit 13 of the trigger, where receiving the trigger causes the static policy acquisition unit 13 to determine that the policy is updated. Further, initialization of the policy table 12 may cause the static policy acquisition unit 13 to determine that all policies in the policy table 12 are updated.
- receiving the informatione.g. a Hello message
- the static policy acquisition unit 13may cause the static policy acquisition unit 13 to determine whether or not the policy table 12 is updated. Having read the updated policy, the static policy acquisition unit 13 notifies the policy determination unit 15 of the policy.
- the OFS 30receives the identification information and the action stored in the policy table 12 , regardless of the received packet.
- Such transmitted/received identification information and actioncan therefore be called a static policy.
- the static policy acquisition unit 13can be regarded as detecting the update of the static policy and acquiring the flow (i.e. match condition) and the action.
- the dynamic policy acquisition unit 14acquires a policy corresponding to the received information of the packet, from the policy table 12 .
- the dynamic policy acquisition unit 14compares the received information of the packet with each match condition stored in the policy table 12 , and reads, from the policy table 12 , an action corresponding to a match condition met by the received information of the packet. For example, in the case where the OFP reception unit 11 receives the information of the packet and the “Packet-in” message based on the OFP from the OFS 30 , the dynamic policy acquisition unit 14 reads, on condition that the received information of the packet meets the match condition, the action corresponding to the match condition from the policy table 12 .
- the “Packet-in” message mentioned hereis a message used on a Secure Channel in OpenFlow, indicating that the packet input in the switch is notified to the controller.
- the dynamic policy acquisition unit 14notifies the policy determination unit 15 of the read action and the information of the packet.
- the OFC 10may include any one or both of the static policy acquisition unit 13 and the dynamic policy acquisition unit 14 .
- the policy determination unit 15determines, using the information of the packet received by the OFS 30 , whether to allow or not to allow communication to the destination unit for the packet, based on the policy. In detail, upon receiving the action read by the dynamic policy acquisition unit 14 and the information of the packet received from the OFS 30 , the policy determination unit 15 determines whether or not the action is an action of allowing communication to the destination unit. In the case of an action of allowing (Allow) communication to the destination unit, the policy determination unit 15 determines to allow communication to the destination unit, and instructs the below-mentioned Allow control unit 16 to compute a forwarding destination of the packet. In the case of an action of not allowing (Deny) communication to the destination unit, the policy determination unit 15 determines not to allow communication to the destination unit, and instructs the below-mentioned Deny control unit 17 to determine a Deny process of the packet.
- the policy determination unit 15may also determine whether to allow or not to allow communication to the destination unit for the packet indicated by the match condition of the updated policy, based on the policy. In detail, upon receiving the updated policy from the static policy acquisition unit 13 , the policy determination unit 15 determines whether or not the action included in the policy is an action of allowing communication to the destination unit. In the case of an action of allowing (Allow) communication to the destination unit, the policy determination unit 15 determines to allow communication to the destination unit for the packet indicated by the match condition of the policy, and instructs the below-mentioned Allow control unit 16 to compute a forwarding destination of the packet.
- the policy determination unit 15determines not to allow communication to the destination unit for the packet indicated by the match condition of the policy, and instructs the below-mentioned Deny control unit 17 to determine a Deny process of the packet.
- the Allow control unit 16computes the transmission path of the packet, in the case where the action of the policy is “Allow”. In detail, the Allow control unit 16 instructs the path computation unit 18 to compute the transmission path to the destination. The Allow control unit 16 notifies the OFS control unit 20 of the computed transmission path.
- the Deny control unit 17determines the Deny process, in the case where the action of the policy is “Deny”. That is, the Deny control unit 17 determines the Deny process for the packet for which communication to the destination unit is determined not to be allowed. In detail, when the policy determination unit 15 determines that the action of the policy is an action of not allowing (Deny) communication to the destination unit, the Deny control unit 17 determines a process for the packet for which communication to the destination unit is determined not to be allowed, based on the additional information included in the action. The Deny control unit 17 notifies the OFS control unit 20 of the determined process.
- the Deny control unit 17may determine that the OFS 30 is to discard (Drop) the received packet, in the case where “Drop” is set as the additional information in the action.
- the OFC 10 settingin the OFS 30 , a rule of a process (Drop process) of discarding a specific packet in such a way, a CPU load in the case where the OFS 30 subsequently receives the same packet can be reduced. That is, in the case where the Drop process rule is set in the OFS 30 , the OFS 30 can perform the Drop process in a hardware part of the OFS 30 , without querying the OFC 10 as to the process of the received packet. This contributes to a reduced CPU load of the OFS 30 and the OFC 10 .
- the Deny control unit 17may determine to set, in the OFS 30 , an explicit path to another destination (e.g. an external specific unit) different from the destination unit for the received packet, in the case where information indicating “forwarding to a specific unit” is set as the additional information in the action.
- the Deny control unit 17determines that the OFS 30 is to transmit the packet to another destination such as a quarantine network, a honeypot, and a detailed flow behavior analysis unit.
- the Deny control unit 17instructs the path computation unit 18 to compute transmission paths to the plurality of such security analysis units.
- the Deny control unit 17may determine to transmit the packet to one of the plurality of units, or determine to transmit the packet to the plurality of units.
- the destination to which the Deny control unit 17 determines to transmit the packetis defined beforehand according to the match condition. In the case where the number of destinations is one, the same destination is specified in all match conditions.
- the OFC 10cannot explicitly set the path or adaptively set the path, in the OFS 30 .
- the OFC 10can set, in the OFS 30 , the explicit path or the adaptive path for the packet for which communication to the destination unit is not allowed.
- a more detailed Deny processcan be provided from an external unit.
- the Deny control unit 17may also determine that, when the OFS 30 receives the packet which is determined to be discarded or the packet for which the explicit path is determined to be set, the OFS 30 is to transmit the information of the packet to the OFC 10 again.
- the Deny control unit 17may determine to cause the OFS 30 to discard (Drop) the received packet and also determine to cause the OFS 30 to transmit (Packet-in) the information of the packet to the OFC 10 , in the case where a setting (logging setting) of keeping a log is made in the additional information.
- the Deny control unit 17may set the explicit path of the received packet in the OFS 30 and also determine to cause the OFS 30 to transmit (Packet-in) the information of the packet to the OFC 10 .
- the OFC 10can recognize the contents of the packet. Besides, the below-mentioned Deny log creation unit 19 can create log information based on the received information of the packet.
- the Deny control unit 17determines the Deny process based on the additional information included in the action corresponding to the identification information.
- the method of determining the Deny process by the Deny control unit 17is not limited to the method based on the identification information.
- the Deny control unit 17may determine a predetermined process as the Deny process.
- the packet for which communication to the destination unit is not allowedmight be discarded after a predetermined time elapses, as a result exhibiting the same behavior as the Drop process in the Deny process.
- a process other than Dropsuch as a process whereby the OFS 30 forwards the packet to a specific unit or a process whereby the OFC 10 keeps a log.
- the Deny control unit 17determines the Deny process based on the policy. This enables the OFC 10 to set, in the OFS 30 , a switch action of suppressing forwarding of the packet for which communication to the destination unit is not allowed (i.e. a process for suppressing forwarding to the destination unit).
- the path computation unit 18computes a path when transmitting the packet to the destination in the payload or the unit indicated by the policy. For example, the path computation unit 18 computes information sequentially indicating each OFS 30 and its output port via which the packet arrives at the destination in the payload or the specific unit indicated by the policy.
- the path computation unit 18may compute the path to the destination unit, based on a shortest path algorithm.
- the path computation methodis not limited to the method based on the shortest path algorithm. Since the method of computing the path to the destination unit is widely known, its description is omitted here.
- the path computation unit 18may compute a plurality of path candidates, instead of only one path candidate.
- a pathcan be regarded as sequentially indicating each unit (e.g. switch) and its output port via which a flow arrives at its destination. Take, for example, a path where the received packet is first transmitted from “output port 1 ” of switch A to switch B, then transmitted from “output port 3 ” of switch B to switch C, and further output from “output port 4 ” of switch C. Such a path can be expressed as “switch A, output port 1 ⁇ switch B, output port 3 ⁇ switch C, output port 4 ”.
- the Deny log creation unit 19creates a log (hereafter referred to as “Deny log”) when performing the Deny process.
- the Deny logcan be regarded as a log indicating determination that communication to the destination unit is not allowed.
- the Deny control unit 17determines to cause the OFS 30 to transmit the information of the packet discarded or the information of the packet for which the explicit path is set, to the OFC 10 again.
- the Deny log creation unit 19may create the Deny log, upon receiving such packet information from the OFS 30 .
- the Deny log creation unit 19may create the Deny log as “2009/08/11 12:00:01 Deny TCP SRC: 192.168.1.3: 49388 DST: xxx.xxx.xxx.xxx: 80”.
- This example of the Deny logmeans “a packet transmitted from a unit whose source IP address is “192.168.1.3 (port number 49388)” to a destination whose IP address is “xxx.xxx.xxx.xxx (port number 80)” is Deny-processed at 12:00:01 on Aug. 11, 2009”. Note that, in the case where the OFC 10 does not output a log, the OFC 10 does not need to include the Deny log creation unit 19 .
- the Deny logincludes a date or a part (e.g. an IP address and the like) of the payload information of the packet.
- the information included in the Deny logis not limited to the above.
- the Deny logmay include other information in the payload information of the packet.
- the log output from the Deny log creation unit 19is not limited to the Deny log.
- the output logmay include a log (hereafter referred to as “Allow log”) indicating that communication to the destination unit is allowed (Allow).
- the Deny log creation unit 19may create the Allow log as “2009/08/11 12:00:01 Allow TCP SRC: 192.168.1.3: 49388 DST: xxx.xxx.xxx.xxx: 80”.
- the OFS control unit 20sets a process rule that is executed by the OFS 30 , based on the transmission path of the packet computed by the Allow control unit 16 or the Deny process determined by the Deny control unit 17 . That is, upon receiving the Deny process determined by the Deny control unit 17 , the OFS control unit 20 sets a rule of executing the Deny process, in the OFS 30 receiving the packet.
- the OFS control unit 20may determine the OFS 30 transmitting the information of the packet to the OFC 10 , as the setting target switch. Note that the switch in which the OFS control unit 20 sets the process rule is not limited to the OFS 30 receiving the packet.
- the OFS control unit 20Upon receiving the transmission path of the packet computed by the Allow control unit 16 , the OFS control unit 20 sets a rule of forwarding the packet on the transmission path, in the OFS 30 .
- the OFS control unit 20receives a notification of the transmission path of the packet computed by the Allow control unit 16 or the Deny process determined by the Deny control unit 17 .
- the OFS control unit 20creates a flow that associates the information of the payload of the packet as the identification information with the transmission path of the packet as the action.
- the OFS control unit 20creates a flow that associates the information of the payload of the packet as the identification information with the Deny process as the action.
- the OFS control unit 20then creates a message for updating the storage unit 32 of the OFS 30 with information of the created flow, and instructs the OFP transmission unit 21 to transmit the message to the OFS 30 .
- the OFS control unit 20sets the Deny process in the following cases.
- the OFS control unit 20performs a setting of updating the output port of the packet for a flow stored in one OFS 30 or a plurality of OFSs 30 , according to the paths.
- the OFS control unit 20performs a setting of discarding the packet for a flow in the OFS 30 (also referred to as “ingress”) transmitting the packet.
- the Deny control unit 17determines to cause the OFS 30 to transmit the packet which is determined to be Dropped or the packet for which the explicit path is determined to be set, to the OFC 10 again.
- the OFS control unit 20sets a virtual port “Controller” and also performs a setting of transmitting (Packet-in) the packet, for a flow in the OFS 30 (i.e. ingress) transmitting the packet.
- a “Flow Mod message”is used in the case where the controller requests the switch to register, change, or delete a flow on the Secure Channel in OpenFlow. Accordingly, the OFS control unit 20 may set a flow in the OFS 30 , by using the Flow Mod message.
- the OFP transmission unit 21transmits a message based on the OFP, to the OFS 30 .
- the OFP transmission unit 21transmits a message created by the OFS control unit 20 based on the OFP, to the OFS 30 .
- the OFP reception unit 11 , the static policy acquisition unit 13 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , the Allow control unit 16 , the Deny control unit 17 , the path computation unit 18 , the Deny log creation unit 19 , and the OFS control unit 20are realized by a CPU of a computer operating according to a program (relay control program).
- the programmay be stored in a storage unit (not shown) in the OFC 10 , with the CPU reading the program and, according to the program, operating as the OFP reception unit 11 , the static policy acquisition unit 13 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , the Allow control unit 16 , the Deny control unit 17 , the path computation unit 18 , the Deny log creation unit 19 , and the OFS control unit 20 .
- the OFP reception unit 11 , the static policy acquisition unit 13 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , the Allow control unit 16 , the Deny control unit 17 , the path computation unit 18 , the Deny log creation unit 19 , and the OFS control unit 20may also be each realized by dedicated hardware.
- the followingdescribes an operation. The following first describes processing in the case where the OFC 10 receives information of a packet from the OFS 30 , and then describes processing caused by updating of a policy stored in the policy table 12 .
- FIG. 3is a flowchart showing an example of processing in the case where the OFC 10 receives information of a packet from the OFS 30 .
- the control unit 33 in the OFS 30transmits a message including information of the received packet to the OFC 10 , via the network interface unit 31 .
- the dynamic policy acquisition unit 14acquires an action that matches a Packet-in header in the OpenFlow message, from the policy table 12 (step S 120 ). That is, the dynamic policy acquisition unit 14 compares the received information of the packet with each match condition stored in the policy table 12 , and reads an action corresponding to a match condition met by the received information of the packet, from the policy table 12 .
- the policy determination unit 15determines whether or not the action read by the dynamic policy acquisition unit 14 is an action of “not allowing (Deny) communication to the destination unit” (step S 130 ). In the case where the action is Deny (step S 130 : “YES”), the policy determination unit 15 instructs the Deny control unit 17 to determine a Deny process of the packet (step S 140 ).
- FIG. 4is a flowchart showing an example of processing performed by the Deny control unit 17 .
- the Deny control unit 17determines the process, based on additional information included in the action (step S 141 ). In the case where the additional information indicates “Drop” (step S 141 : “Drop”), the Deny control unit 17 sets a Drop flag (step S 142 ). In detail, the Deny control unit 17 stores the setting of the Drop flag, in a memory (not shown) or the like in the OFC 10 . In the case where the additional information indicates to forward the packet to a specific host (i.e. forward to a specific unit) (step S 141 : “to specific host”), on the other hand, the Deny control unit 17 instructs the path computation unit 18 to compute a transmission path of the packet to the specific host (step S 143 ).
- the Deny control unit 17also determines whether or not the logging setting is made in the additional information (step S 144 ). In the case where the logging setting is made (step S 144 : “YES”), the Deny control unit 17 sets a Packet-in flag (step S 145 ). In detail, the Deny control unit 17 stores the setting of the Packet-in flag, in a memory (not shown) or the like in the OFC 10 . Following this, the Deny log creation unit 19 creates a Deny log (Deny logging) (step S 146 ). In the case where the logging setting is not made (step S 144 : “NO”), the Deny control unit 17 does not perform the Deny log creation process.
- step S 130the policy determination unit 15 instructs the Allow control unit 16 to compute a forwarding destination of the packet (step S 150 ).
- the Allow control unit 16instructs the path computation unit 18 to compute a path of the packet. The Allow control unit 16 thus acquires the path.
- the OFS control unit 20After the process by the Deny control unit 17 (step S 140 ) or the path computation process by the Allow control unit 16 (step S 150 ), the OFS control unit 20 creates a message based on the OFP, using the transmission path, the Drop flag, or the Packet-in flag (step S 160 ). In detail, the OFS control unit 20 creates a message for updating a flow stored in the storage unit 32 in the OFS 30 , based on the transmission path of the packet computed by the Allow control unit 16 or the Deny process determined by the Deny control unit 17 , as well as the Drop flag or the Packet-in flag. The OFP transmission unit 21 transmits the message created by the OFS control unit 20 based on the OFP, to the OFS 30 (step S 170 ).
- the reception of the information of the packet from the OFS 30causes the flow to be determined (that is, the OFS 10 creates the entry to be stored in the storage unit 32 in the OFS 30 , after actually receiving the packet), which produces an advantageous effect of reducing the number of flow entries stored in the storage unit 32 .
- FIG. 5is a flowchart showing an example of this processing.
- the static policy acquisition unit 13Upon receiving information indicating that the OFS 30 is connected to the communication network or detecting an update in the policy table 12 , the static policy acquisition unit 13 reads an updated policy from the policy table 12 . Moreover, upon detecting initialization of the policy table 12 , the static policy acquisition unit 13 reads all policies in the policy table 12 (step S 210 ). Having read the updated policy, the static policy acquisition unit 13 notifies the policy determination unit 15 of the policy.
- the policy determination unit 15determines whether or not an action included in the policy received from the static policy acquisition unit 13 is an action of “not allowing (Deny) communication to the destination unit” (step S 220 ). In the case where the action is not Deny (step S 220 : “NO”), the policy determination unit 15 ends the processing. In the case where the action is Deny (step S 220 : “YES”), on the other hand, the policy determination unit 15 instructs the Deny control unit 17 to determine a Deny process of the packet (step S 230 ).
- Steps S 230 to S 250Subsequent processing from when the Deny control unit 17 determines the Deny process to when the OFP transmission unit 21 transmits a message created by the OFS control unit 20 based on the OFP to the OFS 30 (steps S 230 to S 250 ) is the same as the processing of steps S 140 and S 160 to S 170 shown as an example in FIG. 3 , and so its description is omitted.
- the updating of the policy stored in the policy table 12causes the flow to be determined (that is, the OFC 10 creates the entry to be stored in the storage unit 32 in the OFS 30 , when the policy is updated), which produces an advantageous effect of reducing a load because the OFC 10 can reduce access from the OFS 30 .
- the policy determination unit 15determines, using information of a packet received by the OFS 30 , whether to allow or not to allow communication to a destination unit for the packet that meets a match condition, based on a policy. On condition that the policy determination unit 15 determines not to allow (Deny) communication to the destination unit for the packet that meets the match condition, the Deny control unit 17 determines a process for suppressing forwarding of the packet to the destination unit, and the OFS control unit 20 sets, at least in the OFS 30 receiving the packet, a process rule of executing the process. This contributes to a reduced load of processing performed by a packet relay unit (e.g. the OFS 30 ) on a packet for which communication to a destination unit is not allowed (Deny).
- a packet relay unite.g. the OFS 30
- the Deny control unit 17 and the OFS control unit 20set a process rule for discarding (Drop) the packet that meets the match condition, in the OFS 30 . This contributes to a reduced CPU load of the OFS 30 and the OFC 10 .
- the Deny control unit 17 and the OFS control unit 20set a process rule (e.g. a path to another destination) for transmitting the packet that meets the match condition to another destination different from the destination unit, in the OFS 30 .
- a process rulee.g. a path to another destination
- the Deny control unit 17 and the OFS control unit 20set a rule for transmitting, when the OFS 30 receives the Deny packet, the information of the packet to the OFC 10 , in the OFS 30 .
- the Deny log creation unit 19creates a log. This enables a communication status of the Deny packet to be recognized.
- FIG. 6is a block diagram showing an example of a relay control system in a second exemplary embodiment of the present invention.
- the same structures as the first exemplary embodimentare given the same reference signs as in FIG. 1 , and their description is omitted.
- the relay control system in this exemplary embodimentincludes an OFC 10 a and the OFS 30 .
- the OFS 30is the same as that in the first exemplary embodiment.
- the OFC 10 aincludes the OFP reception unit 11 , the policy table 12 , the static policy acquisition unit 13 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , the Allow control unit 16 , the Deny control unit 17 , the path computation unit 18 , the Deny log creation unit 19 , an OFS control unit 20 a , and the OFP transmission unit 21 .
- the OFC 10 aincludes a flow management table 22 . That is, the OFC 10 a differs from the OFC 10 in the first exemplary embodiment in that the OFS control unit 20 a is included instead of the OFS control unit 20 , and also the flow management table 22 is included.
- the other structuresare the same as the first exemplary embodiment.
- the flow management table 22stores an action (hereafter referred to as “OF action”) of a flow created by the OFS control unit 20 . That is, the flow management table 22 stores a rule set in the OFS 30 .
- the flow management table 22is realized by a magnetic disk unit or the like included in the OFC 10 a .
- the flow management table 22may store the OF action and information (hereafter referred to as “switch identification information”) identifying the OFS 30 as the flow update target, in association with each other.
- the OFS control unit 20 astores the created OF action in the flow management table 22 . Having newly creating the OF action, the OFS control unit 20 a determines whether or not the same OF action is already stored in the flow management table 22 . In the case where the same OF action is already stored, the OFS control unit 20 a discards the created OF action so that no message is transmitted from the OFP transmission unit 21 . That is, in the case where a rule to be set in the OFS 30 is already stored in the flow management table 22 , the OFS control unit 20 a does not set the rule in the OFS 30 . In the case where the created OF action is different from the stored OF action, the OFS control unit 20 a updates the flow management table 22 with the created OF action. Functions of the OFS control unit 20 a other than the above-mentioned function are the same as those of the OFS control unit 20 in the first exemplary embodiment.
- the OFS control unit 20 ais realized by a CPU of a computer operating according to a program (relay control program).
- the OFS control unit 20 amay also be realized by dedicated hardware.
- FIG. 7is a flowchart showing an example of processing in the case where the OFC 10 a receives information of a packet from the OFS 30 in the second exemplary embodiment. Processing from when the OFC 10 a receives the information of the packet from the OFS 30 to when the OFS control unit 20 a creates a message based on the OFP is the same as the processing of steps S 110 to S 160 shown as an example in FIG. 3 .
- the OFS control unit 20 adetermines whether or not the same OF action is stored in the flow management table 22 (step S 310 ). In the case where the same OF action is already stored in the flow management table 22 (step S 310 : “YES”), the OFS control unit 20 a discards the created message (step S 320 ), and ends the processing. In the case where the same OF action is not stored in the flow management table 22 (step S 310 : “NO”), the OFS control unit 20 a stores the created OF action in the flow management table 22 (step S 330 ). Following this, the OFP transmission unit 21 transmits the message created by the OFS control unit 20 a based on the OFP, to the OFS 30 (step S 170 ).
- the OFS control unit 20 awhen the OFS control unit 20 a sets a process rule in the OFS 30 , the OFS control unit 20 a also stores the process rule in the flow management table 22 . Subsequently, when the policy determination unit 15 determines not to allow (Deny) communication to a destination unit for a packet that meets a match condition, in the case where a process rule to be set in the OFS 30 is already stored in the flow management table 22 , the OFS control unit 20 a does not set the process rule in the OFS 30 . In this way, a resetting instruction for an already set process rule can be prevented, which contributes to a reduced CPU load of the OFS 30 and the OFC 10 a.
- the OFC 10 adoes not receive the Deny packet from the OFS 30 again. If Packet-in is set for the Deny packet, however, the packet for which communication is not allowed (Deny) will end up being transmitted to the OFC 10 a again. In this exemplary embodiment, even when the Deny packet is transmitted to the OFC 10 a again, the OFS control unit 20 a suppresses the already set flow updating. This contributes to a reduced processing load on the OFC 10 a and the OFS 30 .
- the OFC 10 acan be prevented from writing the already written flow action to the storage unit 32 in the OFS 30 a plurality of times.
- FIG. 8is a block diagram showing an example of a relay control system in a third exemplary embodiment of the present invention.
- the same structures as the first exemplary embodimentare given the same reference signs as in FIG. 1 , and their description is omitted.
- the relay control system in this exemplary embodimentincludes an OFC 10 b and the OFS 30 .
- the OFS 30is the same as that in the first exemplary embodiment.
- the OFC 10 bincludes the OFP reception unit 11 , the policy table 12 , the static policy acquisition unit 13 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , the Allow control unit 16 , a Deny control unit 17 b , the path computation unit 18 , the Deny log creation unit 19 , the OFS control unit 20 , and the OFP transmission unit 21 .
- the OFC 10 bincludes a Deny counter table 23 . That is, the OFC 10 b differs from the OFC 10 in the first exemplary embodiment in that the Deny control unit 17 b is included instead of the Deny control unit 17 , and also the Deny counter table 23 is included.
- the other structuresare the same as the first exemplary embodiment.
- the Deny counter table 23stores the number (also referred to as “counter value”) of determinations for a packet for which the Deny control unit 17 b determines not to allow communication to a destination unit, in association with identification information (e.g. match condition) of the packet.
- This identification informationis hereafter also referred to as “field”.
- the counter valuecan be regarded as a count of the number of Packet-in processes.
- the Deny counter table 23may store the number of Deny processes and the same information as identification information used in a match condition of a policy, in association with each other. Alternatively, the Deny counter table 23 may store the number of Deny processes and information included in a payload such as a packet source, in association with each other.
- the Deny counter table 23may store one counter value that is shared between a plurality of flows (match conditions).
- the Deny counter table 23is realized by a magnetic disk unit or the like included in the OFC 10 b.
- the Deny control unit 17 bincreases, in the case where an action of a policy is “Deny” (i.e. it is determined not to allow communication to the destination unit), a counter value in the Deny counter table 23 corresponding to a match condition of the policy. In the case where the counter value exceeds a predetermined threshold (hereafter referred to as “Deny process count threshold”), the Deny control unit 17 b determines that a process (i.e. Packet-in process) of transmitting information of a packet to the OFC 10 b is not to be performed for a flow that meets the match condition corresponding to the counter value.
- a processi.e. Packet-in process
- the Deny control unit 17 bdetermines to cause the OFS 30 to perform only the Drop process or the specific path selection for the specific flow. In so doing, for example in the case where an attack process is carried out on the OFC 10 b , a Packet-in frequency can be decreased, which contributes to a reduced processing load on the OFS 30 and the OFC 10 b.
- the Deny control unit 17 bis realized by a CPU of a computer operating according to a program (relay control program).
- the Deny control unit 17 bmay also be realized by dedicated hardware.
- processing from when the OFC 10 b receives information of a packet from the OFS 30 to when the OFP transmission unit 21 transmits a message to the OFS 30is the same as the processing in the flowchart shown as an example in FIG. 3 , but processing performed by the Deny control unit 17 b is different from the processing performed by the Deny control unit 17 in the first exemplary embodiment.
- An operation performed by the Deny control unit 17 bis described below.
- FIG. 9is a flowchart showing an example of processing performed by the Deny control unit 17 b .
- An operation up to when the Deny control unit 17 b determines the process based on the additional information included in the actionis the same as the operation of steps S 141 to S 143 in FIG. 4 .
- the Deny control unit 17 bdetermines whether or not the logging setting is made in the additional information (step S 144 ). In the case where the logging setting is not made (step 144 : “NO”), the Deny control unit 17 b does not perform the Deny log creation process. In the case where the logging setting is made (step S 144 : “YES”), the Deny control unit 17 b determines whether or not a field matching the flow is stored in the Deny counter table 23 (step S 410 ). In the case where the field matching the flow is stored (step S 410 : “YES”), the Deny control unit 17 b increases a counter value corresponding to the field (step S 420 ).
- the Deny control unit 17 badds 1 to the counter value of the field matching the flow.
- the Deny control unit 17 bcreates a match condition (field) of the flow, and initializes a counter value to 0 (step S 430 ).
- the Deny control unit 17 bdetermines whether or not the counter value is equal to or more than the threshold (Deny process count threshold) (step S 440 ).
- step S 440the Deny control unit 17 b instructs the Deny log creation unit 19 to output information indicating that log output is suppressed (step S 450 ).
- the Deny control unit 17 binstructs the OFS control unit 20 to create a message, with Packet-in being deleted from the action of the policy.
- the Deny control unit 17 bsets the Packet-in flag and performs Deny logging, as in steps S 145 to S 146 shown as an example in FIG. 3 .
- step S 440 in FIG. 9the Deny control unit 17 b determines whether or not the counter value is equal to or more than the threshold (Deny process count threshold).
- the Deny control unit 17 bmay instead determine whether or not the counter value exceeds the threshold (Deny process count threshold).
- the Deny control unit 17 b and the OFS control unit 20increase the number of determinations for a packet stored in the Deny counter table 23 in association with an element identifying the packet.
- the Deny control unit 17 b and the OFS control unit 20set a process rule for suppressing transmission of information of the packet to the OFC 10 b , in the OFS 30 .
- a situation where information of a packet for which communication is not allowedis notified to the OFC 10 b an excessive number of times can be prevented.
- FIG. 10is a block diagram showing an example of a relay control system in a fourth exemplary embodiment of the present invention.
- the same structures as the first exemplary embodimentare given the same reference signs as in FIG. 1 , and their description is omitted.
- the relay control system in this exemplary embodimentincludes an OFC 10 c and the OFS 30 .
- the OFS 30is the same as that in the first exemplary embodiment.
- the first exemplary embodimentdescribes the case where the OFS control unit 20 sets a process rule of executing a Deny process in the OFS 30 (i.e. ingress) receiving packet information
- this exemplary embodimentdescribes the case where the Deny setting is made on an OFS 30 other than the ingress.
- the OFC 10 cincludes the OFP reception unit 11 , the policy table 12 , the static policy acquisition unit 13 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , an Allow control unit 16 c , the Deny control unit 17 , the path computation unit 18 , the Deny log creation unit 19 , the OFS control unit 20 , and the OFP transmission unit 21 . That is, the OFC 10 c differs from the OFC 10 in the first exemplary embodiment in that the Allow control unit 16 c is included instead of the Allow control unit 16 .
- the other structuresare the same as the first exemplary embodiment.
- the Allow control unit 16 ccomputes, in the case where an action of a policy is “Allow” (i.e., it is determined to allow communication to the destination unit), one or more path candidates to a destination unit of a packet.
- the Allow control unit 16 cinstructs the path computation unit 18 to compute a plurality of transmission paths to the destination unit.
- the Allow control unit 16 cdetermines, for each computed path, whether or not a switch (hereafter referred to as “Deny switch”) that determines not to allow (Deny) communication of the received packet exists on the path.
- the Allow control unit 16 cmay query each switch on the path whether to allow or not to allow communication of the packet and, based on a response result, determine whether or not the Deny switch exists.
- the Allow control unit 16 cdetermines to perform the Deny process. In detail, the Allow control unit 16 c instructs the Deny control unit 17 to determine the Deny process of the packet. In the case where the transmission path candidates include a path on which the communication of the packet is allowed, the Allow control unit 16 c determines not to perform the Deny process, and notifies the OFS control unit 20 of the path.
- the Allow control unit 16 cmay determine to set the Deny process in the Deny switch. In this case, the Allow control unit 16 c may instruct the Deny control unit 17 to determine the Deny process for the switch on the path, with the OFS control unit 20 instructing the switch on the path to update the flow based on the determined Deny process.
- FIGS. 11 and 12are explanatory diagrams showing an example where communication is performed from a source (Nancy) to a destination (Paul).
- a range enclosed with dashed linesis a communication network to which the source (Nancy) and the destination (Paul) are connected.
- SW 1 to SW 4denote switches (e.g. the OFS 30 ), and
- CT 1denotes a controller (e.g. the OFC 10 c ).
- each switch shown by hatchingis a switch not allowing communication from the source (Nancy) to the destination (Paul), whereas each switch shown by a white circle is a switch allowing communication from the source (Nancy) to the destination (Paul).
- a switch to which the source (Nancy) is connecteddetermines not to allow communication to the destination (Paul). Accordingly, the policy determination unit 15 instructs the Deny control unit 17 to determine the Deny process of the packet.
- a switch to which the source (Nancy) is connecteddetermines to allow communication to the destination (Paul). Accordingly, the policy determination unit 15 instructs the Allow control unit 16 c to compute the forwarding destination of the packet.
- the Allow control unit 16 cinstructs the path computation unit 18 to compute a plurality of transmission paths to the destination. In the example shown in FIG. 12 , three paths to the destination, namely, a path (path 1 ) via SW 1 , SW 2 , and SW 4 , a path (path 2 ) via SW 1 , SW 3 , and SW 4 , and a path (path 3 ) via SW 1 and SW 4 , are computed.
- the Allow control unit 16 cfirst determines whether or not the Deny switch exists on path 1 .
- SW 2that determines not to allow communication exists on path 1 .
- the Allow control unit 16 cdetermines whether or not the Deny switch exists on the next path candidate (path 2 ). No Deny switch exists on path 2 .
- the Allow control unit 16 cnotifies the OFS control unit 20 of path 2 .
- the Allow control unit 16 cmay also determine to set the Deny process in SW 2 on path 1 .
- the Allow control unit 16 cinstructs the Deny control unit 17 to determine the Deny process for SW 2 .
- the OFS control unit 20instructs SW 2 to update the flow, based on the determined Deny process.
- the Deny processcan be set beforehand in the switch on the path. Therefore, in the case where a communication unit is connected to a switch in which the Deny process is already set, there is no need to query the OFC 10 c again. This contributes to a reduced load on the OFC 10 c and the OFS 30 for query.
- the Allow control unit 16 cis realized by a CPU of a computer operating according to a program (relay control program).
- the Allow control unit 16 cmay also be realized by dedicated hardware.
- FIG. 13is a flowchart showing an example of the case where the OFC 10 c receives information of a packet from the OFS 30 .
- processing in the case where the OFC 10 c receives the information of the packet from the OFS 30 and the policy determination unit 15 determines the action as Denyis the same as the processing of steps 5110 to S 140 and S 160 to S 170 shown as an example in FIG. 3 .
- Processing (step S 510 ) performed by the Allow control unit 16 c in the case where the policy determination unit 15 determines the action as an action of “allowing (Allow) communication to the destination unit” (step S 130 in FIG. 13 : “NO”)is described below.
- FIG. 14is a flowchart showing an example of the processing performed by the Allow control unit 16 c .
- the Allow control unit 16 cinstructs the path computation unit 18 to compute a path candidate (step S 511 ).
- the Allow control unit 16 cperforms determination on each computed path candidate in sequence, starting from the first path candidate (step S 512 ). Note that the order of determination is not particularly limited.
- the Allow control unit 16 cdetermines whether or not the Deny switch exists on the path of the candidate (step S 513 ). In the case where the Deny switch exists (step S 513 : “YES”), the Allow control unit 16 c determines to perform a Deny process on the switch (step S 515 ).
- the Allow control unit 16 cdetermines whether or not there is another path candidate (step S 516 ). In the case where there is another path candidate (step S 516 : “YES”), the Allow control unit 16 c repeats the processing of steps S 513 and S 515 to S 518 for each succeeding candidate (step S 518 ). In the case where there is no other path candidate (step S 516 : “NO”), the Allow control unit 16 c determines to perform the Deny process (step S 517 ).
- step S 513In the case where no Deny switch exists on the path of the candidate in step S 513 (step S 513 : “NO”), the Allow control unit 16 c notifies the OFS control unit 20 of the path (step S 514 ).
- step S 520having determined to perform the Deny process (step S 520 : “YES”), the Allow control unit 16 c instructs the Deny control unit 17 to determine the Deny process. Subsequent processing is the same as the processing of steps S 140 and S 160 to S 170 shown as an example in FIG. 3 .
- the Allow control unit 16 cupon detecting the path having no Deny switch, notifies the OFS control unit 20 of the path, without performing determination on the path of each succeeding candidate. However, even when detecting the path having no Deny switch, the Allow control unit 16 c may determine, for each of the remaining path candidates, whether or not the Deny switch exists on the path, and notify the OFS control unit 20 of a subsequently detected path.
- the path computation unit 18computes one or more path candidates to the destination unit of the packet.
- the Allow control unit 16 cdetermines whether or not an OFS 30 that determines not to allow communication of the packet exists on the path candidate.
- the Deny control unit 17 and the OFS control unit 20set a process rule of executing a process (Deny process) for suppressing forwarding of the packet to the destination unit, at least in the OFS 30 receiving the packet.
- the Deny control unit 17sets a process rule of executing a process (Deny process) for suppressing forwarding of the packet to the destination unit, in the OFS 30 .
- the process rule of executing the Deny processcan be set not only in the switch (i.e. ingress) transmitting the packet to the controller, but also in the switch on the path candidate. This contributes to a reduced load on the communication network.
- FIG. 15is a block diagram showing an example of a relay control system in a fifth exemplary embodiment of the present invention.
- the same structures as the second exemplary embodimentare given the same reference signs as in FIG. 6 , and their description is omitted.
- the relay control system in this exemplary embodimentincludes an OFC 10 d and the OFS 30 .
- the OFS 30is the same as that in the first exemplary embodiment.
- the OFC 10 dincludes the OFP reception unit 11 , the policy table 12 , the dynamic policy acquisition unit 14 , the policy determination unit 15 , the Allow control unit 16 , the Deny control unit 17 , the path computation unit 18 , the Deny log creation unit 19 , an OFS control unit 20 d , the OFP transmission unit 21 , and the flow management table 22 . That is, the OFC 10 d differs from the OFC 10 a in the second exemplary embodiment in that the static policy acquisition unit 13 is not included, and also the OFS control unit 20 d is included instead of the OFS control unit 20 a .
- the other structuresare the same as the second exemplary embodiment.
- the OFS control unit 20 dinstructs to update a flow stored in the OFS 30 , based on an OF action (i.e. an action of a flow created by the OFS control unit 20 a ) stored in the flow management table 22 . That is, the OFS control unit 20 d sets the OF action stored in the flow management table 22 , in the OFS 30 . For example, when the OFS 30 is connected, the OFS control unit 20 d reads an OF action corresponding to switch identification information indicating the connected OFS 30 , from the flow management table 22 .
- an OF actioni.e. an action of a flow created by the OFS control unit 20 a
- the OFS control unit 20 dsets the OF action stored in the flow management table 22 , in the OFS 30 . For example, when the OFS 30 is connected, the OFS control unit 20 d reads an OF action corresponding to switch identification information indicating the connected OFS 30 , from the flow management table 22 .
- the OFS control unit 20 dthen creates a message for updating a flow, and instructs the OFP transmission unit 21 to transmit the message to the OFS 30 .
- the OFS control unit 20 dmay read all OF actions stored in the flow management table 22 , regardless of the switch identification information.
- the OFS control unit 20 dmay perform the above-mentioned processing in the case where the OFC 10 d receives, from the OFS 30 , a message requesting an action of a flow.
- the OFS control unit 20 dis realized by a CPU of a computer operating according to a program (relay control program).
- the OFS control unit 20 dmay also be realized by dedicated hardware.
- FIG. 16is a flowchart showing an example of processing in the case where the OFC 10 d receives a message requesting an action of a flow, from the OFS 30 .
- the OFP reception unit 11receives the message requesting the action of the flow from the OFS 30 (step S 610 )
- the OFS control unit 20 dreads the action (OF action) of the flow from the flow management table 22 , and creates a message based on the OFP (step S 620 ).
- the OFP transmission unit 21transmits the message created by the OFS control unit 20 d based on the OFP, to the OFS 30 (step S 630 ).
- the OFS control unit 20 dsets a flow stored in the flow management table 22 , in the packet relay unit. Therefore, even in the case where an update of the policy table 12 cannot be detected as in the second exemplary embodiment, the flow indicating the Deny process can be reflected on the OFS 30 .
- FIG. 17is a block diagram showing an example of a minimum structure of a relay control unit according to the present invention.
- the relay control unit according to the present inventionis a relay control unit (e.g. the OFC 10 ) for controlling a packet relay unit (e.g. the OFS 30 ), the relay control unit comprising: communication allowance determination means 81 (e.g. the policy determination unit 15 ) for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g.
- communication allowance determination means 81e.g. the policy determination unit 15
- rule setting means 82e.g. the Deny control unit 17 and the OFS control unit 20 ) for setting, at least in the packet relay unit receiving the packet, a rule (e.g. flow) of executing a process (e.g. Deny process) for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means 81 determines not to allow (e.g. Deny) the communication to the destination unit for the packet that meets the match condition.
- a load of processing performed by the packet relay unit for a packet for which communication to a destination unit is not allowedcan be reduced.
- a packet relay unit 90may be provided to a relay control unit 80 according to the present invention to thereby form a relay control system.
- FIG. 19is a block diagram showing an example of a minimum structure of a packet relay unit according to the present invention.
- the packet relay unit according to the present inventioncomprises: flow storage means 71 (e.g. the storage unit 32 ) for storing a flow which is information associating a process for a received packet with information identifying the packet; and packet relay means 72 (e.g. the control unit 33 ) for relaying the received packet based on the flow stored in the flow storage means 71 .
- flow storage means 71e.g. the storage unit 32
- packet relay means 72e.g. the control unit 33
- the packet relay means 72transmits information of the packet to a relay control unit (e.g. the OFC 10 ) in the case where the flow associated with the received packet is not stored in the flow storage means 71 , and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g.
- a relay control unite.g. the OFC 10
- Deny communication to a destination unit for the packet that meets the match conditionthe match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process (e.g. Deny process) for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed (e.g. Deny) for the packet.
- a processe.g. Deny process
- a load of processing performed by the packet relay unit for a packet for which communication to a destination unit is not allowedcan be reduced.
- relay control unitrelay system
- packet relay unitare also included in any of the exemplary embodiments described above.
- a relay control unitfor controlling a packet relay unit (e.g. the OFS 30 ), the relay control unit comprising: communication allowance determination means (e.g. the policy determination unit 15 ) for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g. Deny) communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means (e.g.
- the Deny control unit 17 and the OFS control unit 20for setting, at least in the packet relay unit receiving the packet, a rule (e.g. flow) of executing a process (e.g. Deny process) for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow (e.g. Deny) the communication to the destination unit for the packet that meets the match condition.
- a rulee.g. flow
- a processe.g. Deny process
- the relay control unit wherein the rule setting meanse.g. the Deny control unit 17 and the OFS control unit 20 ) sets, at least in the packet relay unit receiving the packet, a rule for discarding (e.g. Drop) the packet that meets the match condition.
- a rule for discardinge.g. Drop
- the relay control unitwherein the rule setting means (e.g. the Deny control unit 17 and the OFS control unit 20 ) sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination (e.g. a quarantine network, a honeypot, a detailed flow behavior analysis unit, and so on) different from the destination unit.
- the rule setting meanse.g. the Deny control unit 17 and the OFS control unit 20 .
- the relay control unitcomprising path computation means (e.g. the path computation unit 18 ) for computing a path to a predetermined destination according to the match condition, wherein the rule setting means sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to the destination computed by the path computation means.
- path computation meanse.g. the path computation unit 18
- the rule setting meanssets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to the destination computed by the path computation means.
- the relay control unitcomprising log creation means (e.g. the Deny log creation unit 19 ) for creating a log (e.g. Deny log) indicating that the communication allowance determination means (e.g. the policy determination unit 15 ) determines not to allow the communication to the destination unit, wherein the rule setting means sets, in the packet relay unit, a rule for transmitting the information of the packet to the relay control unit, when the packet relay unit receives the packet for which the process (e.g. Deny process) for suppressing the forwarding to the destination unit is executed, and wherein the log creation means creates the log, when receiving the information of the packet from the packet relay unit.
- log creation meanse.g. the Deny log creation unit 19
- the communication allowance determination meanse.g. the policy determination unit 15
- the rule setting meanssets, in the packet relay unit, a rule for transmitting the information of the packet to the relay control unit, when the packet relay unit receives the packet for which the process (e.g. Deny process) for suppressing the forwarding to
- the relay control unitcomprising rule storage means (e.g. the flow management table 22 ) for storing the rule set in the packet relay unit, wherein the rule setting means (e.g. the Deny control unit 17 and the OFS control unit 20 a ): stores the rule into the rule storage means, when setting the rule in the packet relay unit; and, in the case where the rule to be set in the packet relay unit is already stored in the rule storage means when the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition, does not set the rule in the packet relay unit.
- rule storage meanse.g. the flow management table 22
- the rule setting meanse.g. the Deny control unit 17 and the OFS control unit 20 a
- the relay control unitcomprising determination count storage means (e.g. the Deny counter table 23 ) for storing the number (e.g. counter value) of determinations for the packet for which the communication allowance determination means (e.g. the policy determination unit 15 ) determines not to allow the communication to the destination unit, in association with an element identifying the packet, wherein the rule setting means (e.g.
- the Deny control unit 17 b and the OFS control unit 20increases the number of determinations for the packet associated with the element, when the communication allowance determination means determines not to allow the communication to the destination unit; and sets, in the packet relay unit, a rule for suppressing transmission of the information of the packet to the relay control unit, in the case where the number of determinations for the packet exceeds a predetermined threshold (e.g. Deny process count threshold).
- a predetermined thresholde.g. Deny process count threshold
- the relay control unitcomprising: path candidate computation means (e.g. the path computation unit 18 ) for computing one or more path candidates to the destination unit of the packet, on condition that the communication allowance determination means (e.g. the policy determination unit 15 ) determines to allow (e.g. Allow) the communication to the destination unit for the packet that meets the match condition; and path determination means (e.g. the Allow control unit 16 c ) for determining, for each of the path candidates, whether or not a packet relay unit determining not to allow the communication of the packet exists on the path candidate, wherein, in the case where the packet relay unit determining not to allow the communication of the packet exists on each path of all of the path candidates, the rule setting means (e.g. the Deny control unit 17 and the OFS control unit 20 ) sets, at least in the packet relay unit receiving the packet, the rule of executing the process (e.g. Deny process) for suppressing the forwarding of the packet to the destination unit.
- the communication allowance determination meanse.g. the policy determination unit 15
- the relay control unitwherein, in the case where the packet relay unit (e.g. switch) that does not allow the communication of the packet that meets the match condition exists on the path, the rule setting means (e.g. the Deny control unit 17 and the OFS control unit 20 ) sets, in the packet relay unit, the rule of executing the process (i.e. Deny process) for suppressing the forwarding of the packet to the destination unit.
- the packet relay unite.g. switch
- the rule setting meanse.g. the Deny control unit 17 and the OFS control unit 20
- the relay control unit wherein the rule setting meanse.g. the OFS control unit 20 d
- sets the rulee.g. flow action
- the rule storage meanse.g. the flow management table 22
- a relay control systemcomprising: a packet relay unit (e.g. the OFS 30 ); and a relay control unit (the OFC 10 ) for controlling the packet relay unit, wherein the relay control unit includes: communication allowance determination means (e.g. the policy determination unit 15 ) for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g.
- communication allowance determination meanse.g. the policy determination unit 15
- communicability informatione.g. action
- Deny communication to a destination unit for the packet that meets the match conditionthe match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition
- rule setting meanse.g. the Deny control unit 17 and the OFS control unit 20
- rule setting meansfor setting, at least in the packet relay unit receiving the packet, a rule (e.g. flow) of executing a process (e.g. Deny process) for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow (e.g. Deny) the communication to the destination unit for the packet that meets the match condition.
- the relay control systemwherein the rule setting means sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit.
- a packet relay unitcomprising: flow storage means (e.g. the storage unit 32 ) for storing a flow which is information associating a process for a received packet with information identifying the packet; and packet relay means (e.g. the control unit 33 ) for relaying the received packet based on the flow stored in the flow storage means, wherein the packet relay means transmits information of the packet to a relay control unit (e.g. the OFC 10 ) in the case where the flow associated with the received packet is not stored in the flow storage means, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information (e.g.
- the present inventionis preferably applied to a relay control unit for controlling processing performed by a packet relay unit.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Business, Economics & Management (AREA)
- General Business, Economics & Management (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
- The present invention relates to a relay control unit, a relay control system, and a relay control program for controlling processing performed by a packet relay unit, and a packet relay unit, a packet relay method, and a packet relay program applied to the relay control system.
- Various network architectures in which a controller performs centralized management of operations of switches for forwarding packets are known. For example, NPL 1 and NPL 2 each describe a network architecture according to Ethane. Ethane is a network architecture including a controller that determines behaviors of packets transmitted and switches that are under control of the controller and forward packets.
- Each switch includes a flow table for determining destinations of packets. Upon receiving a packet whose destination is indicated by an entry in the flow table, the switch transmits the packet based on the entry. Upon receiving a packet having no corresponding entry in the flow table, on the other hand, the switch forwards information of the packet to the controller. The controller has information about a communication network topology, and performs path computation for a packet for which communication is allowed. In detail, upon receiving the information of the packet from the switch, the controller determines whether to allow or not to allow communication of the packet. In the case of determining to allow the communication, the controller computes a path of the packet. The controller then adds a new destination entry to a flow table of each switch on the computed path. The switch subsequently transmits the packet based on the registered destination entry.
- NPL 3 describes a network architecture according to OpenFlow (hereafter also referred to as “OF”). Like Ethane, OpenFlow is a network architecture in which a controller controls switches. In OpenFlow, a packet forwarding function and a path control function are separated by a flow control protocol, where the controller controls different types of switches using a uniform API (Application Program Interface). Besides, in OpenFlow, packet control in flow granularity is performed for faster datapath and lower control cost.
- Each switch in OF includes a flow table for storing actions for received packets, and a secure channel through which the switch communicates with the controller. The switch and the controller communicate with each other on the secure channel, using an OF protocol.
FIG. 20 is an explanatory diagram showing flow entries stored in a flow table. The flow table stores, for each flow, a rule (Rule) against which a packet header is checked, an action (Action) defining a process for the flow, and flow statistic information (Statistics).- In the rule (Rule), a value (exact) for determining whether or not there is a match and a wildcard (wild card) are used.
FIG. 21 is an explanatory diagram showing fields against which the packet header is checked. The following fields are used as search keys against which the packet header is checked. - (1) Input port number (Input Port No) of a Physical (physical) layer
- (2) MAC (Media Access Control) DA (MAC destination address), MAC SA (MAC source address), VLAN ID (Virtual LAN (Local Area Network) ID), or VLAN TYPE (priority) of an Ethernet (registered trademark) (Ethernet (registered trademark)) layer
- (3) IP SA (IP source address), IP DA (IP destination address), or IP protocol of an IPv4 (version4) layer
- (4) Source Port (TCP/UDP source port) and/or Destination Port (TCP/UDP destination port) of a TCP (Transmission Control Protocol)/UDP (User Datagram Protocol) layer
- (5) ICMP Type or ICMP Code of an ICMP (Internet Control Message Protocol) layer
- The action (Action) is a process applied to a packet that matches the rule.
FIG. 22 is an explanatory diagram showing actions set for a flow. For example, in the case where “OUTPUT” is set in the action, it means that the switch performs “output to designated port” on the packet that matches the rule. Likewise, in the case where “SET_DL_DST” is set in the action, it means that the switch performs “update MAC DA (destination unit)” to which the packet that matches the rule is transmitted. - The flow statistic information includes the number of packets and the number of bytes of packets that match the rule, an elapsed time (session duration) from reception of a last one of the packets, and the like. The flow statistic information is used for determining whether or not to delete the flow entry.
- The following describes an operation in OF. Upon receiving a packet, the switch compares a packet header of the received packet with the rule in the flow table. In the case where the received packet does not match the rule, the switch forwards information of the packet to the controller, using a message in the secure channel. The controller computes a transmission path of the packet, based on a communication network topology. The controller then transmits a message for adding a flow entry to the flow table of the switch, to enable the switch to relay the packet along the transmission path. Subsequently, upon receiving a packet corresponding to the added flow entry, the switch performs a corresponding action (forwarding process), without forwarding information of the packet to the controller.
FIG. 23 is an explanatory diagram showing messages used on the secure channel. For example, the switch transmits a message “Packet in” to the controller, in the case of notifying the controller of an input packet. Likewise, the switch transmits a message “Flow Expired” to the controller, in the case of notifying the controller of expiration of a flow (session duration reaching a predetermined time). On the other hand, the controller transmits a message “Packet Out” to the switch, in the case of instructing the switch to output a packet. Likewise, the controller transmits a message “Flow Mod” to the switch, in the case of requesting the switch to register, change, or delete a flow.- NPL 1: Martin Casado, and five others, “Ethane: Taking Control of the Enterprise”, ACM SIGCOMM Computer Communication Review, Volume 37, Issue 4, SESSION: Enterprise networks, Pages: 1 to 12, October 2007
- NPL 2: Martin Casado, and five others, “Architectural Support for Security Management in Enterprise Networks”,
Slide 11, [online], [search on Aug. 24, 2009], Internet <URL: http://www.soi.wide.ad.jp/project/sigcomm2007/pdf/sig11.pdf> - NPL 3: Nick McKeown, and seven others, “OpenFlow: Enabling Innovation in Campus Networks”, [online], [search on Aug. 24, 2009], Internet <URL:
http://www.openflowswitch.org/documents/openflow-wp- latest.pdf> - In the network architecture based on Ethane described in
NPL 1 and NPL 2, for a packet which has no corresponding entry in the flow table and for which the controller does not allow communication, no path computation is typically performed and therefore no forwarding is performed. In many occasions, such a packet is accumulated in a queue of the switch, and discarded after a predetermined time elapses. - In the case where the switch receives again the packet for which the controller does not allow communication, the switch normally queries the controller again, and the controller determines again whether to allow or not to allow communication for the packet. That is, in the case where the switch repeatedly receives a packet for which communication is not allowed, the switch needs to query the controller each time, and also the controller needs to determine each time whether to allow or not to allow communication. This causes a problem of a high processing load on both the switch and the controller.
- For example, when retransmission is repeatedly performed in TCP communication because a packet does not arrive at a destination unit, the switch will end up repeatedly receiving the same packet. In this case, each time the packet arrives at the switch, the switch queries the controller. This causes a problem of an increase in CPU load of both the switch and the controller.
- In OpenFlow described in NPL 3, too, when the switch repeatedly transmits, to the controller, a packet for which communication to a destination unit is not allowed, a problem of a high processing load on both the switch and the controller arises. Hence, it is desirable that the controller controls the switch so that such a packet can be processed appropriately.
- In view of this, an exemplary object of the present invention is to provide a relay control unit, a relay control system, and a relay control program that can reduce a load of processing performed by a packet relay unit on a packet for which communication to a destination unit is not allowed, and a packet relay unit, a packet relay method, and a packet relay program that are applied to the relay control system.
- A relay control unit according to the present invention is a relay control unit for controlling a packet relay unit, the relay control unit comprising: communication allowance determination means for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition.
- A relay control system according to the present invention comprises: a packet relay unit; and a relay control unit for controlling the packet relay unit, wherein the relay control unit includes: communication allowance determination means for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition.
- A packet relay unit according to the present invention comprises: flow storage means for storing a flow which is information associating a process for a received packet with information identifying the packet; and packet relay means for relaying the received packet based on the flow stored in the flow storage means, wherein the packet relay means transmits information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage means, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.
- A relay control method according to the present invention comprises: a relay control unit for controlling a packet relay unit determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and the relay control unit setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition.
- A packet relay method according to the present invention comprises: relaying a received packet based on a flow stored in flow storage means for storing the flow which is information associating a process for the received packet with information identifying the packet; and transmitting information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage means, and relaying the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.
- A relay control program according to the present invention is a relay control program applied to a computer for controlling a packet relay unit, the relay control program causing the computer to execute: a communication allowance determination process of determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and a rule setting process of setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition in the communication allowance determination process.
- A packet relay program according to the present invention is a packet relay program applied to a computer that includes flow storage means for storing a flow which is information associating a process for a received packet with information identifying the packet, the packet relay program causing the computer to execute a packet relay process of relaying the received packet based on the flow stored in the flow storage means, wherein in the packet relay process, the computer is caused to transmit information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage means, and process the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.
- According to the present invention, a load of processing performed by a packet relay unit on a packet for which communication to a destination unit is not allowed can be reduced.
FIG. 1 is a block diagram showing an example of a relay control system in a first exemplary embodiment.FIG. 2 is an explanatory diagram showing an example of policies for a Deny packet.FIG. 3 is a flowchart showing an example of processing in the case of receiving information of a packet.FIG. 4 is a flowchart showing an example of processing performed by a Denycontrol unit 17.FIG. 5 is a flowchart showing an example of processing caused by updating of a policy.FIG. 6 is a block diagram showing an example of a relay control system in a second exemplary embodiment.FIG. 7 is a flowchart showing an example of processing in the case of receiving information of a packet.FIG. 8 is a block diagram showing an example of a relay control system in a third exemplary embodiment.FIG. 9 is a flowchart showing an example of processing performed by a Denycontrol unit 17b.FIG. 10 is a block diagram showing an example of a relay control system in a fourth exemplary embodiment.FIG. 11 is an explanatory diagram showing an example where communication is performed from a source to a destination.FIG. 12 is an explanatory diagram showing an example where communication is performed from a source to a destination.FIG. 13 is a flowchart showing an example of processing in the case of receiving information of a packet.FIG. 14 is a flowchart showing an example of processing performed by an Allowcontrol unit 16c.FIG. 15 is a block diagram showing an example of a relay control system in a fifth exemplary embodiment.FIG. 16 is a flowchart showing an example of processing in the case of receiving a message requesting an action of a flow.FIG. 17 is a block diagram showing an example of a minimum structure of a relay control unit according to the present invention.FIG. 18 is a block diagram showing an example of a minimum structure of a relay control system according to the present invention.FIG. 19 is a block diagram showing an example of a minimum structure of a packet relay unit according to the present invention.FIG. 20 is an explanatory diagram showing flow entries stored in a flow table.FIG. 21 is an explanatory diagram showing fields against which a packet header is checked.FIG. 22 is an explanatory diagram showing actions set for a flow.FIG. 23 is an explanatory diagram showing messages used on a secure channel.- Exemplary embodiments of the present invention are described below, with reference to drawings. The following describes the case where the present invention is applied to OpenFlow. That is, the following describes the case where the present invention is applied to OpenFlow including an OF switch (Open Flow Switch, hereafter referred to as “OFS”) which is a packet relay unit and an OF controller (Open Flow Controller, hereafter referred to as “OFC”) which is a unit (i.e. a relay control unit) for controlling the packet relay unit. Note, however, that a network architecture to which the present invention is applied is not limited to OpenFlow. The present invention is applicable to any other form of network architecture in which a relay control unit controls a packet relay unit.
FIG. 1 is a block diagram showing an example of a relay control system in a first exemplary embodiment of the present invention. The relay control system in this exemplary embodiment includes anOFC 10 and anOFS 30. TheOFC 10 is a controller that has network topology information and valid communication path information, and controls theOFS 30 in a communication network. In detail, theOFC 10 controls processing performed by theOFS 30 upon receiving a packet. TheOFS 30 is a switch that forwards the received packet based on a set rule, under control of theOFC 10. TheOFC 10 and theOFS 30 are connected to each other via the communication network, where a form of the communication network is not particularly limited. Though only oneOFS 30 is shown in the relay control system inFIG. 1 , the number ofOFSs 30 is not limited to one, and may be two or more. Moreover, theOFC 10 may have a cluster structure composed of a plurality of computers which collectively achieve functions of theOFC 10.- The
OFS 30 includes anetwork interface unit 31, astorage unit 32, and acontrol unit 33. Thenetwork interface unit 31 communicates with theOFC 10 or another switch (not shown). - The
storage unit 32 stores a process (hereafter also referred to as “switch action”) for a received packet, in association with information identifying the packet. The switch action includes a process such as forwarding the received packet to a designated port, discarding (also referred to as “Drop”) the packet, transmitting the packet to theOFC 10, or the like. As the information identifying the packet, thestorage unit 32 may store, for example, a protocol number, a Src (Source) IP address, a Src port, a Dst (Destination) IP address, and a Dst port included in a set of information called 5-tuple. Note, however, that the information identifying the packet is not limited to 5-tuple. Thestorage unit 32 may store an input port, a VLAN (Virtual LAN) ID, an Ethertype, a Src MAC address, and a Dst MAC address included in a set of information called 10-tuple, as the information identifying the packet. Moreover, thestorage unit 32 may store a VLAN priority included in a set of information called 11-tuple, as the information identifying the packet. Furthermore, thestorage unit 32 may store a wildcard indicating arbitrary information, as the information identifying the packet. Thestorage unit 32 stores at least one pair of identification information and a switch action in association with each other. This identification information is information for determining the switch action, and accordingly is hereafter also referred to as “rule”. In addition, information associating the rule with the switch action is also collectively referred to as “flow”. Hence, thestorage unit 32 can be regarded as a storage unit for storing the flow. For example, thestorage unit 32 is realized by a magnetic disk unit or the like included in theOFS 30. The flow in thestorage unit 32 is stored by thecontrol unit 33 according to an instruction from theOFC 10. - The
control unit 33 processes the received packet, based on the flow stored in thestorage unit 32. In detail, upon receiving the packet from another unit, thecontrol unit 33 compares header information of the packet with the rule in the flow, and executes the switch action of the rule corresponding to the header information. For instance, thecontrol unit 33 may execute the switch action corresponding to the rule, in the case where the header information of the packet matches the identification information indicated by the rule. Note that, in the case where thestorage unit 32 stores, as the rule, an input port and a value of an arbitrary bit field in a payload, thecontrol unit 33 may determine whether or not information identifying the received packet matches the information indicated by the rule. Moreover, in the case where thestorage unit 32 stores a prefix of an IP address as the rule, thecontrol unit 33 may compare an IP address included in the received packet with the prefix to determine whether or not they match. - In the case where no flow corresponding to the received packet is stored in the
storage unit 32, thecontrol unit 33 transmits information of the received packet to theOFC 10. Subsequently, upon receiving a flow corresponding to the transmitted information of the packet from theOFC 10, thecontrol unit 33 stores the received flow in thestorage unit 32, and also executes a switch action indicated by the received flow. In OpenFlow, a packet not corresponding to any flow stored in thestorage unit 32 as mentioned above is also referred to as “first packet”. - Moreover, when the
OFS 30 is connected to the communication network to which theOFC 10 is connected, thecontrol unit 33 may notify theOFC 10 of information (e.g. a Hello message) indicating the connection. Thecontrol unit 33 may also receive identification information and a switch action (i.e. a flow) transmitted together from theOFC 10, and store these information in thestorage unit 32. - The
control unit 33 is realized by a CPU of a computer operating according to a program. For example, the program may be stored in thestorage unit 32 in theOFS 30, with the CPU reading the program and operating as thecontrol unit 33 according to the program. - The
OFC 10 includes an OF protocol (hereafter referred to as “OFP”)reception unit 11, a policy table12, a staticpolicy acquisition unit 13, a dynamicpolicy acquisition unit 14, apolicy determination unit 15, an Allowcontrol unit 16, a Denycontrol unit 17, apath computation unit 18, a Denylog creation unit 19, anOFS control unit 20, and anOFP transmission unit 21. - The
OFP reception unit 11 receives a message based on the OFP, from theOFS 30. In detail, theOFP reception unit 11 receives a packet having no corresponding flow in thestorage unit 32 in theOFS 30. - The policy table12 stores information (hereafter referred to as “policy”) that associates information (hereafter referred to as “match condition”) identifying a transmitted packet with communicability information (hereafter simply referred to as “action”) indicating whether to allow or not to allow communication to a destination unit for a packet that meets the match condition. For example, the policy table12 is realized by a magnetic disk unit or the like included in the
OFC 10. The match condition may be the same as a rule used by a controller to identify a packet in OpenFlow. Moreover, for example, the same information (i.e.5-tuple or10-tuple) as the identification information (rule) stored in thestorage unit 32 may be used as the match condition. The policy table12 may store the policy beforehand, or store the policy according to an instruction from another unit or a user. - As mentioned above, the action is information indicating whether the packet is a packet for which communication to the destination unit is allowed (Allow) or a packet for which communication to the destination unit is not allowed (Deny). The action may include additional information indicating a process performed for the packet for which communication to the destination unit is not allowed (Deny). In this case, the policy table12 stores the additional information in association with the action of each individual match condition. The additional information includes information such as disposing a Deny packet (drop), keeping a log (logging), setting a path to an external specific unit, or the like. The process for the packet for which communication to the destination unit is not allowed (Deny) is hereafter also referred to as “Deny process”. The Deny process is a process for a packet that is not forwarded, and therefore can be regarded as a process for suppressing forwarding of the packet to the destination unit. Note that, in the case where there is only one type of Deny process, the policy table12 does not need to store the additional information.
FIG. 2 is an explanatory diagram showing an example of policies for the packet for which communication to the destination unit is not allowed (Deny).FIG. 2( a) is an explanatory diagram showing an example where Deny is set in a last policy of set policies. In the example shown inFIG. 2( a), the packet is compared with the policies in the order in which the policies are set, and determined as Deny in the case where the packet does not match any of the policies preceding “All Deny”.FIG. 2( b) is an explanatory diagram showing an example of policies in the case of determining, based on information set in a payload of the packet, whether or not the packet is a Deny packet. “IP 192.168.0.1→Deny” shown as an example inFIG. 2( b) indicates that access from an IP address “192.168.0.1” is not allowed (determined as Deny). Meanwhile, “IP 192.168.0.0/0.0.7.255→Deny” shown as an example inFIG. 2( b) indicates that access from an IP address other than “192.168.0.0/255.255.248.0” is not allowed (determined as Deny).- Though the policy that uses an IP address as the identification information is shown as an example in
FIG. 2 , the information used as the identification information of the policy is not limited to an IP address. An ID identifying a terminal, such as a MAC (Media Access Control) address, may be used as the identification information of the policy. Moreover, information of a field identifying a protocol or an application, such as a protocol number or a port number, may be used as the identification information of the policy. Furthermore, a value identifying a network, such as a VLAN ID or a MPLS (Multi-Protocol Label Switching) label, may be used as the identification information of the policy. - Alternatively, an input port of a switch may be used as the identification information of the policy. An example of such a policy is “Deny a packet from Porti of switch A”. The policy may also include both the information set in the payload and the input port of the switch. An example of such a policy is “Deny access from IP 192.168.0.1 of Porti of switch A”.
- The static
policy acquisition unit 13 acquires a policy stored in the policy table12. In detail, the staticpolicy acquisition unit 13 determines whether or not an updated policy is included in the policies stored in the policy table12, and reads the updated policy. As an example, the staticpolicy acquisition unit 13 may access the policy table12 on a regular basis, determine information different from previous access as an updated policy, and read the updated policy. The method of determining the updated policy, however, is not limited to the above-mentioned method. As another example, the policy table12 may create a trigger at a timing of updating a policy and notify the staticpolicy acquisition unit 13 of the trigger, where receiving the trigger causes the staticpolicy acquisition unit 13 to determine that the policy is updated. Further, initialization of the policy table12 may cause the staticpolicy acquisition unit 13 to determine that all policies in the policy table12 are updated. - Moreover, receiving the information (e.g. a Hello message) indicating that the
OFS 30 is connected to the communication network may cause the staticpolicy acquisition unit 13 to determine whether or not the policy table12 is updated. Having read the updated policy, the staticpolicy acquisition unit 13 notifies thepolicy determination unit 15 of the policy. - Thus, the
OFS 30 receives the identification information and the action stored in the policy table12, regardless of the received packet. Such transmitted/received identification information and action can therefore be called a static policy. Hence, the staticpolicy acquisition unit 13 can be regarded as detecting the update of the static policy and acquiring the flow (i.e. match condition) and the action. - The dynamic
policy acquisition unit 14 acquires a policy corresponding to the received information of the packet, from the policy table12. In detail, the dynamicpolicy acquisition unit 14 compares the received information of the packet with each match condition stored in the policy table12, and reads, from the policy table12, an action corresponding to a match condition met by the received information of the packet. For example, in the case where theOFP reception unit 11 receives the information of the packet and the “Packet-in” message based on the OFP from theOFS 30, the dynamicpolicy acquisition unit 14 reads, on condition that the received information of the packet meets the match condition, the action corresponding to the match condition from the policy table12. The “Packet-in” message mentioned here is a message used on a Secure Channel in OpenFlow, indicating that the packet input in the switch is notified to the controller. The dynamicpolicy acquisition unit 14 notifies thepolicy determination unit 15 of the read action and the information of the packet. - Though this exemplary embodiment describes the case where the
OFC 10 includes both the staticpolicy acquisition unit 13 and the dynamicpolicy acquisition unit 14, theOFC 10 may include any one or both of the staticpolicy acquisition unit 13 and the dynamicpolicy acquisition unit 14. - The
policy determination unit 15 determines, using the information of the packet received by theOFS 30, whether to allow or not to allow communication to the destination unit for the packet, based on the policy. In detail, upon receiving the action read by the dynamicpolicy acquisition unit 14 and the information of the packet received from theOFS 30, thepolicy determination unit 15 determines whether or not the action is an action of allowing communication to the destination unit. In the case of an action of allowing (Allow) communication to the destination unit, thepolicy determination unit 15 determines to allow communication to the destination unit, and instructs the below-mentioned Allowcontrol unit 16 to compute a forwarding destination of the packet. In the case of an action of not allowing (Deny) communication to the destination unit, thepolicy determination unit 15 determines not to allow communication to the destination unit, and instructs the below-mentioned Denycontrol unit 17 to determine a Deny process of the packet. - The
policy determination unit 15 may also determine whether to allow or not to allow communication to the destination unit for the packet indicated by the match condition of the updated policy, based on the policy. In detail, upon receiving the updated policy from the staticpolicy acquisition unit 13, thepolicy determination unit 15 determines whether or not the action included in the policy is an action of allowing communication to the destination unit. In the case of an action of allowing (Allow) communication to the destination unit, thepolicy determination unit 15 determines to allow communication to the destination unit for the packet indicated by the match condition of the policy, and instructs the below-mentioned Allowcontrol unit 16 to compute a forwarding destination of the packet. In the case of an action of not allowing (Deny) communication to the destination unit, thepolicy determination unit 15 determines not to allow communication to the destination unit for the packet indicated by the match condition of the policy, and instructs the below-mentioned Denycontrol unit 17 to determine a Deny process of the packet. - The Allow
control unit 16 computes the transmission path of the packet, in the case where the action of the policy is “Allow”. In detail, the Allowcontrol unit 16 instructs thepath computation unit 18 to compute the transmission path to the destination. The Allowcontrol unit 16 notifies theOFS control unit 20 of the computed transmission path. - The Deny
control unit 17 determines the Deny process, in the case where the action of the policy is “Deny”. That is, the Denycontrol unit 17 determines the Deny process for the packet for which communication to the destination unit is determined not to be allowed. In detail, when thepolicy determination unit 15 determines that the action of the policy is an action of not allowing (Deny) communication to the destination unit, the Denycontrol unit 17 determines a process for the packet for which communication to the destination unit is determined not to be allowed, based on the additional information included in the action. The Denycontrol unit 17 notifies theOFS control unit 20 of the determined process. - As an example, the Deny
control unit 17 may determine that theOFS 30 is to discard (Drop) the received packet, in the case where “Drop” is set as the additional information in the action. By theOFC 10 setting, in theOFS 30, a rule of a process (Drop process) of discarding a specific packet in such a way, a CPU load in the case where theOFS 30 subsequently receives the same packet can be reduced. That is, in the case where the Drop process rule is set in theOFS 30, theOFS 30 can perform the Drop process in a hardware part of theOFS 30, without querying theOFC 10 as to the process of the received packet. This contributes to a reduced CPU load of theOFS 30 and theOFC 10. - As another example, the Deny
control unit 17 may determine to set, in theOFS 30, an explicit path to another destination (e.g. an external specific unit) different from the destination unit for the received packet, in the case where information indicating “forwarding to a specific unit” is set as the additional information in the action. In detail, the Denycontrol unit 17 determines that theOFS 30 is to transmit the packet to another destination such as a quarantine network, a honeypot, and a detailed flow behavior analysis unit. In this case, the Denycontrol unit 17 instructs thepath computation unit 18 to compute transmission paths to the plurality of such security analysis units. Here, the Denycontrol unit 17 may determine to transmit the packet to one of the plurality of units, or determine to transmit the packet to the plurality of units. The destination to which the Denycontrol unit 17 determines to transmit the packet is defined beforehand according to the match condition. In the case where the number of destinations is one, the same destination is specified in all match conditions. - For instance, in the case where the policy only includes a static default ULAN setting, the
OFC 10 cannot explicitly set the path or adaptively set the path, in theOFS 30. However, since the action is determined according to the policy as described above, theOFC 10 can set, in theOFS 30, the explicit path or the adaptive path for the packet for which communication to the destination unit is not allowed. In addition, a more detailed Deny process can be provided from an external unit. - The Deny
control unit 17 may also determine that, when theOFS 30 receives the packet which is determined to be discarded or the packet for which the explicit path is determined to be set, theOFS 30 is to transmit the information of the packet to theOFC 10 again. In detail, the Denycontrol unit 17 may determine to cause theOFS 30 to discard (Drop) the received packet and also determine to cause theOFS 30 to transmit (Packet-in) the information of the packet to theOFC 10, in the case where a setting (logging setting) of keeping a log is made in the additional information. Alternatively, the Denycontrol unit 17 may set the explicit path of the received packet in theOFS 30 and also determine to cause theOFS 30 to transmit (Packet-in) the information of the packet to theOFC 10. - By causing the
OFS 30 to transmit, to theOFC 10, the information of the packet for which communication to the destination unit is not allowed in this way, theOFC 10 can recognize the contents of the packet. Besides, the below-mentioned Denylog creation unit 19 can create log information based on the received information of the packet. - The above describes the case where the Deny
control unit 17 determines the Deny process based on the additional information included in the action corresponding to the identification information. However, the method of determining the Deny process by the Denycontrol unit 17 is not limited to the method based on the identification information. For instance, the Denycontrol unit 17 may determine a predetermined process as the Deny process. - The packet for which communication to the destination unit is not allowed might be discarded after a predetermined time elapses, as a result exhibiting the same behavior as the Drop process in the Deny process. Here, if no control is exercised on such a packet, it is impossible to perform a process other than Drop, such as a process whereby the
OFS 30 forwards the packet to a specific unit or a process whereby theOFC 10 keeps a log. In this exemplary embodiment, however, when thepolicy determination unit 15 determines the action of the policy as the action of not allowing communication to the destination unit, the Denycontrol unit 17 determines the Deny process based on the policy. This enables theOFC 10 to set, in theOFS 30, a switch action of suppressing forwarding of the packet for which communication to the destination unit is not allowed (i.e. a process for suppressing forwarding to the destination unit). - The
path computation unit 18 computes a path when transmitting the packet to the destination in the payload or the unit indicated by the policy. For example, thepath computation unit 18 computes information sequentially indicating eachOFS 30 and its output port via which the packet arrives at the destination in the payload or the specific unit indicated by the policy. Thepath computation unit 18 may compute the path to the destination unit, based on a shortest path algorithm. The path computation method, however, is not limited to the method based on the shortest path algorithm. Since the method of computing the path to the destination unit is widely known, its description is omitted here. Thepath computation unit 18 may compute a plurality of path candidates, instead of only one path candidate. - Note that a path can be regarded as sequentially indicating each unit (e.g. switch) and its output port via which a flow arrives at its destination. Take, for example, a path where the received packet is first transmitted from “
output port 1” of switch A to switch B, then transmitted from “output port3” of switch B to switch C, and further output from “output port4” of switch C. Such a path can be expressed as “switch A,output port 1→switch B, output port3→switch C, output port4”. - The Deny
log creation unit 19 creates a log (hereafter referred to as “Deny log”) when performing the Deny process. Hence, the Deny log can be regarded as a log indicating determination that communication to the destination unit is not allowed. There is also the case where the Denycontrol unit 17 determines to cause theOFS 30 to transmit the information of the packet discarded or the information of the packet for which the explicit path is set, to theOFC 10 again. In this case, the Denylog creation unit 19 may create the Deny log, upon receiving such packet information from theOFS 30. - For example, the Deny
log creation unit 19 may create the Deny log as “2009/08/11 12:00:01 Deny TCP SRC: 192.168.1.3: 49388 DST: xxx.xxx.xxx.xxx: 80”. This example of the Deny log means “a packet transmitted from a unit whose source IP address is “192.168.1.3 (port number 49388)” to a destination whose IP address is “xxx.xxx.xxx.xxx (port number 80)” is Deny-processed at 12:00:01 on Aug. 11, 2009”. Note that, in the case where theOFC 10 does not output a log, theOFC 10 does not need to include the Denylog creation unit 19. - The above describes an example where the Deny log includes a date or a part (e.g. an IP address and the like) of the payload information of the packet. The information included in the Deny log, however, is not limited to the above. The Deny log may include other information in the payload information of the packet. Besides, the log output from the Deny
log creation unit 19 is not limited to the Deny log. For instance, the output log may include a log (hereafter referred to as “Allow log”) indicating that communication to the destination unit is allowed (Allow). As an example, suppose communication of a packet transmitted to a destination indicated by “xxx.xxx.xxx.xxx (port number 80)” is allowed (Allow) at 12:00:01 on Aug. 11, 2009. In this case, the Denylog creation unit 19 may create the Allow log as “2009/08/11 12:00:01 Allow TCP SRC: 192.168.1.3: 49388 DST: xxx.xxx.xxx.xxx: 80”. - The
OFS control unit 20 sets a process rule that is executed by theOFS 30, based on the transmission path of the packet computed by the Allowcontrol unit 16 or the Deny process determined by the Denycontrol unit 17. That is, upon receiving the Deny process determined by the Denycontrol unit 17, theOFS control unit 20 sets a rule of executing the Deny process, in theOFS 30 receiving the packet. Here, theOFS control unit 20 may determine theOFS 30 transmitting the information of the packet to theOFC 10, as the setting target switch. Note that the switch in which theOFS control unit 20 sets the process rule is not limited to theOFS 30 receiving the packet. Upon receiving the transmission path of the packet computed by the Allowcontrol unit 16, theOFS control unit 20 sets a rule of forwarding the packet on the transmission path, in theOFS 30. - An operation of the
OFS control unit 20 is described in detail below. First, theOFS control unit 20 receives a notification of the transmission path of the packet computed by the Allowcontrol unit 16 or the Deny process determined by the Denycontrol unit 17. In the case of receiving the transmission path of the packet computed by the Allowcontrol unit 16, theOFS control unit 20 creates a flow that associates the information of the payload of the packet as the identification information with the transmission path of the packet as the action. In the case of receiving the Deny process determined by the Denycontrol unit 17, on the other hand, theOFS control unit 20 creates a flow that associates the information of the payload of the packet as the identification information with the Deny process as the action. TheOFS control unit 20 then creates a message for updating thestorage unit 32 of theOFS 30 with information of the created flow, and instructs theOFP transmission unit 21 to transmit the message to theOFS 30. - For instance, the
OFS control unit 20 sets the Deny process in the following cases. As an example, in the case where the Denycontrol unit 17 determines to explicitly set paths to a plurality of security analysis units, theOFS control unit 20 performs a setting of updating the output port of the packet for a flow stored in oneOFS 30 or a plurality ofOFSs 30, according to the paths. As another example, in the case where the Denycontrol unit 17 determines to drop the received packet, theOFS control unit 20 performs a setting of discarding the packet for a flow in the OFS30 (also referred to as “ingress”) transmitting the packet. - There is also the case where the Deny
control unit 17 determines to cause theOFS 30 to transmit the packet which is determined to be Dropped or the packet for which the explicit path is determined to be set, to theOFC 10 again. In this case, theOFS control unit 20 sets a virtual port “Controller” and also performs a setting of transmitting (Packet-in) the packet, for a flow in the OFS30 (i.e. ingress) transmitting the packet. - A “Flow Mod message” is used in the case where the controller requests the switch to register, change, or delete a flow on the Secure Channel in OpenFlow. Accordingly, the
OFS control unit 20 may set a flow in theOFS 30, by using the Flow Mod message. - The
OFP transmission unit 21 transmits a message based on the OFP, to theOFS 30. In detail, theOFP transmission unit 21 transmits a message created by theOFS control unit 20 based on the OFP, to theOFS 30. - The
OFP reception unit 11, the staticpolicy acquisition unit 13, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, the Allowcontrol unit 16, the Denycontrol unit 17, thepath computation unit 18, the Denylog creation unit 19, and theOFS control unit 20 are realized by a CPU of a computer operating according to a program (relay control program). For example, the program may be stored in a storage unit (not shown) in theOFC 10, with the CPU reading the program and, according to the program, operating as theOFP reception unit 11, the staticpolicy acquisition unit 13, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, the Allowcontrol unit 16, the Denycontrol unit 17, thepath computation unit 18, the Denylog creation unit 19, and theOFS control unit 20. TheOFP reception unit 11, the staticpolicy acquisition unit 13, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, the Allowcontrol unit 16, the Denycontrol unit 17, thepath computation unit 18, the Denylog creation unit 19, and theOFS control unit 20 may also be each realized by dedicated hardware. - The following describes an operation. The following first describes processing in the case where the
OFC 10 receives information of a packet from theOFS 30, and then describes processing caused by updating of a policy stored in the policy table12. FIG. 3 is a flowchart showing an example of processing in the case where theOFC 10 receives information of a packet from theOFS 30. First, when theOFS 30 receives a packet having no corresponding flow in thestorage unit 32, thecontrol unit 33 in theOFS 30 transmits a message including information of the received packet to theOFC 10, via thenetwork interface unit 31.- When the
OFP reception unit 11 receives the message based on the OFP from the OFS30 (step S110), the dynamicpolicy acquisition unit 14 acquires an action that matches a Packet-in header in the OpenFlow message, from the policy table12 (step S120). That is, the dynamicpolicy acquisition unit 14 compares the received information of the packet with each match condition stored in the policy table12, and reads an action corresponding to a match condition met by the received information of the packet, from the policy table12. Thepolicy determination unit 15 determines whether or not the action read by the dynamicpolicy acquisition unit 14 is an action of “not allowing (Deny) communication to the destination unit” (step S130). In the case where the action is Deny (step S130: “YES”), thepolicy determination unit 15 instructs the Denycontrol unit 17 to determine a Deny process of the packet (step S140). FIG. 4 is a flowchart showing an example of processing performed by the Denycontrol unit 17. First, the Denycontrol unit 17 determines the process, based on additional information included in the action (step S141). In the case where the additional information indicates “Drop” (step S141: “Drop”), the Denycontrol unit 17 sets a Drop flag (step S142). In detail, the Denycontrol unit 17 stores the setting of the Drop flag, in a memory (not shown) or the like in theOFC 10. In the case where the additional information indicates to forward the packet to a specific host (i.e. forward to a specific unit) (step S141: “to specific host”), on the other hand, the Denycontrol unit 17 instructs thepath computation unit 18 to compute a transmission path of the packet to the specific host (step S143).- The Deny
control unit 17 also determines whether or not the logging setting is made in the additional information (step S144). In the case where the logging setting is made (step S144: “YES”), the Denycontrol unit 17 sets a Packet-in flag (step S145). In detail, the Denycontrol unit 17 stores the setting of the Packet-in flag, in a memory (not shown) or the like in theOFC 10. Following this, the Denylog creation unit 19 creates a Deny log (Deny logging) (step S146). In the case where the logging setting is not made (step S144: “NO”), the Denycontrol unit 17 does not perform the Deny log creation process. - In the case where the action is not Deny in step S130 in
FIG. 3 (step S130: “NO”), thepolicy determination unit 15 instructs the Allowcontrol unit 16 to compute a forwarding destination of the packet (step S150). In detail, the Allowcontrol unit 16 instructs thepath computation unit 18 to compute a path of the packet. The Allowcontrol unit 16 thus acquires the path. - After the process by the Deny control unit17 (step S140) or the path computation process by the Allow control unit16 (step S150), the
OFS control unit 20 creates a message based on the OFP, using the transmission path, the Drop flag, or the Packet-in flag (step S160). In detail, theOFS control unit 20 creates a message for updating a flow stored in thestorage unit 32 in theOFS 30, based on the transmission path of the packet computed by the Allowcontrol unit 16 or the Deny process determined by the Denycontrol unit 17, as well as the Drop flag or the Packet-in flag. TheOFP transmission unit 21 transmits the message created by theOFS control unit 20 based on the OFP, to the OFS30 (step S170). - Thus, the reception of the information of the packet from the
OFS 30 causes the flow to be determined (that is, theOFS 10 creates the entry to be stored in thestorage unit 32 in theOFS 30, after actually receiving the packet), which produces an advantageous effect of reducing the number of flow entries stored in thestorage unit 32. - Processing caused by updating of a policy stored in the policy table12 is described next.
FIG. 5 is a flowchart showing an example of this processing. Upon receiving information indicating that theOFS 30 is connected to the communication network or detecting an update in the policy table12, the staticpolicy acquisition unit 13 reads an updated policy from the policy table12. Moreover, upon detecting initialization of the policy table12, the staticpolicy acquisition unit 13 reads all policies in the policy table12 (step S210). Having read the updated policy, the staticpolicy acquisition unit 13 notifies thepolicy determination unit 15 of the policy. - The
policy determination unit 15 determines whether or not an action included in the policy received from the staticpolicy acquisition unit 13 is an action of “not allowing (Deny) communication to the destination unit” (step S220). In the case where the action is not Deny (step S220: “NO”), thepolicy determination unit 15 ends the processing. In the case where the action is Deny (step S220: “YES”), on the other hand, thepolicy determination unit 15 instructs the Denycontrol unit 17 to determine a Deny process of the packet (step S230). Subsequent processing from when the Denycontrol unit 17 determines the Deny process to when theOFP transmission unit 21 transmits a message created by theOFS control unit 20 based on the OFP to the OFS30 (steps S230 to S250) is the same as the processing of steps S140 and S160 to S170 shown as an example inFIG. 3 , and so its description is omitted. - Thus, the updating of the policy stored in the policy table12 causes the flow to be determined (that is, the
OFC 10 creates the entry to be stored in thestorage unit 32 in theOFS 30, when the policy is updated), which produces an advantageous effect of reducing a load because theOFC 10 can reduce access from theOFS 30. - As described above, according to the present invention, the
policy determination unit 15 determines, using information of a packet received by theOFS 30, whether to allow or not to allow communication to a destination unit for the packet that meets a match condition, based on a policy. On condition that thepolicy determination unit 15 determines not to allow (Deny) communication to the destination unit for the packet that meets the match condition, the Denycontrol unit 17 determines a process for suppressing forwarding of the packet to the destination unit, and theOFS control unit 20 sets, at least in theOFS 30 receiving the packet, a process rule of executing the process. This contributes to a reduced load of processing performed by a packet relay unit (e.g. the OFS30) on a packet for which communication to a destination unit is not allowed (Deny). - Moreover, the Deny
control unit 17 and theOFS control unit 20 set a process rule for discarding (Drop) the packet that meets the match condition, in theOFS 30. This contributes to a reduced CPU load of theOFS 30 and theOFC 10. - Besides, the Deny
control unit 17 and theOFS control unit 20 set a process rule (e.g. a path to another destination) for transmitting the packet that meets the match condition to another destination different from the destination unit, in theOFS 30. This enables a more detailed Deny process to be provided from an external unit. - Furthermore, the Deny
control unit 17 and theOFS control unit 20 set a rule for transmitting, when theOFS 30 receives the Deny packet, the information of the packet to theOFC 10, in theOFS 30. In this case, when theOFC 10 receives the information of the packet from theOFS 30, the Denylog creation unit 19 creates a log. This enables a communication status of the Deny packet to be recognized. FIG. 6 is a block diagram showing an example of a relay control system in a second exemplary embodiment of the present invention. The same structures as the first exemplary embodiment are given the same reference signs as inFIG. 1 , and their description is omitted. The relay control system in this exemplary embodiment includes anOFC 10aand theOFS 30. TheOFS 30 is the same as that in the first exemplary embodiment.- The
OFC 10aincludes theOFP reception unit 11, the policy table12, the staticpolicy acquisition unit 13, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, the Allowcontrol unit 16, the Denycontrol unit 17, thepath computation unit 18, the Denylog creation unit 19, anOFS control unit 20a, and theOFP transmission unit 21. In addition, theOFC 10aincludes a flow management table22. That is, theOFC 10adiffers from theOFC 10 in the first exemplary embodiment in that theOFS control unit 20ais included instead of theOFS control unit 20, and also the flow management table22 is included. The other structures are the same as the first exemplary embodiment. - The flow management table22 stores an action (hereafter referred to as “OF action”) of a flow created by the
OFS control unit 20. That is, the flow management table22 stores a rule set in theOFS 30. For example, the flow management table22 is realized by a magnetic disk unit or the like included in theOFC 10a. The flow management table22 may store the OF action and information (hereafter referred to as “switch identification information”) identifying theOFS 30 as the flow update target, in association with each other. - The
OFS control unit 20astores the created OF action in the flow management table22. Having newly creating the OF action, theOFS control unit 20adetermines whether or not the same OF action is already stored in the flow management table22. In the case where the same OF action is already stored, theOFS control unit 20adiscards the created OF action so that no message is transmitted from theOFP transmission unit 21. That is, in the case where a rule to be set in theOFS 30 is already stored in the flow management table22, theOFS control unit 20adoes not set the rule in theOFS 30. In the case where the created OF action is different from the stored OF action, theOFS control unit 20aupdates the flow management table22 with the created OF action. Functions of theOFS control unit 20aother than the above-mentioned function are the same as those of theOFS control unit 20 in the first exemplary embodiment. - The
OFS control unit 20ais realized by a CPU of a computer operating according to a program (relay control program). TheOFS control unit 20amay also be realized by dedicated hardware. - The following describes an operation.
FIG. 7 is a flowchart showing an example of processing in the case where theOFC 10areceives information of a packet from theOFS 30 in the second exemplary embodiment. Processing from when theOFC 10areceives the information of the packet from theOFS 30 to when theOFS control unit 20acreates a message based on the OFP is the same as the processing of steps S110 to S160 shown as an example inFIG. 3 . - Having created the message based on the OFP, the
OFS control unit 20adetermines whether or not the same OF action is stored in the flow management table22 (step S310). In the case where the same OF action is already stored in the flow management table22 (step S310: “YES”), theOFS control unit 20adiscards the created message (step S320), and ends the processing. In the case where the same OF action is not stored in the flow management table22 (step S310: “NO”), theOFS control unit 20astores the created OF action in the flow management table22 (step S330). Following this, theOFP transmission unit 21 transmits the message created by theOFS control unit 20abased on the OFP, to the OFS30 (step S170). - As described above, according to this exemplary embodiment, when the
OFS control unit 20asets a process rule in theOFS 30, theOFS control unit 20aalso stores the process rule in the flow management table22. Subsequently, when thepolicy determination unit 15 determines not to allow (Deny) communication to a destination unit for a packet that meets a match condition, in the case where a process rule to be set in theOFS 30 is already stored in the flow management table22, theOFS control unit 20adoes not set the process rule in theOFS 30. In this way, a resetting instruction for an already set process rule can be prevented, which contributes to a reduced CPU load of theOFS 30 and theOFC 10a. - For example, in the case where the
OFS 30 performs only the Drop process on the Deny packet, theOFC 10adoes not receive the Deny packet from theOFS 30 again. If Packet-in is set for the Deny packet, however, the packet for which communication is not allowed (Deny) will end up being transmitted to theOFC 10aagain. In this exemplary embodiment, even when the Deny packet is transmitted to theOFC 10aagain, theOFS control unit 20asuppresses the already set flow updating. This contributes to a reduced processing load on theOFC 10aand theOFS 30. - In other words, when the policy includes the action indicating the Drop process and the Packet-in process for the Deny packet or the explicit path setting and the Packet-in process for the Deny packet, the
OFC 10acan be prevented from writing the already written flow action to thestorage unit 32 in the OFS30 a plurality of times. FIG. 8 is a block diagram showing an example of a relay control system in a third exemplary embodiment of the present invention. The same structures as the first exemplary embodiment are given the same reference signs as inFIG. 1 , and their description is omitted. The relay control system in this exemplary embodiment includes anOFC 10band theOFS 30. TheOFS 30 is the same as that in the first exemplary embodiment.- The
OFC 10bincludes theOFP reception unit 11, the policy table12, the staticpolicy acquisition unit 13, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, the Allowcontrol unit 16, a Denycontrol unit 17b, thepath computation unit 18, the Denylog creation unit 19, theOFS control unit 20, and theOFP transmission unit 21. In addition, theOFC 10bincludes a Deny counter table23. That is, theOFC 10bdiffers from theOFC 10 in the first exemplary embodiment in that the Denycontrol unit 17bis included instead of the Denycontrol unit 17, and also the Deny counter table23 is included. The other structures are the same as the first exemplary embodiment. - The Deny counter table23 stores the number (also referred to as “counter value”) of determinations for a packet for which the Deny
control unit 17bdetermines not to allow communication to a destination unit, in association with identification information (e.g. match condition) of the packet. This identification information is hereafter also referred to as “field”. The counter value can be regarded as a count of the number of Packet-in processes. The Deny counter table23 may store the number of Deny processes and the same information as identification information used in a match condition of a policy, in association with each other. Alternatively, the Deny counter table23 may store the number of Deny processes and information included in a payload such as a packet source, in association with each other. Moreover, to aggregate counter values, the Deny counter table23 may store one counter value that is shared between a plurality of flows (match conditions). For example, the Deny counter table23 is realized by a magnetic disk unit or the like included in theOFC 10b. - The Deny
control unit 17bincreases, in the case where an action of a policy is “Deny” (i.e. it is determined not to allow communication to the destination unit), a counter value in the Deny counter table23 corresponding to a match condition of the policy. In the case where the counter value exceeds a predetermined threshold (hereafter referred to as “Deny process count threshold”), the Denycontrol unit 17bdetermines that a process (i.e. Packet-in process) of transmitting information of a packet to theOFC 10bis not to be performed for a flow that meets the match condition corresponding to the counter value. - That is, in the case where the number of Packet-in processes for a specific flow (e.g. on a policy basis or on a source address basis) determined as Deny exceeds a threshold (Deny process count threshold), the Deny
control unit 17bdetermines to cause theOFS 30 to perform only the Drop process or the specific path selection for the specific flow. In so doing, for example in the case where an attack process is carried out on theOFC 10b, a Packet-in frequency can be decreased, which contributes to a reduced processing load on theOFS 30 and theOFC 10b. - The Deny
control unit 17bis realized by a CPU of a computer operating according to a program (relay control program). The Denycontrol unit 17bmay also be realized by dedicated hardware. - The following describes an operation. In the third exemplary embodiment, processing from when the
OFC 10breceives information of a packet from theOFS 30 to when theOFP transmission unit 21 transmits a message to theOFS 30 is the same as the processing in the flowchart shown as an example inFIG. 3 , but processing performed by the Denycontrol unit 17bis different from the processing performed by the Denycontrol unit 17 in the first exemplary embodiment. An operation performed by the Denycontrol unit 17bis described below. FIG. 9 is a flowchart showing an example of processing performed by the Denycontrol unit 17b. An operation up to when the Denycontrol unit 17bdetermines the process based on the additional information included in the action is the same as the operation of steps S141 to S143 inFIG. 4 .- Next, the Deny
control unit 17bdetermines whether or not the logging setting is made in the additional information (step S144). In the case where the logging setting is not made (step144: “NO”), the Denycontrol unit 17bdoes not perform the Deny log creation process. In the case where the logging setting is made (step S144: “YES”), the Denycontrol unit 17bdetermines whether or not a field matching the flow is stored in the Deny counter table23 (step S410). In the case where the field matching the flow is stored (step S410: “YES”), the Denycontrol unit 17bincreases a counter value corresponding to the field (step S420). For example, the Denycontrol unit 17badds1 to the counter value of the field matching the flow. In the case where the field matching the flow is not stored (step S410: “NO”), the Denycontrol unit 17bcreates a match condition (field) of the flow, and initializes a counter value to0 (step S430). After increasing the counter value (step S420) or creating the match condition (field) of the flow (step S430), the Denycontrol unit 17bdetermines whether or not the counter value is equal to or more than the threshold (Deny process count threshold) (step S440). In the case where the counter value is equal to or more than the threshold (step S440: “YES”), the Denycontrol unit 17binstructs the Denylog creation unit 19 to output information indicating that log output is suppressed (step S450). In detail, in the case where the counter value is equal to or more than the threshold, the Denycontrol unit 17binstructs theOFS control unit 20 to create a message, with Packet-in being deleted from the action of the policy. In the case where the counter value is less than the threshold (step S440: “NO”), the Denycontrol unit 17bsets the Packet-in flag and performs Deny logging, as in steps S145 to S146 shown as an example inFIG. 3 . - The above describes the case where, in step S440 in
FIG. 9 , the Denycontrol unit 17bdetermines whether or not the counter value is equal to or more than the threshold (Deny process count threshold). However, the Denycontrol unit 17bmay instead determine whether or not the counter value exceeds the threshold (Deny process count threshold). - As described above, according to this exemplary embodiment, when the
policy determination unit 15 determines not to allow (Deny) communication to a destination unit, the Denycontrol unit 17band theOFS control unit 20 increase the number of determinations for a packet stored in the Deny counter table23 in association with an element identifying the packet. In the case where the number of determinations for the packet exceeds the Deny process count threshold, the Denycontrol unit 17band theOFS control unit 20 set a process rule for suppressing transmission of information of the packet to theOFC 10b, in theOFS 30. As a result, a situation where information of a packet for which communication is not allowed is notified to theOFC 10ban excessive number of times can be prevented. FIG. 10 is a block diagram showing an example of a relay control system in a fourth exemplary embodiment of the present invention. The same structures as the first exemplary embodiment are given the same reference signs as inFIG. 1 , and their description is omitted. The relay control system in this exemplary embodiment includes anOFC 10cand theOFS 30. TheOFS 30 is the same as that in the first exemplary embodiment. Though the first exemplary embodiment describes the case where theOFS control unit 20 sets a process rule of executing a Deny process in the OFS30 (i.e. ingress) receiving packet information, this exemplary embodiment describes the case where the Deny setting is made on anOFS 30 other than the ingress.- The
OFC 10cincludes theOFP reception unit 11, the policy table12, the staticpolicy acquisition unit 13, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, an Allowcontrol unit 16c, the Denycontrol unit 17, thepath computation unit 18, the Denylog creation unit 19, theOFS control unit 20, and theOFP transmission unit 21. That is, theOFC 10cdiffers from theOFC 10 in the first exemplary embodiment in that the Allowcontrol unit 16cis included instead of the Allowcontrol unit 16. The other structures are the same as the first exemplary embodiment. - The Allow
control unit 16ccomputes, in the case where an action of a policy is “Allow” (i.e., it is determined to allow communication to the destination unit), one or more path candidates to a destination unit of a packet. In detail, the Allowcontrol unit 16cinstructs thepath computation unit 18 to compute a plurality of transmission paths to the destination unit. The Allowcontrol unit 16cthen determines, for each computed path, whether or not a switch (hereafter referred to as “Deny switch”) that determines not to allow (Deny) communication of the received packet exists on the path. For example, the Allowcontrol unit 16cmay query each switch on the path whether to allow or not to allow communication of the packet and, based on a response result, determine whether or not the Deny switch exists. - In the case where the transmission path candidates do not include a path on which the communication of the packet is allowed, the Allow
control unit 16cdetermines to perform the Deny process. In detail, the Allowcontrol unit 16cinstructs the Denycontrol unit 17 to determine the Deny process of the packet. In the case where the transmission path candidates include a path on which the communication of the packet is allowed, the Allowcontrol unit 16cdetermines not to perform the Deny process, and notifies theOFS control unit 20 of the path. - Note that, in the case of determining that the Deny switch exists on the path, the Allow
control unit 16cmay determine to set the Deny process in the Deny switch. In this case, the Allowcontrol unit 16cmay instruct the Denycontrol unit 17 to determine the Deny process for the switch on the path, with theOFS control unit 20 instructing the switch on the path to update the flow based on the determined Deny process. - The following describes the case where the Deny process is set in the switch on the path, with reference to
FIGS. 11 and 12 .FIGS. 11 and 12 are explanatory diagrams showing an example where communication is performed from a source (Nancy) to a destination (Paul). A range enclosed with dashed lines is a communication network to which the source (Nancy) and the destination (Paul) are connected. SW1 to SW4 denote switches (e.g. the OFS30), and CT1 denotes a controller (e.g. theOFC 10c). Among SW1 to SW4, each switch shown by hatching is a switch not allowing communication from the source (Nancy) to the destination (Paul), whereas each switch shown by a white circle is a switch allowing communication from the source (Nancy) to the destination (Paul). In the example shown inFIG. 11 , a switch to which the source (Nancy) is connected determines not to allow communication to the destination (Paul). Accordingly, thepolicy determination unit 15 instructs the Denycontrol unit 17 to determine the Deny process of the packet. - Meanwhile, in the example shown in
FIG. 12 , a switch to which the source (Nancy) is connected determines to allow communication to the destination (Paul). Accordingly, thepolicy determination unit 15 instructs the Allowcontrol unit 16cto compute the forwarding destination of the packet. The Allowcontrol unit 16cinstructs thepath computation unit 18 to compute a plurality of transmission paths to the destination. In the example shown inFIG. 12 , three paths to the destination, namely, a path (path1) via SW1, SW2, and SW4, a path (path2) via SW1, SW3, and SW4, and a path (path3) via SW1 and SW4, are computed. The Allowcontrol unit 16cfirst determines whether or not the Deny switch exists onpath 1. SW2 that determines not to allow communication exists onpath 1. The Allowcontrol unit 16cthen determines whether or not the Deny switch exists on the next path candidate (path2). No Deny switch exists on path2. Hence, the Allowcontrol unit 16cnotifies theOFS control unit 20 of path2. - The Allow
control unit 16cmay also determine to set the Deny process in SW2 onpath 1. In this case, the Allowcontrol unit 16cinstructs the Denycontrol unit 17 to determine the Deny process for SW2. TheOFS control unit 20 instructs SW2 to update the flow, based on the determined Deny process. Thus, the Deny process can be set beforehand in the switch on the path. Therefore, in the case where a communication unit is connected to a switch in which the Deny process is already set, there is no need to query theOFC 10cagain. This contributes to a reduced load on theOFC 10cand theOFS 30 for query. - The Allow
control unit 16cis realized by a CPU of a computer operating according to a program (relay control program). The Allowcontrol unit 16cmay also be realized by dedicated hardware. - The following describes an operation.
FIG. 13 is a flowchart showing an example of the case where theOFC 10creceives information of a packet from theOFS 30. In the fourth exemplary embodiment, processing in the case where theOFC 10creceives the information of the packet from theOFS 30 and thepolicy determination unit 15 determines the action as Deny is the same as the processing of steps5110 to S140 and S160 to S170 shown as an example inFIG. 3 . Processing (step S510) performed by the Allowcontrol unit 16cin the case where thepolicy determination unit 15 determines the action as an action of “allowing (Allow) communication to the destination unit” (step S130 inFIG. 13 : “NO”) is described below. FIG. 14 is a flowchart showing an example of the processing performed by the Allowcontrol unit 16c. First, the Allowcontrol unit 16cinstructs thepath computation unit 18 to compute a path candidate (step S511). The Allowcontrol unit 16cperforms determination on each computed path candidate in sequence, starting from the first path candidate (step S512). Note that the order of determination is not particularly limited. The Allowcontrol unit 16cdetermines whether or not the Deny switch exists on the path of the candidate (step S513). In the case where the Deny switch exists (step S513: “YES”), the Allowcontrol unit 16cdetermines to perform a Deny process on the switch (step S515). The Allowcontrol unit 16cthen determines whether or not there is another path candidate (step S516). In the case where there is another path candidate (step S516: “YES”), the Allowcontrol unit 16crepeats the processing of steps S513 and S515 to S518 for each succeeding candidate (step S518). In the case where there is no other path candidate (step S516: “NO”), the Allowcontrol unit 16cdetermines to perform the Deny process (step S517).- In the case where no Deny switch exists on the path of the candidate in step S513 (step S513: “NO”), the Allow
control unit 16cnotifies theOFS control unit 20 of the path (step S514). - In
FIG. 13 , having determined to perform the Deny process (step S520: “YES”), the Allowcontrol unit 16cinstructs the Denycontrol unit 17 to determine the Deny process. Subsequent processing is the same as the processing of steps S140 and S160 to S170 shown as an example inFIG. 3 . - The above describes the case where, in the processing shown as an example in
FIG. 14 , upon detecting the path having no Deny switch, the Allowcontrol unit 16cnotifies theOFS control unit 20 of the path, without performing determination on the path of each succeeding candidate. However, even when detecting the path having no Deny switch, the Allowcontrol unit 16cmay determine, for each of the remaining path candidates, whether or not the Deny switch exists on the path, and notify theOFS control unit 20 of a subsequently detected path. - As described above, according to this exemplary embodiment, on condition that the
policy determination unit 15 determines to allow (Allow) communication to a destination unit for a packet that meets a match condition, thepath computation unit 18 computes one or more path candidates to the destination unit of the packet. Following this, the Allowcontrol unit 16cdetermines whether or not anOFS 30 that determines not to allow communication of the packet exists on the path candidate. In the case where anOFS 30 that determines not to allow communication of the packet exists on each path of all of the path candidates, the Denycontrol unit 17 and theOFS control unit 20 set a process rule of executing a process (Deny process) for suppressing forwarding of the packet to the destination unit, at least in theOFS 30 receiving the packet. As a result, whether or not transmission is allowed can be determined before theOFS 30 relays the packet to another switch, which contributes to a reduced load on the communication network. - Moreover, in the case where the
OFS 30 not allowing communication of the packet that meets the match condition exists on the path, the Denycontrol unit 17 sets a process rule of executing a process (Deny process) for suppressing forwarding of the packet to the destination unit, in theOFS 30. Thus, the process rule of executing the Deny process can be set not only in the switch (i.e. ingress) transmitting the packet to the controller, but also in the switch on the path candidate. This contributes to a reduced load on the communication network. FIG. 15 is a block diagram showing an example of a relay control system in a fifth exemplary embodiment of the present invention. The same structures as the second exemplary embodiment are given the same reference signs as inFIG. 6 , and their description is omitted. The relay control system in this exemplary embodiment includes anOFC 10dand theOFS 30. TheOFS 30 is the same as that in the first exemplary embodiment.- The
OFC 10dincludes theOFP reception unit 11, the policy table12, the dynamicpolicy acquisition unit 14, thepolicy determination unit 15, the Allowcontrol unit 16, the Denycontrol unit 17, thepath computation unit 18, the Denylog creation unit 19, anOFS control unit 20d, theOFP transmission unit 21, and the flow management table22. That is, theOFC 10ddiffers from theOFC 10ain the second exemplary embodiment in that the staticpolicy acquisition unit 13 is not included, and also theOFS control unit 20dis included instead of theOFS control unit 20a. The other structures are the same as the second exemplary embodiment. - In addition to the functions of the
OFS control unit 20ain the second exemplary embodiment, theOFS control unit 20dinstructs to update a flow stored in theOFS 30, based on an OF action (i.e. an action of a flow created by theOFS control unit 20a) stored in the flow management table22. That is, theOFS control unit 20dsets the OF action stored in the flow management table22, in theOFS 30. For example, when theOFS 30 is connected, theOFS control unit 20dreads an OF action corresponding to switch identification information indicating the connectedOFS 30, from the flow management table22. TheOFS control unit 20dthen creates a message for updating a flow, and instructs theOFP transmission unit 21 to transmit the message to theOFS 30. Note that theOFS control unit 20dmay read all OF actions stored in the flow management table22, regardless of the switch identification information. Moreover, theOFS control unit 20dmay perform the above-mentioned processing in the case where theOFC 10dreceives, from theOFS 30, a message requesting an action of a flow. - The
OFS control unit 20dis realized by a CPU of a computer operating according to a program (relay control program). TheOFS control unit 20dmay also be realized by dedicated hardware. - The following describes an operation.
FIG. 16 is a flowchart showing an example of processing in the case where theOFC 10dreceives a message requesting an action of a flow, from theOFS 30. When theOFP reception unit 11 receives the message requesting the action of the flow from the OFS30 (step S610), theOFS control unit 20dreads the action (OF action) of the flow from the flow management table22, and creates a message based on the OFP (step S620). TheOFP transmission unit 21 transmits the message created by theOFS control unit 20dbased on the OFP, to the OFS30 (step S630). - As described above, according to this exemplary embodiment, the
OFS control unit 20dsets a flow stored in the flow management table22, in the packet relay unit. Therefore, even in the case where an update of the policy table12 cannot be detected as in the second exemplary embodiment, the flow indicating the Deny process can be reflected on theOFS 30. - The following describes an example of a minimum structure of a relay control unit according to the present invention.
FIG. 17 is a block diagram showing an example of a minimum structure of a relay control unit according to the present invention. The relay control unit according to the present invention is a relay control unit (e.g. the OFC10) for controlling a packet relay unit (e.g. the OFS30), the relay control unit comprising: communication allowance determination means81 (e.g. the policy determination unit15) for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g. Deny) communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means82 (e.g. the Denycontrol unit 17 and the OFS control unit20) for setting, at least in the packet relay unit receiving the packet, a rule (e.g. flow) of executing a process (e.g. Deny process) for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means81 determines not to allow (e.g. Deny) the communication to the destination unit for the packet that meets the match condition. - According to such a structure, a load of processing performed by the packet relay unit for a packet for which communication to a destination unit is not allowed can be reduced.
- Moreover, as shown in a block diagram of
FIG. 18 , apacket relay unit 90 may be provided to arelay control unit 80 according to the present invention to thereby form a relay control system. - The following describes an example of a minimum structure of a packet relay unit according to the present invention.
FIG. 19 is a block diagram showing an example of a minimum structure of a packet relay unit according to the present invention. The packet relay unit according to the present invention comprises: flow storage means71 (e.g. the storage unit32) for storing a flow which is information associating a process for a received packet with information identifying the packet; and packet relay means72 (e.g. the control unit33) for relaying the received packet based on the flow stored in the flow storage means71. - The packet relay means72 transmits information of the packet to a relay control unit (e.g. the OFC10) in the case where the flow associated with the received packet is not stored in the flow storage means71, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g. Deny) communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process (e.g. Deny process) for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed (e.g. Deny) for the packet.
- According to such a structure, a load of processing performed by the packet relay unit for a packet for which communication to a destination unit is not allowed can be reduced.
- Note that at least the following relay control unit, relay system, and packet relay unit are also included in any of the exemplary embodiments described above.
- (1) A relay control unit (e.g. the OFC10) for controlling a packet relay unit (e.g. the OFS30), the relay control unit comprising: communication allowance determination means (e.g. the policy determination unit15) for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g. Deny) communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means (e.g. the Deny
control unit 17 and the OFS control unit20) for setting, at least in the packet relay unit receiving the packet, a rule (e.g. flow) of executing a process (e.g. Deny process) for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow (e.g. Deny) the communication to the destination unit for the packet that meets the match condition. - (2) The relay control unit wherein the rule setting means (e.g. the Deny
control unit 17 and the OFS control unit20) sets, at least in the packet relay unit receiving the packet, a rule for discarding (e.g. Drop) the packet that meets the match condition. - (3) The relay control unit wherein the rule setting means (e.g. the Deny
control unit 17 and the OFS control unit20) sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination (e.g. a quarantine network, a honeypot, a detailed flow behavior analysis unit, and so on) different from the destination unit. - (4) The relay control unit comprising path computation means (e.g. the path computation unit18) for computing a path to a predetermined destination according to the match condition, wherein the rule setting means sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to the destination computed by the path computation means.
- (5) The relay control unit comprising log creation means (e.g. the Deny log creation unit19) for creating a log (e.g. Deny log) indicating that the communication allowance determination means (e.g. the policy determination unit15) determines not to allow the communication to the destination unit, wherein the rule setting means sets, in the packet relay unit, a rule for transmitting the information of the packet to the relay control unit, when the packet relay unit receives the packet for which the process (e.g. Deny process) for suppressing the forwarding to the destination unit is executed, and wherein the log creation means creates the log, when receiving the information of the packet from the packet relay unit.
- (6) The relay control unit comprising rule storage means (e.g. the flow management table22) for storing the rule set in the packet relay unit, wherein the rule setting means (e.g. the Deny
control unit 17 and theOFS control unit 20a): stores the rule into the rule storage means, when setting the rule in the packet relay unit; and, in the case where the rule to be set in the packet relay unit is already stored in the rule storage means when the communication allowance determination means determines not to allow the communication to the destination unit for the packet that meets the match condition, does not set the rule in the packet relay unit. - (7) The relay control unit comprising determination count storage means (e.g. the Deny counter table23) for storing the number (e.g. counter value) of determinations for the packet for which the communication allowance determination means (e.g. the policy determination unit15) determines not to allow the communication to the destination unit, in association with an element identifying the packet, wherein the rule setting means (e.g. the Deny
control unit 17band the OFS control unit20): increases the number of determinations for the packet associated with the element, when the communication allowance determination means determines not to allow the communication to the destination unit; and sets, in the packet relay unit, a rule for suppressing transmission of the information of the packet to the relay control unit, in the case where the number of determinations for the packet exceeds a predetermined threshold (e.g. Deny process count threshold). - (8) The relay control unit comprising: path candidate computation means (e.g. the path computation unit18) for computing one or more path candidates to the destination unit of the packet, on condition that the communication allowance determination means (e.g. the policy determination unit15) determines to allow (e.g. Allow) the communication to the destination unit for the packet that meets the match condition; and path determination means (e.g. the Allow
control unit 16c) for determining, for each of the path candidates, whether or not a packet relay unit determining not to allow the communication of the packet exists on the path candidate, wherein, in the case where the packet relay unit determining not to allow the communication of the packet exists on each path of all of the path candidates, the rule setting means (e.g. the Denycontrol unit 17 and the OFS control unit20) sets, at least in the packet relay unit receiving the packet, the rule of executing the process (e.g. Deny process) for suppressing the forwarding of the packet to the destination unit. - (9) The relay control unit wherein, in the case where the packet relay unit (e.g. switch) that does not allow the communication of the packet that meets the match condition exists on the path, the rule setting means (e.g. the Deny
control unit 17 and the OFS control unit20) sets, in the packet relay unit, the rule of executing the process (i.e. Deny process) for suppressing the forwarding of the packet to the destination unit. - (10) The relay control unit wherein the rule setting means (e.g. the
OFS control unit 20d) sets the rule (e.g. flow action) stored in the rule storage means (e.g. the flow management table22), in the packet relay unit. - (11) A relay control system comprising: a packet relay unit (e.g. the OFS30); and a relay control unit (the OFC10) for controlling the packet relay unit, wherein the relay control unit includes: communication allowance determination means (e.g. the policy determination unit15) for determining, using information of a packet received by the packet relay unit and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g. Deny) communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and rule setting means (e.g. the Deny
control unit 17 and the OFS control unit20) for setting, at least in the packet relay unit receiving the packet, a rule (e.g. flow) of executing a process (e.g. Deny process) for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination means determines not to allow (e.g. Deny) the communication to the destination unit for the packet that meets the match condition. - (12) The relay control system wherein the rule setting means sets, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition.
- (13) The relay control system wherein the rule setting means sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit.
- (14) A packet relay unit comprising: flow storage means (e.g. the storage unit32) for storing a flow which is information associating a process for a received packet with information identifying the packet; and packet relay means (e.g. the control unit33) for relaying the received packet based on the flow stored in the flow storage means, wherein the packet relay means transmits information of the packet to a relay control unit (e.g. the OFC10) in the case where the flow associated with the received packet is not stored in the flow storage means, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which is information associating a match condition with communicability information (e.g. action), whether to allow (e.g. Allow) or not to allow (e.g. Deny) communication to a destination unit for the packet that meets the match condition, the match condition being information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process (e.g. Deny process) for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed (e.g. Deny) for the packet.
- While the present invention has been described with reference to the above exemplary embodiments and examples, the present invention is not limited to the above exemplary embodiments and examples. Various changes understandable by those skilled in the art within the scope of the present invention can be made to the structures and details of the present invention.
- This application claims priority based on Japanese Patent Application No. 2009-209722 filed on Sep. 10, 2009, the disclosure of which is incorporated herein in its entirety.
- The present invention is preferably applied to a relay control unit for controlling processing performed by a packet relay unit.
- 10,10a,10b,10c,10dOFC
- 11 OFP reception unit
- 12 policy table
- 13 static policy acquisition unit
- 14 dynamic policy acquisition unit
- 15 policy determination unit
- 16,16cAllow control unit
- 17,17bDeny control unit
- 18 path computation unit
- 19 Deny log creation unit
- 20,20a,20dOFS control unit
- 21 OFP transmission unit
- 22 flow management table
- 23 Deny counter table
- 30 OFS
- 31 network interface unit
- 32 storage unit
- 33 control unit
- SW1 to SW4 switch
- CT1 controller
Claims (23)
1.-22. (canceled)
23. A relay control unit for controlling a packet relay unit, the relay control unit comprising:
a communication allowance determination section for determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and
a rule setting section for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination section determines not to allow the communication to the destination unit for the packet that meets the match condition.
24. The relay control unit according toclaim 23 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition.
25. The relay control unit according toclaim 23 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit.
26. The relay control unit according toclaim 25 , further comprising
a path computation section for computing a path to a predetermined destination according to the match condition,
wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to the destination computed by the path computation section.
27. The relay control unit according toclaim 23 , further comprising
a log creation section for creating a log indicating that the communication allowance determination section determines not to allow the communication to the destination unit,
wherein the rule setting section sets, in the packet relay unit, a rule for transmitting the information of the packet to the relay control unit, when the packet relay unit receives the packet for which the process for suppressing the forwarding to the destination unit is executed, and
wherein the log creation section creates the log, when receiving the information of the packet from the packet relay unit.
28. The relay control unit according toclaim 23 , further comprising
a rule storage section for storing the rule set in the packet relay unit,
wherein the rule setting section: stores the rule into the rule storage section, when setting the rule in the packet relay unit; and, in the case where the rule to be set in the packet relay unit is already stored in the rule storage section when the communication allowance determination section determines not to allow the communication to the destination unit for the packet that meets the match condition, does not set the rule in the packet relay unit.
29. The relay control unit according toclaim 27 , further comprising
a determination count storage section for storing the number of determinations for the packet for which the communication allowance determination section determines not to allow the communication to the destination unit, in association with an element identifying the packet,
wherein the rule setting section: increases the number of determinations for the packet associated with the element, when the communication allowance determination section determines not to allow the communication to the destination unit; and sets, in the packet relay unit, a rule for suppressing transmission of the information of the packet to the relay control unit, in the case where the number of determinations for the packet exceeds a predetermined threshold.
30. The relay control unit according toclaim 23 , further comprising:
a path candidate computation section for computing one or more path candidates to the destination unit of the packet, on condition that the communication allowance determination section determines to allow the communication to the destination unit for the packet that meets the match condition; and
path determination section for determining, for each of the path candidates, whether or not a packet relay unit determining not to allow the communication of the packet exists on the path candidate,
wherein, in the case where the packet relay unit determining not to allow the communication of the packet exists on each path of all of the path candidates, the rule setting section sets, at least in the packet relay unit receiving the packet, the rule of executing the process for suppressing the forwarding of the packet to the destination unit.
31. The relay control unit according toclaim 30 , wherein, in the case where the packet relay unit that does not allow the communication of the packet that meets the match condition exists on the path, the rule setting section sets, in the packet relay unit, the rule of executing the process for suppressing the forwarding of the packet to the destination unit.
32. The relay control unit according toclaim 28 , wherein the rule setting section sets the rule stored in the rule storage section, in the packet relay unit.
33. A relay control system comprising:
a packet relay unit; and
a relay control unit for controlling the packet relay unit,
wherein the relay control unit includes:
a communication allowance determination section for determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and
a rule setting section for setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication allowance determination section determines not to allow the communication to the destination unit for the packet that meets the match condition.
34. The relay control system according toclaim 33 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition.
35. The relay control system according toclaim 33 , wherein the rule setting section sets, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit.
36. A packet relay unit comprising:
a flow storage section for storing a flow which is information associating a process for a received packet with information identifying the packet; and
a packet relay section for relaying the received packet based on the flow stored in the flow storage section,
wherein the packet relay section transmits information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage section, and processes the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.
37. A relay control method comprising:
a relay control unit for controlling a packet relay unit determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and
the relay control unit setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition.
38. The relay control method according toclaim 37 , wherein a rule for discarding the packet that meets the match condition is set at least in the packet relay unit receiving the packet, on condition that the communication to the destination unit is determined no to be allowed for the received packet.
39. The relay control method according toclaim 37 , wherein a rule for transmitting the packet that meets the match condition to another destination different from the destination unit is set at least in the packet relay unit receiving the packet, on condition that the communication to the destination unit is determined no to be allowed for the received packet.
40. A packet relay method comprising:
relaying a received packet based on a flow stored in flow storage section for storing the flow which is information associating a process for the received packet with information identifying the packet; and
transmitting information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage section, and relaying the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.
41. A relay control program applied to a computer for controlling a packet relay unit, the relay control program causing the computer to execute:
a communication allowance determination process of determining, using information of a packet received by the packet relay unit and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and
a rule setting process of setting, at least in the packet relay unit receiving the packet, a rule of executing a process for suppressing forwarding of the packet to the destination unit, on condition that the communication to the destination unit is determined no to be allowed for the packet that meets the match condition in the communication allowance determination process.
42. The relay control program according toclaim 41 , causing the computer to
set, at least in the packet relay unit receiving the packet, a rule for discarding the packet that meets the match condition, in the rule setting process.
43. The relay control program according toclaim 41 , causing the computer to
set, at least in the packet relay unit receiving the packet, a rule for transmitting the packet that meets the match condition to another destination different from the destination unit, in the rule setting process.
44. A packet relay program applied to a computer that includes flow storage section for storing a flow which is information associating a process for a received packet with information identifying the packet, the packet relay program causing the computer to execute
a packet relay process of relaying the received packet based on the flow stored in the flow storage section,
wherein in the packet relay process, the computer is caused to transmit information of the packet to a relay control unit in the case where the flow associated with the received packet is not stored in the flow storage section, and process the packet based on the flow set by the relay control unit, the relay control unit: determining, using the information of the received packet and based on a policy which comprises information associating a match condition with communicability information, whether to allow or not to allow communication to a destination unit for the packet that meets the match condition, the match condition comprising information identifying the packet, and the communicability information indicating whether to allow or not to allow the communication to the destination unit for the packet that meets the match condition; and setting, at least in a source unit receiving the packet, the flow of executing a process for suppressing forwarding of the packet that meets the match condition to the destination unit, on condition that the communication to the destination unit is determined not to be allowed for the packet.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US15/349,717US10075338B2 (en) | 2009-09-10 | 2016-11-11 | Relay control unit, relay control system, relay control method, and relay control program |
Applications Claiming Priority (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| JPJP2009-209722 | 2009-09-10 | ||
| JP2009209722 | 2009-09-10 | ||
| PCT/JP2010/004419WO2011030490A1 (en) | 2009-09-10 | 2010-07-06 | Relay control device, relay control system, relay control method, and relay control program |
Related Parent Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/JP2010/004419ContinuationWO2011030490A1 (en) | 2009-09-10 | 2010-07-06 | Relay control device, relay control system, relay control method, and relay control program |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| US15/349,717ContinuationUS10075338B2 (en) | 2009-09-10 | 2016-11-11 | Relay control unit, relay control system, relay control method, and relay control program |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| US20120044935A1true US20120044935A1 (en) | 2012-02-23 |
Family
ID=43732173
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| US13/137,926AbandonedUS20120044935A1 (en) | 2009-09-10 | 2011-09-21 | Relay control unit, relay control system, relay control method, and relay control program |
| US15/349,717ActiveUS10075338B2 (en) | 2009-09-10 | 2016-11-11 | Relay control unit, relay control system, relay control method, and relay control program |
Family Applications After (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| US15/349,717ActiveUS10075338B2 (en) | 2009-09-10 | 2016-11-11 | Relay control unit, relay control system, relay control method, and relay control program |
Country Status (5)
| Country | Link |
|---|---|
| US (2) | US20120044935A1 (en) |
| EP (1) | EP2477362A4 (en) |
| JP (2) | JP5648639B2 (en) |
| CN (1) | CN102577275B (en) |
| WO (1) | WO2011030490A1 (en) |
Cited By (28)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103001887A (en)* | 2012-11-22 | 2013-03-27 | 中兴通讯股份有限公司 | Link keeping alive method, controller and switchboard |
| US20130246655A1 (en)* | 2010-12-13 | 2013-09-19 | Nobuhiko Itoh | Communication path control system, path control device, communication path control method, and path control program |
| US8693344B1 (en)* | 2011-09-27 | 2014-04-08 | Big Switch Network, Inc. | Systems and methods for generating packet forwarding rules based on network policy |
| US20140123215A1 (en)* | 2011-06-17 | 2014-05-01 | Nec Corporation | Communication control apparatus, communication control method, and program |
| US20140149542A1 (en)* | 2012-11-29 | 2014-05-29 | Futurewei Technologies, Inc. | Transformation and Unified Control of Hybrid Networks Composed of OpenFlow Switches and Other Programmable Switches |
| US20140317684A1 (en)* | 2012-05-22 | 2014-10-23 | Sri International | Security Actuator for a Dynamically Programmable Computer Network |
| EP2698952A4 (en)* | 2011-04-15 | 2014-12-03 | Nec Corp | COMPUTER SYSTEM, CONTROLLER AND METHOD FOR CONTROLLING NETWORK ACCESS POLICY |
| US20150023176A1 (en)* | 2012-02-28 | 2015-01-22 | Nokia Solutions And Networks Oy | Data forwarding in a mobile communications network system with centralized gateway apparatus controlling distributed gateway elements |
| US20150043585A1 (en)* | 2012-02-29 | 2015-02-12 | Nec Corporation | Communication apparatus, communication method, communication system and program |
| JP2015050772A (en)* | 2013-08-29 | 2015-03-16 | 株式会社Ｎｔｔドコモ | Apparatus and method for implementing packet gateway user plane |
| US20150078362A1 (en)* | 2013-09-17 | 2015-03-19 | Ricoh Company, Limited | Communication system and communication method |
| US20160021571A1 (en)* | 2014-07-16 | 2016-01-21 | Cisco Technology, Inc. | Interfrequency and inter-technology neighbor planning on a self-organizing network |
| US20160021583A1 (en)* | 2014-07-16 | 2016-01-21 | Cisco Technology, Inc. | Interfrequency and inter-technology neighbor planning on a self-organizing network |
| CN105450710A (en)* | 2014-09-01 | 2016-03-30 | 上海贝尔股份有限公司 | Direct user-to-user communication in access network based on software-defined network |
| US20170063675A1 (en)* | 2015-08-25 | 2017-03-02 | Fujitsu Limited | Flow switch, controller and relay apparatus |
| US20170078183A1 (en)* | 2015-09-14 | 2017-03-16 | Argela Yazilim ve Bilisim Teknolojileri San. ve Tic. A.S. | System and method for control flow management in software defined networks |
| US9660904B2 (en) | 2015-02-10 | 2017-05-23 | Alcatel Lucent | Method and system for inserting an openflow flow entry into a flow table using openflow protocol |
| US9660903B2 (en) | 2015-02-10 | 2017-05-23 | Alcatel Lucent | Method and system for inserting an openflow flow entry into a flow table using openflow protocol |
| US9667440B2 (en)* | 2015-02-10 | 2017-05-30 | Alcatel Lucent | Method and system for identifying an incoming interface using openflow protocol |
| US20170171343A1 (en)* | 2015-12-15 | 2017-06-15 | Freescale Semiconductor, Inc. | Method and apparatus to accelerate session creation using historical session cache |
| US9686137B2 (en) | 2015-02-10 | 2017-06-20 | Alcatel Lucent | Method and system for identifying an outgoing interface using openflow protocol |
| US20170338999A1 (en)* | 2012-07-30 | 2017-11-23 | Rambus Inc. | System and method for memory access in server communications |
| US10244537B2 (en) | 2012-05-01 | 2019-03-26 | Nec Corporation | Communication system, access control apparatus, switch, network control method, and program |
| US10291435B2 (en)* | 2011-02-24 | 2019-05-14 | Nec Platforms, Ltd. | Router device, packet control method based on prefix management, and program |
| US20190182159A1 (en)* | 2013-12-23 | 2019-06-13 | Huawei Technologies Co., Ltd. | Routing control method in software defined networking and openflow controller |
| US10439842B2 (en)* | 2015-08-31 | 2019-10-08 | National University Corporation Nagoya University | Relay device |
| WO2021185161A1 (en)* | 2020-03-19 | 2021-09-23 | 阿里巴巴集团控股有限公司 | Message processing device and message processing method |
| US11218506B2 (en)* | 2018-12-17 | 2022-01-04 | Microsoft Technology Licensing, Llc | Session maturity model with trusted sources |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9544194B2 (en) | 2011-09-09 | 2017-01-10 | Nec Corporation | Network management service system, control apparatus, method, and program |
| WO2014021861A1 (en)* | 2012-07-31 | 2014-02-06 | Hewlett-Packard Development Company, L.P. | Implementing a transition protocol in which a first rule set for routing packets received by a group of switches during a first time period is updated to a second rule set |
| CN104579722A (en)* | 2013-10-11 | 2015-04-29 | 中兴通讯股份有限公司 | Flow statistics capability negotiation method and apparatus |
| WO2015178415A1 (en) | 2014-05-21 | 2015-11-26 | 日本電気株式会社 | Communication apparatus, control apparatus, communication system, and transmission control method |
| ES2654165T3 (en)* | 2015-03-27 | 2018-02-12 | Deutsche Telekom Ag | Network protection entity and method to protect a communication network against fraudulent messages |
| US11323862B2 (en) | 2016-05-06 | 2022-05-03 | Convida Wireless, Llc | Traffic steering at the service layer |
| CN113728598A (en)* | 2019-05-23 | 2021-11-30 | 慧与发展有限责任合伙企业 | System and method for a reduction engine to facilitate self-management |
Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020143955A1 (en)* | 2001-03-27 | 2002-10-03 | Fujitsu Limited | Packet relay processing apparatus |
| US20030204632A1 (en)* | 2002-04-30 | 2003-10-30 | Tippingpoint Technologies, Inc. | Network security system integration |
| US6728929B1 (en)* | 2001-02-16 | 2004-04-27 | Spirent Communications Of Calabasas, Inc. | System and method to insert a TCP checksum in a protocol neutral manner |
| US20040213237A1 (en)* | 2000-06-29 | 2004-10-28 | Toshikazu Yasue | Network authentication apparatus and network authentication system |
| US20060114939A1 (en)* | 2000-07-25 | 2006-06-01 | Juniper Networks, Inc. | Network architecture and methods for transparent on-line cross-sessional encoding and transport of network communications data |
| US20060143710A1 (en)* | 2004-12-29 | 2006-06-29 | Desai Nehal G | Use of application signature to identify trusted traffic |
| US20060168318A1 (en)* | 2003-02-12 | 2006-07-27 | Adam Twiss | Methods and apparatus for traffic management in peer-to-peer networks |
| US20060288413A1 (en)* | 2005-06-17 | 2006-12-21 | Fujitsu Limited | Intrusion detection and prevention system |
| US20070140273A1 (en)* | 2005-12-19 | 2007-06-21 | Fujitsu Limited | Packet relay system |
| US20070157316A1 (en)* | 2005-12-30 | 2007-07-05 | Intel Corporation | Managing rogue IP traffic in a global enterprise |
| US20080016562A1 (en)* | 2004-02-02 | 2008-01-17 | Glenn Mansfield Keeni | Unauthorized Information Detection System and Unauthorized Attack Source Search System |
| US7328349B2 (en)* | 2001-12-14 | 2008-02-05 | Bbn Technologies Corp. | Hash-based systems and methods for detecting, preventing, and tracing network worms and viruses |
| US20080077793A1 (en)* | 2006-09-21 | 2008-03-27 | Sensory Networks, Inc. | Apparatus and method for high throughput network security systems |
| US7451489B2 (en)* | 2002-11-07 | 2008-11-11 | Tippingpoint Technologies, Inc. | Active network defense system and method |
| US7515612B1 (en)* | 2002-07-19 | 2009-04-07 | Qlogic, Corporation | Method and system for processing network data packets |
| US20090138577A1 (en)* | 2007-09-26 | 2009-05-28 | Nicira Networks | Network operating system for managing and securing networks |
| US20090252041A1 (en)* | 2008-04-03 | 2009-10-08 | Alcatel Lucent | Optimized statistics processing in integrated DPI service-oriented router deployments |
| US7856661B1 (en)* | 2005-07-14 | 2010-12-21 | Mcafee, Inc. | Classification of software on networked systems |
| US8495725B2 (en)* | 2009-08-28 | 2013-07-23 | Great Wall Systems | Methods, systems, and computer readable media for adaptive packet filtering |
| US8588056B1 (en)* | 2009-04-15 | 2013-11-19 | Sprint Communications Company L.P. | Elimination of unwanted packets entering a restricted bandwidth network |
Family Cites Families (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP3928833B2 (en)* | 1998-06-30 | 2007-06-13 | 株式会社日立製作所 | Packet relay method and packet relay apparatus |
| US6542496B1 (en) | 1998-06-30 | 2003-04-01 | Hitachi, Ltd. | Packet switching method and apparatus thereof |
| US6726929B1 (en) | 1998-12-18 | 2004-04-27 | Basf Aktiengesellschaft | Pharmaceutical mixture comprising a profen |
| US7403999B2 (en)* | 2001-12-28 | 2008-07-22 | International Business Machines Corporation | Classification support system and method for fragmented IP packets |
| CN1531282A (en)* | 2003-03-12 | 2004-09-22 | ���µ�����ҵ��ʽ���� | packet repeater |
| JP2005175635A (en)* | 2003-12-08 | 2005-06-30 | Nippon Telegr & Teleph Corp <Ntt> | Network connection control method and system apparatus |
| JP2005197823A (en)* | 2003-12-26 | 2005-07-21 | Fujitsu Ltd | Unauthorized access control device between firewall and router |
| JP2006319808A (en)* | 2005-05-13 | 2006-11-24 | Nippon Telegraph & Telephone East Corp | Service relay network system and service relay method |
| US7664088B2 (en)* | 2005-12-08 | 2010-02-16 | Electronics And Telecommunications Research Institute | Method for providing QoS using flow label in providing multimedia service in IPv6 network and system applying the same |
| US20070220187A1 (en)* | 2006-03-20 | 2007-09-20 | Lawrence Kates | Virus-resistant computer with data interface for filtering data |
| CN1921477A (en)* | 2006-09-01 | 2007-02-28 | 华为数字技术有限公司 | Method and system for complicated flow classification of arrange cutted piece message |
| JP4570652B2 (en)* | 2007-11-02 | 2010-10-27 | 日本電信電話株式会社 | Unauthorized access monitoring apparatus and method |
| US8072894B2 (en)* | 2007-11-07 | 2011-12-06 | Juniper Networks, Inc. | Systems and methods for flow monitoring |
| JP4909875B2 (en)* | 2007-11-27 | 2012-04-04 | アラクサラネットワークス株式会社 | Packet relay device |
| CN101222379B (en)* | 2007-12-13 | 2010-12-29 | 东软集团股份有限公司 | Rubbish voice information monitoring method and device |
| JP2009209722A (en) | 2008-03-03 | 2009-09-17 | Nissan Motor Co Ltd | Start control device and start control method for engine |
| US7826458B2 (en)* | 2009-03-05 | 2010-11-02 | Juniper Networks, Inc. | Tracking fragmented data flows |
- 2010
- 2010-07-06CNCN201080045695.5Apatent/CN102577275B/ennot_activeExpired - Fee Related
- 2010-07-06JPJP2011530730Apatent/JP5648639B2/ennot_activeExpired - Fee Related
- 2010-07-06EPEP10815093.9Apatent/EP2477362A4/ennot_activeWithdrawn
- 2010-07-06WOPCT/JP2010/004419patent/WO2011030490A1/enactiveApplication Filing
- 2011
- 2011-09-21USUS13/137,926patent/US20120044935A1/ennot_activeAbandoned
- 2014
- 2014-10-29JPJP2014220018Apatent/JP2015029356A/enactivePending
- 2016
- 2016-11-11USUS15/349,717patent/US10075338B2/enactiveActive
Patent Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040213237A1 (en)* | 2000-06-29 | 2004-10-28 | Toshikazu Yasue | Network authentication apparatus and network authentication system |
| US20060114939A1 (en)* | 2000-07-25 | 2006-06-01 | Juniper Networks, Inc. | Network architecture and methods for transparent on-line cross-sessional encoding and transport of network communications data |
| US6728929B1 (en)* | 2001-02-16 | 2004-04-27 | Spirent Communications Of Calabasas, Inc. | System and method to insert a TCP checksum in a protocol neutral manner |
| US20020143955A1 (en)* | 2001-03-27 | 2002-10-03 | Fujitsu Limited | Packet relay processing apparatus |
| US7328349B2 (en)* | 2001-12-14 | 2008-02-05 | Bbn Technologies Corp. | Hash-based systems and methods for detecting, preventing, and tracing network worms and viruses |
| US20030204632A1 (en)* | 2002-04-30 | 2003-10-30 | Tippingpoint Technologies, Inc. | Network security system integration |
| US7515612B1 (en)* | 2002-07-19 | 2009-04-07 | Qlogic, Corporation | Method and system for processing network data packets |
| US7451489B2 (en)* | 2002-11-07 | 2008-11-11 | Tippingpoint Technologies, Inc. | Active network defense system and method |
| US20060168318A1 (en)* | 2003-02-12 | 2006-07-27 | Adam Twiss | Methods and apparatus for traffic management in peer-to-peer networks |
| US20080016562A1 (en)* | 2004-02-02 | 2008-01-17 | Glenn Mansfield Keeni | Unauthorized Information Detection System and Unauthorized Attack Source Search System |
| US20060143710A1 (en)* | 2004-12-29 | 2006-06-29 | Desai Nehal G | Use of application signature to identify trusted traffic |
| US20060288413A1 (en)* | 2005-06-17 | 2006-12-21 | Fujitsu Limited | Intrusion detection and prevention system |
| US7856661B1 (en)* | 2005-07-14 | 2010-12-21 | Mcafee, Inc. | Classification of software on networked systems |
| US20070140273A1 (en)* | 2005-12-19 | 2007-06-21 | Fujitsu Limited | Packet relay system |
| US20070157316A1 (en)* | 2005-12-30 | 2007-07-05 | Intel Corporation | Managing rogue IP traffic in a global enterprise |
| US20080077793A1 (en)* | 2006-09-21 | 2008-03-27 | Sensory Networks, Inc. | Apparatus and method for high throughput network security systems |
| US20090138577A1 (en)* | 2007-09-26 | 2009-05-28 | Nicira Networks | Network operating system for managing and securing networks |
| US20090252041A1 (en)* | 2008-04-03 | 2009-10-08 | Alcatel Lucent | Optimized statistics processing in integrated DPI service-oriented router deployments |
| US8588056B1 (en)* | 2009-04-15 | 2013-11-19 | Sprint Communications Company L.P. | Elimination of unwanted packets entering a restricted bandwidth network |
| US8495725B2 (en)* | 2009-08-28 | 2013-07-23 | Great Wall Systems | Methods, systems, and computer readable media for adaptive packet filtering |
Cited By (47)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130246655A1 (en)* | 2010-12-13 | 2013-09-19 | Nobuhiko Itoh | Communication path control system, path control device, communication path control method, and path control program |
| US10291435B2 (en)* | 2011-02-24 | 2019-05-14 | Nec Platforms, Ltd. | Router device, packet control method based on prefix management, and program |
| EP2698952A4 (en)* | 2011-04-15 | 2014-12-03 | Nec Corp | COMPUTER SYSTEM, CONTROLLER AND METHOD FOR CONTROLLING NETWORK ACCESS POLICY |
| US20140123215A1 (en)* | 2011-06-17 | 2014-05-01 | Nec Corporation | Communication control apparatus, communication control method, and program |
| US9288233B2 (en)* | 2011-06-17 | 2016-03-15 | Nec Corporation | Communication control apparatus, communication control method, and program |
| US8693344B1 (en)* | 2011-09-27 | 2014-04-08 | Big Switch Network, Inc. | Systems and methods for generating packet forwarding rules based on network policy |
| US10390259B2 (en)* | 2012-02-28 | 2019-08-20 | Nokia Solutions And Networks Oy | Data forwarding in a mobile communications network system with centralized gateway apparatus controlling distributed gateway elements |
| US20150023176A1 (en)* | 2012-02-28 | 2015-01-22 | Nokia Solutions And Networks Oy | Data forwarding in a mobile communications network system with centralized gateway apparatus controlling distributed gateway elements |
| US20150043585A1 (en)* | 2012-02-29 | 2015-02-12 | Nec Corporation | Communication apparatus, communication method, communication system and program |
| US10244537B2 (en) | 2012-05-01 | 2019-03-26 | Nec Corporation | Communication system, access control apparatus, switch, network control method, and program |
| US20140317684A1 (en)* | 2012-05-22 | 2014-10-23 | Sri International | Security Actuator for a Dynamically Programmable Computer Network |
| US9571523B2 (en)* | 2012-05-22 | 2017-02-14 | Sri International | Security actuator for a dynamically programmable computer network |
| US20170338999A1 (en)* | 2012-07-30 | 2017-11-23 | Rambus Inc. | System and method for memory access in server communications |
| US11121904B2 (en)* | 2012-07-30 | 2021-09-14 | Rambus, Inc. | System and method for memory access in server communications |
| US20220052901A1 (en)* | 2012-07-30 | 2022-02-17 | Rambus Inc. | System and method for memory access in server communications |
| US11671522B2 (en)* | 2012-07-30 | 2023-06-06 | Rambus Inc. | System and method for memory access in server communications |
| US9590888B2 (en) | 2012-11-22 | 2017-03-07 | Zte Corporation | Link keepalive method, controller and switch |
| WO2014079271A1 (en)* | 2012-11-22 | 2014-05-30 | 中兴通讯股份有限公司 | Link keepalive method, controller and switch |
| CN103001887A (en)* | 2012-11-22 | 2013-03-27 | 中兴通讯股份有限公司 | Link keeping alive method, controller and switchboard |
| US9729425B2 (en)* | 2012-11-29 | 2017-08-08 | Futurewei Technologies, Inc. | Transformation and unified control of hybrid networks composed of OpenFlow switches and other programmable switches |
| CN107749822A (en)* | 2012-11-29 | 2018-03-02 | 华为技术有限公司 | The conversion for the hybrid network being made up of OpenFlow interchangers and other programmable switches and it is uniformly controlled |
| CN104823417A (en)* | 2012-11-29 | 2015-08-05 | 华为技术有限公司 | Transformation and unified control of hybrid networks composed of OpenFlow switches and other programmable switches |
| US20140149542A1 (en)* | 2012-11-29 | 2014-05-29 | Futurewei Technologies, Inc. | Transformation and Unified Control of Hybrid Networks Composed of OpenFlow Switches and Other Programmable Switches |
| JP2015050772A (en)* | 2013-08-29 | 2015-03-16 | 株式会社Ｎｔｔドコモ | Apparatus and method for implementing packet gateway user plane |
| US9907108B2 (en)* | 2013-09-17 | 2018-02-27 | Ricoh Company, Limited | Communication system and communication method |
| US20150078362A1 (en)* | 2013-09-17 | 2015-03-19 | Ricoh Company, Limited | Communication system and communication method |
| US20190182159A1 (en)* | 2013-12-23 | 2019-06-13 | Huawei Technologies Co., Ltd. | Routing control method in software defined networking and openflow controller |
| US10757021B2 (en)* | 2013-12-23 | 2020-08-25 | Huawei Technologies Co., Ltd. | Routing control method in software defined networking and OpenFlow controller |
| US20160021583A1 (en)* | 2014-07-16 | 2016-01-21 | Cisco Technology, Inc. | Interfrequency and inter-technology neighbor planning on a self-organizing network |
| US20160021571A1 (en)* | 2014-07-16 | 2016-01-21 | Cisco Technology, Inc. | Interfrequency and inter-technology neighbor planning on a self-organizing network |
| US9923772B2 (en)* | 2014-07-16 | 2018-03-20 | Cisco Technology, Inc. | Interfrequency and inter-technology neighbor planning on a self-organizing network |
| US9924382B2 (en)* | 2014-07-16 | 2018-03-20 | Cisco Technology, Inc. | Interfrequency and inter-technology neighbor planning on a self-organizing network |
| CN105450710A (en)* | 2014-09-01 | 2016-03-30 | 上海贝尔股份有限公司 | Direct user-to-user communication in access network based on software-defined network |
| US9660903B2 (en) | 2015-02-10 | 2017-05-23 | Alcatel Lucent | Method and system for inserting an openflow flow entry into a flow table using openflow protocol |
| US9686137B2 (en) | 2015-02-10 | 2017-06-20 | Alcatel Lucent | Method and system for identifying an outgoing interface using openflow protocol |
| US9667440B2 (en)* | 2015-02-10 | 2017-05-30 | Alcatel Lucent | Method and system for identifying an incoming interface using openflow protocol |
| US9660904B2 (en) | 2015-02-10 | 2017-05-23 | Alcatel Lucent | Method and system for inserting an openflow flow entry into a flow table using openflow protocol |
| US10237170B2 (en)* | 2015-08-25 | 2019-03-19 | Fujitsu Limited | Flow switch, controller and relay apparatus |
| US20170063675A1 (en)* | 2015-08-25 | 2017-03-02 | Fujitsu Limited | Flow switch, controller and relay apparatus |
| US10439842B2 (en)* | 2015-08-31 | 2019-10-08 | National University Corporation Nagoya University | Relay device |
| US20170078183A1 (en)* | 2015-09-14 | 2017-03-16 | Argela Yazilim ve Bilisim Teknolojileri San. ve Tic. A.S. | System and method for control flow management in software defined networks |
| US9806983B2 (en)* | 2015-09-14 | 2017-10-31 | Argela Yazilim ve Bilisim Teknolojileri San. ve Tic. A.S. | System and method for control flow management in software defined networks |
| US20170171343A1 (en)* | 2015-12-15 | 2017-06-15 | Freescale Semiconductor, Inc. | Method and apparatus to accelerate session creation using historical session cache |
| US10536549B2 (en)* | 2015-12-15 | 2020-01-14 | Nxp Usa, Inc. | Method and apparatus to accelerate session creation using historical session cache |
| US11218506B2 (en)* | 2018-12-17 | 2022-01-04 | Microsoft Technology Licensing, Llc | Session maturity model with trusted sources |
| CN113497718A (en)* | 2020-03-19 | 2021-10-12 | 阿里巴巴集团控股有限公司 | Message processing device and message processing method |
| WO2021185161A1 (en)* | 2020-03-19 | 2021-09-23 | 阿里巴巴集团控股有限公司 | Message processing device and message processing method |
Also Published As
| Publication number | Publication date |
|---|---|
| US10075338B2 (en) | 2018-09-11 |
| JPWO2011030490A1 (en) | 2013-02-04 |
| JP2015029356A (en) | 2015-02-12 |
| CN102577275B (en) | 2016-05-04 |
| EP2477362A4 (en) | 2013-12-04 |
| CN102577275A (en) | 2012-07-11 |
| WO2011030490A1 (en) | 2011-03-17 |
| EP2477362A1 (en) | 2012-07-18 |
| US20170063619A1 (en) | 2017-03-02 |
| JP5648639B2 (en) | 2015-01-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10075338B2 (en) | Relay control unit, relay control system, relay control method, and relay control program | |
| US9276852B2 (en) | Communication system, forwarding node, received packet process method, and program | |
| US8780721B2 (en) | Network system, controller, method, and program | |
| US9065724B2 (en) | Managing a flow table | |
| US9419910B2 (en) | Communication system, control apparatus, and communication method | |
| US20130246655A1 (en) | Communication path control system, path control device, communication path control method, and path control program | |
| CN109873768B (en) | Method for updating forwarding table, hardware accelerator, OVS and server | |
| JP5858141B2 (en) | Control device, communication device, communication system, communication method, and program | |
| JP5725236B2 (en) | Communication system, node, packet transfer method and program | |
| US9769064B2 (en) | Communication node, packet processing method and program | |
| EP2905932B1 (en) | Method for multiple path packet routing | |
| JP2008118281A (en) | Communication device | |
| US20150256455A1 (en) | Communication system, path information exchange apparatus, communication node, forwarding method for path information and program | |
| KR101707355B1 (en) | Communication node, communication system, control device, packet transfer method, and program | |
| JP2005033351A (en) | Packet relay device | |
| US20150172176A1 (en) | Control device, communication system, communication method and program | |
| WO2014142256A1 (en) | Communication system, controller, communication method, and program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| AS | Assignment | Owner name:NEC CORPORATION, JAPAN Free format text:ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HAMA, TAKAYUKI;YAMATO, JUNICHI;CHIBA, YASUNOBU;REEL/FRAME:027097/0044 Effective date:20110628 | |
| STCB | Information on status: application discontinuation | Free format text:ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |