Packet relay system and packet relay method

Abstract

This packet relay system (1) comprises: a tenant (51) with a plurality of tap devices (513, 514) that terminate a tunneling protocol; a tenant (52) with a plurality of tap devices (523, 524); and a plurality of relay devices (41, 42) connecting the plurality of tenants (51, 52) and external devices (31, 32). The relay devices (41, 42) are provided with connection management units (414, 424) that determine transfer destinations of packets, received from the external devices (31, 32), on the basis of header information of the packets.

Description

[Technical Field]

[0001] The present invention relates to a packet relay system and a packet relay method for transferring packets in a network device. [Background technology]

[0002] With the development of SDN (Software Defined Network) and NFV (Network Function Virtualization) technologies, there is a demand for flexible connections between mobile terminals and cloud servers, etc. As a result, services are emerging that enable packet forwarding between mobile terminals and servers by allowing network users to control packet forwarding destinations on demand via packet relay devices.

[0003] An example of a conventional technology is a configuration that uses tunneling protocols such as IPsec (Internet Protocol Security), VXLAN, and GRE (Generic Routing Encapsulation), and uses routing software such as Open vSwitch for packet relay devices.

[0004] When a mobile terminal and a server on a cloud exchange packets, a service is generally realized by using the IP addresses assigned to the packet relay device as the packet destinations for both parties. One example of a technology that supports such a service is GRE, as described in Non-Patent Document 1. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] "As a Network Engineer - GRE (Generic Routing Encapsulation)", [online], [Retrieved November 18, 2021], Internet<URL:https: / / www.infraexpert.com / study / rp8gre.htm> Summary of the Invention [Problem to be solved by the invention]

[0006] In a packet relay system, there are cases where a tenant needs to be switched due to construction work on the physical server on which the tenant is running, etc. In such cases, it is not possible to switch the tenant only for specific packets.

[0007] Switching specific packets refers to cases where you want to switch only a portion of traffic to a new tenant on a trial basis, or where you want to switch traffic with low latency requirements to another tenant, etc. Switching only a portion of traffic to a new tenant on a trial basis is also called pilot switching.

[0008] Therefore, an object of the present invention is to switch a specific packet to a desired tenant in a relay system having a plurality of tenants. [Means for solving the problem]

[0009] In order to solve the above-mentioned problems, the packet relay system of the present invention comprises: a plurality of tenants that have constructed a plurality of virtual network devices that terminate a tunneling protocol; a plurality of relay devices that connect the plurality of tenants to an external device; a management device that manages the plurality of tenants and the plurality of relay devices, The relay device includes a connection management unit that determines a forwarding destination of a packet based on header information of the packet received from the external device. If the packet relates to new traffic, the connection management unit sets the destination of the packet to a new tenant, and if it can be determined only from the packet whether the connection related to the packet is new or not, notifies the management device of information about the connection, and the management device instructs another relay device different from the relay device to add the connection. It is characterized by: Other means will be described in the detailed description of the invention. [Effects of the Invention]

[0010] According to the present invention, in a relay system having a plurality of tenants, it is possible to switch a specific packet to a desired tenant. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 10 is a diagram illustrating an operation of distributing packets to a plurality of tenants in the packet relay system of the present embodiment. [Figure 2] FIG. 10 is a diagram illustrating a configuration in which a tenant has two network interfaces and relay devices are arranged before and after the tenant. [Figure 3] FIG. 1 is a diagram showing a configuration of a packet relay system according to the present embodiment, in which a plurality of tenants each having two network interfaces are provided, with relay devices arranged before and after the tenants. [Figure 4] 10 is a flowchart of a transfer ratio determination process performed by a connection management unit. [Figure 5] 10 is a flowchart of a new packet distribution process performed by a connection management unit. [Figure 6] FIG. 10 is a diagram illustrating a connection information notification. [Figure 7] FIG. 10 is a diagram showing an instruction to add connection information. [Figure 8] 10 is a flowchart of a process of determining transfer to both tenants by a connection management unit. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a configuration diagram of a packet relay system 1 according to this embodiment. This packet relay system 1 is configured to include a management device 11, multiple tenants 51 and 52, and relay devices 41 and 42 located before and after the management device 11 and 52. The packet relay system 1 is connected to an external device, device 31, via a tunnel 81, and is connected to an external device, device 32, via a tunnel 82. The multiple tenants 51 and 52 are multiple units, and are constructed as, for example, containers, virtual machines, or physical devices.

[0013] The management device 11 creates a plurality of tenants 51 and 52 based on a tenant addition instruction from the terminal 2. Then, the management device 11 instructs the relay devices 41 and 42 about a rule for switching the destination.

[0014] Furthermore, the management device 11 performs conversion processing on the information notification of the new connection received from the relay devices 41 and 42, and instructs the opposite relay devices 42 and 41 to add the connection information.

[0015] The relay device 41 has a left network interface 411, a right network interface 412, a routing table 413, and a connection management unit 414. The relay device 41 connects a plurality of tenants 51 and 52 to an external device 31. The connection management unit 414 has a function of analyzing a packet received from the device 31 and determining whether the packet matches a rule specified in advance by the management device 11. The connection management unit 414 determines the forwarding destination of the packet based on the header information of the packet received from the device 31.

[0016] These network interfaces 411 and 412 are connected to adjacent devices to send and receive packets. The routing table 413 is, for example, a forwarding information base (FIB). This routing table 413 contains settings that allow a packet received from one of the network interfaces 411 and 412 to be forwarded to the outside from the other network interface.

[0017] Similarly, the relay device 42 has a connection management unit 424 in addition to network interfaces 421 and 422 and a routing table 423. The relay device 42 connects a plurality of tenants 51 and 52 with an external device 32. The connection management unit 424 has a function of analyzing a packet received from the device 32 and determining whether the packet matches a rule instructed in advance by the management device 11. The connection management unit 424 determines the forwarding destination of the packet based on the header information of the packet received from the device 32.

[0018] The tenant 51 includes a left network interface 511, a right network interface 512, and a routing table 515. The tenant 51 also includes multiple tap devices 513 and 514 that terminate the tunneling protocol. These tap devices 513 and 514 are virtual network devices.

[0019] The tenant 52 also has a left network interface 521, a right network interface 522, and a routing table 525, and tap devices 523 and 524 are configured.

[0020] FIG. 2 is a diagram showing a configuration in which a tenant has two network interfaces and relay devices are placed before and after the tenant. The packet relay system 1 in FIG. 2 does not include a tenant 52, unlike the packet relay system 1 of the present embodiment shown in FIG.

[0021] The relay devices 41 and 42 are connected to the devices 31 and 32 via a network capable of transmitting and receiving IP packets. As a basic operation, the relay devices 41 and 42 transmit tunneling protocol packets transmitted from one of the devices 31 and 32 to the tenant 51. The relay devices 41 and 42 also have a role of transmitting tunneling protocol packets transmitted from the tenant 51 to the other of the devices 31 and 32.

[0022] The tenant 51 is connected to the relay device 41 via a network capable of transmitting and receiving IP packets via a network interface 511. The tenant 51 is further connected to the relay device 42 via a network capable of transmitting and receiving IP packets via a network interface 512.

[0023] The tenant 51 also has tap devices 513 and 514 that terminate the transfer protocol. As a basic operation, when a tunneling protocol packet transmitted from the device 31 arrives at the network interface 511, the tenant 51 terminates the tunneling protocol at the tap device 513. The tenant 51 then encapsulates the packet at another tap device 514 and transfers it to the device 32 on the opposite side.

[0024] Similarly, when a tunneling protocol packet sent from the device 32 arrives at the network interface 512, the tenant 51 terminates the tunneling protocol at a tap device 514. Then, the tenant 51 encapsulates the packet at another tap device 513 and transfers it to the device 31 on the opposite side.

[0025] FIG. 3 is a diagram showing a configuration in which a plurality of tenants each having two network interfaces are provided, and relay devices 41 and 42 are arranged before and after the tenants. The connection management unit 414 identifies a connection based on the header information of a packet received from the device 31. Then, the connection management unit 414 determines a destination tenant for the packet based on predetermined rules. The rules are assumed to have been instructed in advance by the management device 11. The connection management unit 414 determines a destination tenant for the packet based on these predetermined rules, and can switch a specific packet to a desired tenant. The same applies to the connection management unit 424. For example, the connection management unit 414 determines different tenants as the destination when the packet is related to traffic with a low latency requirement and as the destination when the packet is related to traffic with no low latency requirement. This makes it possible to allocate packets to an appropriate tenant according to the packet's delay requirement.

[0026] Rule 1 is a rule that, depending on the number of packets received from the device 31 , a certain percentage of packets are sent to the new tenant 52 , and the remaining packets are sent to the existing tenant 51 . Rule 2 is a rule that determines whether a packet is a new connection from the header information of the packet, and transmits the packet to a new tenant 52 if the connection is new.

[0027] Rule 3 is a rule that transfers packets received from the devices 31 and 32 to both tenants 51 and 52. In other words, the connection management unit 414 transmits packets received from the external device 31 to multiple tenants 51 and 52 simultaneously.

[0028] In the case of a rule that requires management of past connections, such as rule 2, the connection management units 414 and 424 record the rules of the destination tenant for the past connection information. Then, in the case of a rule that requires determination of a new destination, such as rule 2, the connection management units 414 and 424 additionally record the information as connection information.

[0029] When it is only possible to determine from the packet whether the connection of a packet is new or not, one of the relay devices 41, 42 notifies the management device 11 of the connection information in order to propagate the route information to the other relay device. By notifying the other relay device of the connection information, the management device 11 ensures that a certain connection is forwarded via a unique tenant regardless of whether the communication originates from device 31 or device 32.

[0030] By applying these rules, it is possible to perform the desired switching when it is desired to switch only a portion of traffic to a new tenant on a trial basis or when it is desired to switch traffic with low latency requirements to another tenant.

[0031] Rule 1 4 is a flowchart of the transfer ratio determination process performed by the connection management unit 414. Here, the connection management unit 414 is described as the main operator, but the connection management unit 424 may also be the main operator.

[0032] In step S10, the connection management unit 414 identifies the connection based on the header information of the packet received from the device 31. Then, in step S11, the connection management unit 414 determines the destination tenant of the packet based on a predetermined rule. This rule is specified in advance by the management device 11.

[0033] In step S11, the connection management unit 414 determines the transfer of packets received from the device 31 to the tenant 51 and the tenant 52 at a predetermined ratio, and then ends the processing in FIG.

[0034] Rule 2 5 is a flowchart of a new packet distribution process performed by the connection management unit 414. Here, the connection management unit 424 may be the main operator, although the connection management unit 414 is described as the main operator.

[0035] Rule 2 In step S30, the connection management unit 414 identifies the connection based on the header information of the packet received from the device 31. Then, in step S31, the connection management unit 414 determines whether the connection of this packet is new or not.

[0036] In step S31, if the connection of this packet is not new but is an existing one (No), the connection management unit 414 proceeds to step S33, and if the forwarding destination of this packet is set to the existing tenant, ends the processing in Fig. 5. If the connection of this packet is new (Yes), the connection management unit 414 proceeds to step S32.

[0037] In step S32, the connection management unit 414 designates the new tenant as the forwarding destination of this packet. Then, in step S34, the connection management unit 414 determines whether devices other than the device that received the packet can also determine whether the connection of the packet is new. If the connection management unit 414 can also determine whether the connection of the packet is new (Yes), the connection management unit 414 ends the processing in Fig. 5. If devices other than the device that received the packet cannot determine whether the connection of the packet is new (No), the connection management unit 414 proceeds to step S35.

[0038] In step S35, the connection management unit 414 records the rule of the destination tenant with respect to the past connection information, and records it additionally as connection information (step S36).

[0039] Next, the relay device 41 notifies the management device 11 of the connection information and the linking information of the destination tenant (step S37). In other words, if the connection management unit 414 can determine whether the connection related to the packet is new or not only from the packet, it notifies the management device 11 of the information on this connection. As a result, when any of the multiple relay devices connected to the tenant receives a new connection, it is possible to have the other relay devices add the connection information.

[0040] The management device 11 instructs the other relay device 42 to add connection management information for forwarding packets of the same connection to the tenant determined by the original relay device 41 (step S38).

[0041] The other relay device 42 records the connection information instructed by the management device 11 in the connection management section 424 (step S39), and then ends the processing of FIG.

[0042] This allows packets related to new traffic to be transmitted to the new tenant, and allows for a gradual transition from the existing tenant to the new tenant without adversely affecting the existing traffic.

[0043] FIG. 6 is a diagram illustrating a connection information notification. If only the relay device 41 that received the packet can determine whether the connection of this packet is new or not, the relay device 41 notifies the management device 11 of the connection information in order to propagate the route information to the relay device 42.

[0044] If this is not done, packets of the new connection from device 31 to device 32 will pass through tenant 52, but there will be no guarantee that packets from device 32 to device 31 will pass through tenant 52. The relay device 41 transmits to the management device 11 the linking information between the connection information and the destination tenant that has been newly recorded in the connection management unit 414.

[0045] FIG. 7 is a diagram showing an instruction to add connection information. When the management device 11 receives information about the new connection from the relay device 41, it instructs the relay device 42 to add connection management information. This enables the management device 11 to transfer packets of the same connection to the tenant 52 determined by the relay device 41.

[0046] The encapsulation methods of packets passing through relay device 41 and relay device 42 may not match, and the packet frames may not necessarily match. Therefore, management device 11 performs conversion processing based on the types of transfer protocols used by relay device 41 and relay device 42, and then notifies relay device 42 of the connection information to be notified.

[0047] The relay device 42 records the connection information instructed by the management device 11 in the connection management unit 424. This realizes a state in which packets transmitted from the device 32 for the same connection are forwarded to the tenant 52.

[0048] Rule 3 8 is a flowchart of the process of determining whether to transfer data to both the tenants 51 and 52, performed by the connection management unit 414. Note that the connection management unit 424 also performs similar processing. In step S20, the connection management unit 414 identifies the connection based on the header information of the packet received from the device 31.

[0049] In step S21, the connection management unit 414 determines that the packet received from the device 31 should be forwarded to both tenant 51 and tenant 52, and ends the processing in Fig. 8. This makes it possible to simultaneously transmit packets to multiple tenants, improve the reliability of packet transmission, and stop the existing tenants that are currently operating.

[0050] "effect" The effects of the packet relay system and the like according to the present invention will be described below.

[0051] 《Claim 1》 Multiple tenants who have created multiple virtual network devices that terminate tunneling protocols, a plurality of relay devices that connect the plurality of tenants to an external device; the relay device includes a connection management unit that determines a forwarding destination of a packet based on header information of the packet received from the external device; A packet relay system comprising:

[0052] This allows a specific packet to be switched to a desired tenant in a relay system with multiple tenants, so that the tenant can be switched when, for example, construction work is performed on a physical server on which the tenant operates.

[0053] 《Claim 2》 the connection management unit determines a tenant to which the packet is to be forwarded based on a predetermined rule; 2. The packet relay system according to claim 1, wherein:

[0054] This allows packets arriving at the relay device to be forwarded to the determined tenant.

[0055] 《Claim 3》 When the packet relates to new traffic, the connection management unit sets the forwarding destination of the packet to a new tenant. 2. The packet relay system according to claim 1, wherein:

[0056] This allows packets related to new traffic to be transmitted to the new tenant, and allows for a gradual transition from the existing tenant to the new tenant without adversely affecting the existing traffic.

[0057] 《Claim 4》 a management device that manages the plurality of tenants and the plurality of relay devices, the connection management unit, when it can determine whether or not the connection related to the packet is new only from the packet, notifies the management device of information about the connection; the management device instructs another relay device different from the relay device to add the connection; 4. The packet relay system according to claim 3.

[0058] As a result, when one of a plurality of relay devices connected to a tenant receives a new connection, it is possible to have the other relay devices add the connection information.

[0059] 《Claim 5》 the connection management unit sets a forwarding destination when the packet is related to traffic with a low latency requirement and a forwarding destination when the packet is related to traffic without a low latency requirement to different tenants, respectively; 2. The packet relay system according to claim 1, wherein:

[0060] This allows packets to be transferred to an appropriate tenant according to the delay requirement of the traffic associated with the packet.

[0061] 《Claim 6》 the connection management unit simultaneously transmits packets received from an external device to the plurality of tenants; 2. The packet relay system according to claim 1, wherein:

[0062] This makes it possible to simultaneously transmit packets to a plurality of tenants, improve the reliability of packet transmission, and stop conventional tenants that are currently operating.

[0063] 《Claim 7》 A plurality of tenants constructing a plurality of virtual network devices that terminate a tunneling protocol; a step in which a relay device connecting the plurality of tenants and an external device determines a forwarding destination of a packet based on header information of the packet received from the external device; A packet relay method comprising:

[0064] This allows a specific packet to be switched to a desired tenant in a relay system with multiple tenants, so that the tenant can be switched when, for example, construction work is performed on a physical server on which the tenant operates. [Explanation of symbols]

[0065] 1 Packet Relay System 11 Management device 2. Terminal 31,32 equipment 41 Relay device 411,412 Network Interface 413 Routing Table 414 Connection Management Unit 42 Relay device 421,422 Network Interfaces 423 Routing Table 424 Connection Management Unit 51 Tenants 511,512 network interfaces 513,514 tap devices 515 Routing Table 52 tenants 521,522 network interfaces 523,524 tap devices 525 routing table 81 Tunnel 82 Tunnel

Claims

1. Multiple tenants who have created multiple virtual network devices that terminate tunneling protocols, a plurality of relay devices that connect the plurality of tenants with external devices; a management device that manages the plurality of tenants and the plurality of relay devices, the relay device includes a connection management unit that determines a forwarding destination of a packet based on header information of the packet received from the external device; When the packet relates to new traffic, the connection management unit sets a forwarding destination of the packet to a new tenant, If it is possible to determine whether the connection related to the packet is new or not only from the packet, notify the management device of information about the connection; the management device instructs another relay device different from the relay device to add the connection; A packet relay system comprising:

2. the connection management unit determines a tenant to which the packet is to be forwarded based on a predetermined rule; 2. A packet relay system according to claim 1.

3. the connection management unit sets a forwarding destination when the packet is related to traffic with a low latency requirement and a forwarding destination when the packet is related to traffic without a low latency requirement to different tenants, respectively; 2. A packet relay system according to claim 1.

4. Multiple tenants who have created multiple virtual network devices that terminate tunneling protocols, a plurality of relay devices that connect the plurality of tenants to an external device; the relay device includes a connection management unit that determines a forwarding destination of a packet based on header information of the packet received from the external device; In order to enable stopping any one of the tenants to which the packet is to be transmitted, the connection management unit simultaneously transmits the packet received from the external device to the plurality of tenants. A packet relay system comprising:

5. A plurality of tenants constructing a plurality of virtual network devices that terminate a tunneling protocol; a step in which a connection management unit of a relay device that connects the plurality of tenants and an external device determines a forwarding destination of the packet based on header information of the packet received from the external device; the connection management unit designating a new tenant as a forwarding destination of the packet when the packet relates to new traffic; If it is possible to determine whether or not the connection related to the packet is new only from the packet, notifying a management device of information about the connection; a step of instructing another relay device different from the relay device to add the connection by the management device; A packet relay method comprising:

6. A plurality of tenants constructing a plurality of virtual network devices that terminate a tunneling protocol; a step in which a connection management unit of a relay device that connects the plurality of tenants and an external device determines a forwarding destination of the packet based on header information of the packet received from the external device; The connection management unit simultaneously transmits a packet received from an external device to a plurality of tenants so that any one of the tenants to which the packet is to be transmitted can be stopped; A packet relay method comprising:

Images