Gateway, control method, and control program

Abstract

A VPN GW (10), when shifting from a high load state, in which resources are separated between resources for a low-priority communication-using NW function unit (11) and resources for a high-priority communication-using NW function unit (12) and a high-priority / low-priority communication-using NW function unit (13), to a default state in which all resources are shared by all NW function units, limits the traffic flow of the low-priority communication-using NW function unit (11) in accordance with the traffic flow of the low-priority communication-using NW function unit (11) and shares all resources between the low-priority communication-using NW function unit (11) and the high-priority communication-using NW function unit (12) and high-priority / low-priority communication-using NW function unit (13), and then gradually relaxes the limit on the traffic flow of the low-priority communication-using NW function unit (11) according to the resource utilization rate of the high-priority communication-using NW function unit (12) and high-priority / low-priority communication-using NW function unit (13).

Description

Technical Field

[0003] , ,

[0001] The present invention relates to a gateway, a control method, and a control program.

Background Art

[0002] With the development of virtualization technology and the emergence of the concept of microservices, a software architecture has emerged that combines multiple function-specific containers to build a single system. For the VPN gateway (GW) for VPN (Virtual Private Network) services, a method of realizing it by combining function-specific containers has also been proposed.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Non-Patent Document 2

Non-Patent Document 3

Summary of the Invention

[0004] Figures 8 and 9 illustrate existing technologies. Here, using the Linux® functionality of RSS (Receive Side Scaling) / RPS (Receive Packet Steering), it is possible to specify the resources used for packet processing by each container. This functionality enables resource sharing settings (Figure 8), which allow all containers to share resources for packet processing, and resource dedication settings (Figure 9), which allocate dedicated resources to each container based on quality requirements.

[0005] However, with the resource sharing setting, when communications with different quality requirements coexist within the VPN gateway, the increased traffic from low-priority communications consumes packet processing resources for high-priority communications, making it impossible to ensure the quality of high-priority communications. Furthermore, with the resource dedication setting, when there is little high-priority communication, a large amount of resources become idle, preventing the forwarding of low-priority communications as much as possible. Thus, neither setting provides resource allocation that meets the intended purpose.

[0006] Figure 10 illustrates an existing technology. This existing technology addresses a system with multiple web applications running on containers, minimizing the impact of increased load on some containers on other containers' web applications, while simultaneously improving the processing speed of the heavily loaded container. In this method, by default, specific resources are allocated to each container (left diagram in Figure 10), the load status of each container is monitored, and if a container becomes heavily loaded, the resource allocation is released, making all resources available (right diagram in Figure 10).

[0007] However, with the technology shown in Figure 10, when the traffic of low-priority communications increases and the low-priority communications pass through multiple containers, increasing the load on all containers (right diagram in Figure 10), the packet processing resources for high-priority communications are consumed, and the quality of high-priority communications cannot be ensured.

[0008] The present invention has been made in view of the above, and aims to provide a gateway, control method, and control program that enable effective use of resources while eliminating the impact of low-quality communications on high-quality communications when communications with different quality requirements are mixed within a VPN GW. [Means for solving the problem]

[0009] To solve the above-mentioned problems and achieve the objective, the control device according to the present invention is a gateway for a virtual private network service, comprising: a first network function unit that enables communication between networks meeting predetermined quality requirements; a second network function unit that enables communication between networks meeting higher quality requirements than the first network function unit; a monitoring unit that monitors resources within the gateway; a measurement unit that measures the traffic flow rate of the first network function unit; a setting unit that sets limits on the traffic flow rate of the first network function unit; an allocation unit that allocates an instructed amount of resources to the first network function unit and / or the second network function unit; and a control device that controls the monitoring unit, the measurement unit, the setting unit and the allocation unit. The system is characterized by having a control unit that controls the system to either a default state in which the first network function unit and the second network function unit share all resources, or a high-load state in which the first network function unit and the second network function unit separate resources, and when transitioning from the high-load state to the default state, limits the traffic flow of the first network function unit according to the traffic flow of the first network function unit, and after the first network function unit and the second network function unit have shared all resources within the gateway, gradually eases the restriction on the traffic flow of the first network function unit according to the resource utilization rate of the second network function unit. [Effects of the Invention]

[0010] According to the present invention, when communications with different quality requirements are mixed within a VPN gateway, it is possible to effectively utilize resources while eliminating the impact of communications with lower quality requirements on communications with higher quality requirements. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 shows an example of a VPN gateway configuration. [Figure 2] Figure 2 is a diagram illustrating the flow of the control process according to the embodiment. [Figure 3] Figure 3 is a diagram illustrating the flow of the control process according to the embodiment. [Figure 4] Figure 4 is a block diagram showing an example of the configuration of a VPN GW according to an embodiment. [Figure 5] Figure 5 is a flowchart showing the processing procedure of the control process according to the embodiment. [Figure 6] Figure 6 is a flowchart showing the processing procedure of the control process according to the embodiment. [Figure 7] Figure 7 shows an example of a computer where a VPN gateway is realized when a program is executed. [Figure 8] Figure 8 is a diagram illustrating existing technologies. [Figure 9] Figure 9 is a diagram illustrating existing technology. [Figure 10] Figure 10 is a diagram illustrating existing technology. [Modes for carrying out the invention]

[0012] Embodiments of the gateway, control method, and control program according to the present invention will be described in detail below with reference to the drawings. Furthermore, the present invention is not limited to the embodiments described below.

[0013] [Embodiment] First, let's describe the embodiment. This embodiment assumes that communications with different quality requirements are mixed within the VPN GW. Figure 1 shows an example of the VPN GW configuration.

[0014] As shown in Figure 1, the embodiment assumes a VPN GW10 for a VPN service implemented by combining function-specific containers. The VPN GW10 according to the embodiment is allocated a predetermined number of compute resources, such as a CPU (Central Processing Unit), based on requests from each VPN user (corporation, etc.), and function-specific containers are placed inside based on requests from VPN users.

[0015] For example, as containers, there are container 11C equipped with a NAT (Network Address Translator) / FW (Fire Wall) function applicable only to communication with the Internet for security purposes, and container 13C equipped with a function for terminating a VPN (tunnel) connected to a user base.

[0016] In VPN GW10, communications with different quality requirements, such as high-priority communications and low-priority communications, coexist.

[0017] In the embodiment, when communications with different quality requirements coexist in VPN GW10, the following first and second quality controls are realized by allocating computing resources such as a CPU to achieve the following.

[0018] The first quality control is to eliminate the influence of high-priority communications on low-priority communications (such as best-effort communications, low-priority communications). The second quality control is to transfer as much low-priority communication as possible to effectively utilize the transfer processing capacity of VPN GW10 when there is a margin in the processing performance of VPN GW10.

[0019] In the embodiment, by performing the processes of FIGS. 2 and 3, the allocation of resources such as a CPU available to the transfer system is controlled, so that while eliminating the influence of low-priority communications on high-priority communications, effective utilization of resources is made possible.

[0020] FIGS. 2 and 3 are diagrams for explaining the flow of control processing according to the embodiment. First, the default state will be described. In the default state shown in (A) of FIG. 2, VPN GW10 normally shares all resources among the containers (in (1) of FIG. 2), and enables the processing of each communication by using the maximum resources.

[0021] When some resources become heavily loaded, VPN GW10 transitions from its default state to a high-load state (Figure 2(2)). Specifically, when resource utilization is heavily loaded, it separates the resources used for high-priority and low-priority communications (Figure 2(3)), allocating minimal resources to containers through which low-priority communications pass, and allocating the remainder to containers through which high-priority communications pass. This ensures that VPN GW10 can reliably process high-priority communications.

[0022] As shown in Figure 3, VPN GW10 confirms that the resource utilization of high-priority communication is low and transitions from the high-load state to the default state (Figure 3 (4)).

[0023] In this process, VPN GW10 measures the amount of low-priority traffic that is forwarded to the resource allocation state under high load. Then, VPN GW10 limits the inflow of low-priority traffic according to the measured amount and returns the resource allocation to the default state where all resources are shared by each container (Figure 3 (5)).

[0024] For example, in resource allocation under high load (Figure 3(B)), if the output traffic volume of the NAT / FW function container is 10Mbps, VPN GW10 will, upon deactivation (Figure 3(C)), limit the amount of traffic that can flow into the NAT / FW function container to 10Mbps before restoring the resource allocation. Here, the amount of traffic that can be forwarded relative to the resource volume allocated to the container varies depending on the packet size of the traffic flowing through it. Therefore, if the restriction is based on short packets that consume a lot of resources, it would be an overrestriction. Instead, a method is adopted to limit the traffic volume based on the actual measured traffic volume.

[0025] VPN GW10 monitors resource usage and gradually eases the inflow limit for low-priority traffic (Figure 3 (6)), returning to the default state without excessively restricting low-priority traffic or affecting the forwarding process of high-priority traffic. For example, VPN GW10 gradually eases the 10Mbps limit to 20Mbps, then 30Mbps, while confirming that there is no surge in CPU usage, until the limit is equal to the interface speed.

[0026] [VPN GW] Next, the configuration of the VPN GW10 according to the embodiment will be described. Figure 4 is a block diagram showing an example of the configuration of the VPN GW10 according to the embodiment.

[0027] As shown in Figure 4, the VPN GW10 according to the embodiment includes a container-based low-priority communication utilization NW function unit 11 (first network function unit), a high-priority communication utilization NW function unit 12 (second network function unit), and a high-priority / low-priority communication utilization NW function unit 13 (second network function unit), as well as a resource monitoring unit 14 (monitoring unit), a flow rate measurement unit 15 (measurement unit), a flow rate limit setting unit 16 (setting unit), a resource allocation unit 17 (allocation unit), and a control determination unit 18 (control unit).

[0028] For example, VPN GW10 is implemented when a predetermined program is loaded into a computer, such as a computer containing ROM (Read Only Memory), RAM (Random Access Memory), and a CPU, and the CPU executes the predetermined program. VPN GW10 also has a communication interface for sending and receiving various types of information with other devices connected via a network.

[0029] The low-priority communication network function unit 11 is a container equipped with functions applicable to communications with low quality requirements, for example, a container equipped with NAT / FW functions that are applied only to communications with the internet for security purposes. The high-priority communication network function unit 12 is a container equipped with functions applicable to communications with high quality requirements. The high-priority / low-priority communication network function unit 13 is a container with functions applicable to communications with low quality requirements and communications with high quality requirements, for example, a container equipped with a function to terminate VPNs (tunnels) connecting to user sites.

[0030] The resource monitoring unit 14 monitors the resource usage of CPUs and other resources within the VPN GW 10. If the resource usage of any of the CPUs or other resources exceeds a predetermined threshold, the resource monitoring unit 14 notifies the control determination unit 18 (described later) of an overload alert. The resource monitoring unit 14 also returns the resource usage of the low-priority communication NW function unit 11, the high-priority communication NW function unit 12, and / or the high-priority / low-priority communication NW function unit 13 (hereinafter collectively referred to as the NW function unit) as requested by the control determination unit 18.

[0031] The flow rate measurement unit 15 measures the flow rate of traffic passing through each network function unit. The flow rate measurement unit 15 returns the flow rate of traffic for the network function unit that was inquired about by the control determination unit 18.

[0032] The flow rate limit setting unit 16, in accordance with instructions from the control determination unit 18, applies a setting to the specified NW function unit to limit the traffic flow to the specified limit value, based on the NW function unit and limit value included in the instructions.

[0033] The resource allocation unit 17, in accordance with the instructions from the control determination unit 18, sets a configuration to allocate the specified amount of resources to the specified network function unit, based on the network function unit and resource amount included in the instructions.

[0034] The control determination unit 18 controls the VPN GW 10, including resource allocation, traffic flow measurement, and traffic flow limiting, by controlling the resource monitoring unit 14, the flow rate measurement unit 15, the flow rate limit setting unit 16, and the resource allocation unit 17.

[0035] The control determination unit 18 controls the system to either the default state or a high-load state where resource utilization is high. In the default state, the control determination unit 18 allows all resources to be shared among the containers (low-priority communication network function unit 11, high-priority communication network function unit 12, and high-priority / low-priority communication network function unit 13).

[0036] In a high-load state, the control determination unit 18 separates the resources used by the high-priority communication utilization NW function unit 12 and the high-priority / low-priority communication utilization NW function unit 13 from the resources used by the low-priority communication utilization NW function unit 11, and allocates the minimum necessary resources to the containers that the low-priority communication utilization NW function unit 11 passes through.

[0037] Subsequently, when transitioning from a high-load state to the default state, the control determination unit 18 restricts the inflow of low-priority communications according to the traffic volume of low-priority communications, shares resources among each container as in the default state, and gradually eases the inflow restriction of low-priority communications while monitoring resource utilization.

[0038] In other words, when transitioning from a high-load state to the default state, the control determination unit 18 limits the traffic flow of the low-priority communication network function unit 11 according to the traffic flow of the low-priority communication network function unit 11. At the same time, the control determination unit 18 makes the low-priority communication network function unit 11, the high-priority communication network function unit 12, and the high-priority / low-priority communication network function unit 13 share all resources within the VPN GW 10. Subsequently, the control determination unit 18 gradually eases the restriction on the traffic flow of the low-priority communication network function unit 11 according to the resource utilization rate of the high-priority communication network function unit 12 and the high-priority / low-priority communication network function unit 13.

[0039] [Control determination process] Next, resource allocation and traffic flow limiting processes executed by the control determination unit 18 will be described as control processes according to the embodiment. Figures 5 and 6 are flowcharts showing the processing procedure of the control processes according to the embodiment.

[0040] First, we assume that the initial state is the default state. As shown in Figure 5, when the control determination unit 18 receives an overload alert from the resource monitoring unit 14 (step S1), it determines that a high load state is in place (step S2) and performs resource allocation in the high load state.

[0041] Specifically, the control determination unit 18 instructs the resource allocation unit 17 to minimize the resources allocated to the low-priority communication utilization NW function unit 11 (step S3). The control determination unit 18 instructs the resource allocation unit 17 to allocate all resources other than those allocated to the low-priority communication utilization NW function unit 11 to the other NW function units (high-priority communication utilization NW function unit 12 and high-priority / low-priority communication utilization NW function unit 13) (step S4).

[0042] The control determination unit 18 queries the resource monitoring unit 14 for and obtains the resource utilization rates of the high-priority communication utilization NW function unit 12 and the high-priority / low-priority communication utilization NW function unit 13 (step S5).

[0043] The control determination unit 18 determines whether the resource utilization rate obtained in step S5 is below a predetermined threshold (step S6). If the resource utilization rate obtained in step S5 is not below the predetermined threshold (step S6: No), the control determination unit 18 waits for a certain period of time (step S7) and returns to step S5.

[0044] The control determination unit 18 determines the transition from a high-load state to a default state if the resource utilization rate obtained in step S5 is below a predetermined threshold (step S6: Yes). The control determination unit 18 then obtains the measured value of the traffic flow rate through the low-priority communication utilization NW function unit 11 from the flow rate measurement unit 15 (step S8).

[0045] The control determination unit 18 issues an instruction to the flow rate limit setting unit 16 to limit the traffic flow rate in the low-priority communication utilization NW function unit 11 to the measurement value obtained in step S7 (step S9).

[0046] Next, the control determination unit 18 instructs the resource allocation unit 17 to share the allocated resources in all NW function units (low-priority communication utilization NW function unit 11, high-priority communication utilization NW function unit 12, and high-priority / low-priority communication utilization NW function unit 13) among all resources (step S10).

[0047] Then, as shown in Figure 6, the control determination unit 18 obtains the resource utilization rates of the high-priority communication utilization NW function unit 12 and the high-priority / low-priority communication utilization NW function unit 13 from the resource monitoring unit 14 (step S11).

[0048] The control determination unit 18 determines whether the resource utilization rate obtained in step S11 is below a predetermined threshold (step S12). If the resource utilization rate obtained in step S11 is not below the predetermined threshold (step S12: No), the control determination unit 18 waits for a certain period of time (step S13) and returns to step S11.

[0049] If the resource utilization rate obtained in step S11 is below a predetermined threshold (step S12: Yes), the control determination unit 18 issues an instruction to the flow rate limit setting unit 16 to limit the traffic flow to a new limit value that is a certain amount increased from the limit value set in the low-priority communication utilization NW function unit 11 (step S14).

[0050] The control determination unit 18 causes the resource monitoring unit 14 to acquire the resource utilization rates of the high-priority communication utilization NW function unit 12 and the high-priority / low-priority communication utilization NW function unit 13 (step S15).

[0051] The control determination unit 18 determines whether the resource utilization rate obtained in step S14 is below a predetermined threshold (step S16).

[0052] The following describes the case where the resource utilization rate obtained in step S15 is not below a predetermined threshold (step S16: No), that is, the case where the resource utilization rate obtained in step S14 is greater than the predetermined threshold. In this case, the control determination unit 18 instructs the flow rate limit setting unit 16 to limit the traffic flow rate in the low-priority communication utilization NW function unit 11 to a new limit value obtained by reducing the set limit value by a certain amount (step S17). The control determination unit 18 further limits the traffic flow rate in the low-priority communication utilization NW function unit 11 to ensure sufficient resources for the high-priority communication utilization NW function unit 12 and the high-priority / low-priority communication utilization NW function unit 13. The control determination unit 18 waits for a certain period of time (step S18) and returns to step S15.

[0053] If the resource utilization rate obtained in step S15 is below a predetermined threshold (step S16: Yes), the control determination unit 18 obtains the measured value of the traffic flow rate through the low-priority communication utilization NW function unit 11 from the flow rate measurement unit 15 (step S19).

[0054] The control determination unit 18 determines whether the measured value obtained in step S19 is smaller than the limit value (step S20).

[0055] If the measurement value obtained in step S19 is not smaller than the limit value (step S20: No), the control determination unit 18 returns to step S14.

[0056] If the measurement value obtained in step S19 is smaller than the limit value (step S20: Yes), the control determination unit 18 instructs the flow rate limit setting unit 16 to release the traffic flow limit in the low-priority communication utilization NW function unit 11 (step S21), and returns to the default state. In this way, the control determination unit 18 monitors resource usage and gradually relaxes the flow rate limit of the low-priority communication utilization NW function unit 11, thereby returning to the default state without excessively restricting low-priority communication and without affecting the forwarding process of high-priority communication.

[0057] [Examples of application] An example of the application of the embodiment will be described with reference to Figures 1 to 3.

[0058] This application example targets VPN GW10, which is provided to any VPN user. As illustrated in Figure 1, VPN GW10 is equipped with a container that has VPN termination and NAT / FW functions.

[0059] VPN GW10 connects to cloud services used by VPN users, via the VPN termination function container. GPN GW10 connects to the internet and via the NAT / FW function of the VPN termination function container.

[0060] Communication between the cloud and user sites has a different forwarding priority than communication between the internet and user sites. For example, communication between the cloud and user sites requires forwarding with as little packet loss as possible, while communication between the internet and user sites does not require quality assurance. Hereafter, communication between the cloud and user sites will be referred to as high-quality communication, and communication between the internet and user sites as low-quality communication.

[0061] As illustrated in Figure 2(A) for the CPU, VPN GW10 is configured by default to allow each container to share and utilize the compute resources, such as the CPU, that VPN GW10 possesses.

[0062] Suppose the volume of low-quality traffic increases from the default state. Due to the processing of low-quality traffic, the resource utilization within VPN GW10 increases, and the resource monitoring unit 14 detects that it has exceeded a threshold (e.g., 90% or more) and issues an overload alert to the control determination unit 18.

[0063] Upon receiving an overload alert, the control determination unit 18 determines that a high load condition exists and issues the following instructions: The control determination unit 18 instructs the resource allocation unit 17 to minimize the resources allocated to the NAT / FW function container used by low-priority communication (for example, allocating only one CPU). Then, the control determination unit 18 instructs the resource allocation unit 17 to allocate all resources other than those allocated above to the VPN termination function container (Figure 2(B)).

[0064] The control determination unit 18 obtains the resource utilization rate of the VPN termination function container used by high-priority communication from the resource monitoring unit 14. Here, let's assume that this resource utilization rate is below a certain threshold, for example, 20% or less.

[0065] The control determination unit 18 obtains a measured value of the traffic flow rate through the NAT / FW function container from the flow rate measurement unit 15. Here, let's assume the measured value is 10 Mbps. The control determination unit 18 issues an instruction to the flow rate limit setting unit 16 to limit the traffic flow rate in the NAT / FW function container to this measured value of 10 Mbps.

[0066] To disable this setting, the control determination unit 18 instructs the resource allocation unit 17 to share the allocated resources between all VPN termination function containers and NAT / FW function containers.

[0067] The control determination unit 18 obtains the resource utilization rate of the VPN termination function container from the resource monitoring unit 14. Let's assume that this resource utilization rate is below a certain threshold, for example, 20% or less. The control determination unit 18 instructs the traffic flow limit setting unit 16 to set a new limit value for the NAT / FW function container, which is an increase of a certain amount from the previously set traffic flow limit value of 10Mbps, in this case an increase of 10Mbps to 20Mbps.

[0068] The control determination unit 18 obtains the resource utilization rate of the VPN termination function container from the resource monitoring unit 14. Here, let's assume that this resource utilization rate is below a certain threshold, for example, 20% or less.

[0069] The control determination unit 18 obtains a measured value of the traffic flow rate through the low-priority communication utilization NW function unit 11 from the flow rate measurement unit 15. If this measured value is approximately the same as the limit value of 20 Mbps, the control determination unit 18 again instructs the flow rate limit setting unit 16 to set a new limit value that is a certain amount increased from the previously set traffic flow rate limit value of 20 Mbps in the NAT / FW function container, in this case an increase of 10 Mbps to limit it to 30 Mbps.

[0070] Subsequently, the control determination unit 18, while confirming that the resource utilization rate is below a threshold (for example, 20%), increases the traffic flow limit by a certain amount until the traffic flow of low-priority communication becomes sufficiently smaller than the limit value.

[0071] After the traffic flow rate of low-priority communication becomes sufficiently smaller than the limit value, the control determination unit 18 instructs the traffic flow limit setting unit 16 to release the traffic flow limit in the low-priority communication utilization NW function unit. With these operations, the VPN GW 10 returns to its default state.

[0072] [Effects of the embodiment] In this embodiment, the VPN GW10, which is composed of predetermined compute resources such as a CPU and function-specific containers, achieves the following when high-priority and low-priority communications are mixed.

[0073] First, when resource utilization becomes high, VPN GW10 separates the resources used by high-priority and low-priority communications. It allocates minimal resources to containers through which low-priority communications pass, and the remainder to containers through which high-priority communications pass, thereby eliminating the impact of low-priority communications on the forwarding process of high-priority communications.

[0074] Furthermore, while achieving the above, VPN GW10 will, when it has available resources, forward as many low-priority communications as possible in order to effectively utilize its forwarding processing capacity.

[0075] By default, VPN GW10 allows each container to share all resources, enabling it to process each communication using the maximum possible resources.

[0076] Furthermore, under high load resource allocation conditions, VPN GW10 measures the amount of low-priority traffic being forwarded and limits the inflow of low-priority traffic according to that measured amount, while sharing resources in the same way as the default setting.

[0077] Furthermore, during the process of returning from a high-load state to the default state, VPN GW10 monitors resource usage and gradually removes the inflow limit for low-priority traffic, thereby forwarding traffic without affecting the forwarding process of high-priority traffic and without excessively restricting low-priority traffic.

[0078] Thus, according to the VPN GW10 of this embodiment, when communications with different quality requirements are mixed within the VPN GW, it is possible to effectively utilize resources while eliminating the impact of communications with lower quality requirements on communications with higher quality requirements. In other words, according to the VPN GW10 of this embodiment, it is possible to effectively utilize resources while reducing the problem of resources being consumed by low-priority communications and making it impossible to ensure the quality of high-priority communications.

[0079] [Regarding the system configuration of the embodiment] Each component of the VPN GW10 shown in Figure 4 is a functional concept and does not necessarily have to be physically configured as shown. In other words, the specific forms of distribution and integration of the functions of the VPN GW10 are not limited to those shown in the figure, and all or part of it can be configured by functionally or physically distributing or integrating it in any unit depending on various loads and usage conditions.

[0080] Furthermore, each process performed in VPN GW10 may be implemented entirely or partially by the CPU and a program that is analyzed and executed by the CPU. Alternatively, each process performed in VPN GW10 may be implemented as hardware using wired logic.

[0081] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated may be changed as appropriate unless otherwise specified.

[0082] [program] Figure 7 shows an example of a computer in which VPN GW10 is implemented when a program is executed. Computer 1000 has, for example, memory 1010 and CPU 1020. Computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0083] Memory 1010 includes ROM 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as the BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, the mouse 1110 and the keyboard 1120. The video adapter 1060 is connected to, for example, the display 1130.

[0084] The hard disk drive 1090 stores, for example, the OS (Operating System) 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs defining each process of the VPN GW10 are implemented as program modules 1093 containing code executable by the computer 1000. The program modules 1093 are stored, for example, on the hard disk drive 1090. For example, a program module 1093 for performing processes similar to those in the VPN GW10's functional configuration is stored on the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0085] Furthermore, the configuration data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes them.

[0086] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070.

[0087] Although embodiments applying the invention made by the present inventors have been described above, the present invention is not limited by the descriptions and drawings that constitute part of the disclosure of the present invention in this embodiment. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention. [Explanation of Symbols]

[0088] 10 VPN GW 11. Low-priority communication utilization network function section 12. High-priority communication utilization NW function section 13 High-priority / low-priority communication usage NW functional unit 14 Resource Monitoring Department 15 Flow measurement section 16 Flow rate limit setting section 17 Resource Allocation Section 18 Control and determination unit

Claims

1. A gateway for virtual private network services, A first network function unit that enables communication between networks that meet predetermined quality requirements, A second network function unit enables communication between networks with higher quality requirements than the first network function unit, A monitoring unit that monitors resources within the gateway, A measurement unit for measuring the traffic flow rate of the first network function unit, A setting unit for setting limits on the traffic flow rate of the first network function unit, An allocation unit that allocates the instructed amount of resources to the first network function unit and / or the second network function unit, A control unit controls the monitoring unit, the measurement unit, the setting unit, and the allocation unit to control the system to either a default state in which the first network function unit and the second network function unit share all resources, or a high-load state in which the first network function unit and the second network function unit separate resources, and when transitioning from the high-load state to the default state, limits the traffic flow of the first network function unit according to the traffic flow of the first network function unit, and after the first network function unit and the second network function unit share all resources within the gateway, gradually relaxes the restriction on the traffic flow of the first network function unit according to the resource utilization rate of the second network function unit. A gateway characterized by having the following features.

2. The gateway according to claim 1, characterized in that the control unit determines a transition from the high-load state to the default state when the resource utilization rate of the second network function unit is below a predetermined threshold, obtains a first measured value of the traffic flow rate of the first network function unit, limits the traffic flow rate of the first network function unit to the first measured value, and causes the first network function unit and the second network function unit to share all resources within the gateway.

3. The gateway according to claim 2, characterized in that the control unit, after allowing the first network function unit and the second network function unit to share all resources within the gateway, limits the traffic flow rate of the first network function unit to a value obtained by increasing the limit value of the traffic flow rate of the first network function unit by a certain amount if the resource utilization rate of the second network function unit is below a predetermined threshold.

4. The gateway according to claim 3, characterized in that the control unit limits the traffic flow rate of the first network function unit to a value obtained by increasing the limit value of the traffic flow rate of the first network function unit by a certain amount, and then, if the resource utilization rate of the second network function unit is greater than a predetermined threshold, limits the traffic flow rate of the first network function unit to a new value obtained by decreasing the limit value of the traffic flow rate of the first network function unit by a certain amount.

5. The gateway according to claim 3, wherein the control unit limits the traffic flow rate of the first network function unit to a value obtained by increasing the limit value of the traffic flow rate of the first network function unit by a certain amount, and then, when the resource utilization rate of the second network function unit is below a predetermined threshold and the measured value of the traffic flow rate of the first network function unit is smaller than the limit value, the control unit releases the limit on the traffic flow rate of the first network function unit.

6. A control method performed by a gateway for a virtual private network service, The gateway includes a first network function unit that enables communication between networks meeting predetermined quality requirements, and a second network function unit that enables communication between networks meeting higher quality requirements than the first network function unit. The process of monitoring resources within the gateway, The process involves measuring the traffic flow rate of the first network function unit, A step of controlling the system to either a default state in which the first network function unit and the second network function unit share all resources, or a high-load state in which the first network function unit and the second network function unit separate resources, When transitioning from the high-load state to the default state, the process involves limiting the traffic inflow to the first network function unit, and after the first network function unit and the second network function unit share all resources within the gateway, gradually easing the restriction on the traffic inflow to the first network function unit according to the resource utilization rate of the second network function unit. A control method characterized by including

7. Steps to monitor resources within the gateway, The steps include measuring the traffic flow rate of a first network function unit within the gateway that enables communication between networks meeting predetermined quality requirements, A step of controlling the system to either a default state in which the first network function unit and the second network function unit within the gateway, which enables communication between networks with higher quality requirements than the first network function unit, share all resources, or a high-load state in which the first network function unit and the second network function unit separate resources. When transitioning from the high-load state to the default state, the traffic inflow into the first network function unit is limited, and after the first network function unit and the second network function unit share all resources within the gateway, the restriction on the traffic inflow into the first network function unit is gradually eased according to the resource utilization rate of the second network function unit. A control program that causes a computer to execute something.

Images