Apparatus and method for configuring dynamic network by using software-defined network

Abstract

A software-defined network (SDN) controller in a campus network environment for a dynamic virtual local area network (VLAN) is provided. The SDN controller may comprise: a transceiver including a communication circuit; a processor including a processing circuit; and a memory including a storage medium in which instructions are stored, wherein, when executed by the processor, the instructions can instruct the SDN controller to: receive, from an SDN switch, through the transceiver, an authentication request for a terminal connected to the SDN switch; respond to the success of authentication of the terminal in response to the authentication request; identify a VLAN; and transmit a VLAN configuration to the SDN switch through the at least one transceiver such that an uplink port of the SDN switch operates according to the VLAN corresponding to the terminal. The uplink port of the SDN switch can be used to connect with other SDN switches, routers or servers. The VLAN configuration can be used to configure the uplink port so that an Ethernet frame for the VLAN corresponding to the terminal passes therethrough.

Description

Device and method for dynamic network configuration using a software-defined network

[0001] The present disclosure relates to a software defined network (SDN), and more specifically, to an apparatus and method for dynamic network configuration using SDN.

[0002] Dynamic VLANs (Virtual Local Area Networks) are utilized as a technology for dynamic network configuration. According to dynamic VLANs, even if a user moves, a VLAN for that user can be configured on the port they are connected to through an authentication process. Through dynamic VLANs, the same policy for a user can be applied across various locations (e.g., buildings, corporate or university campuses).

[0003] The information described above may be provided as related art for the purpose of aiding understanding of the present disclosure. No claim or determination is made as to whether any of the foregoing may be applied as prior art related to the present disclosure.

[0004] According to embodiments of the present disclosure, a software defined network (SDN) controller is provided in a campus network environment for a dynamic virtual local area network (VLAN). The SDN controller may include at least one transceiver comprising a communication circuit; at least one processor comprising a processing circuit; and a memory comprising one or more storage media for storing instructions. When the instructions are executed collectively or individually by the at least one processor, the SDN controller may receive an authentication request from an SDN switch for a terminal connected to the SDN switch via the at least one transceiver, and in response to the success of the authentication of the terminal according to the authentication request, identify a VLAN corresponding to the terminal and cause the SDN switch to transmit a VLAN configuration via the at least one transceiver so that the uplink port of the SDN switch operates according to the VLAN corresponding to the terminal. The uplink port of the SDN switch may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment. The above VLAN setting can be used to configure the uplink port to pass Ethernet frames for the VLAN corresponding to the terminal.

[0005] According to embodiments of the present disclosure, a software defined network (SDN) switch is provided in a campus network environment for a dynamic virtual local area network (VLAN). The SDN switch may include at least one transceiver comprising a communication circuit; at least one processor comprising a processing circuit; and a memory comprising one or more storage media for storing instructions. When the instructions are executed collectively or individually by the at least one processor, the SDN switch transmits an authentication request for the terminal to an SDN controller via the at least one transceiver in response to the SDN switch detecting that a terminal is connected to the SDN switch, and if the authentication for the terminal is successful, causes the SDN controller to receive a VLAN configuration from the at least one transceiver. The VLAN configuration may be used to configure the uplink port of the SDN switch to pass an Ethernet frame for the VLAN corresponding to the terminal. The uplink port of the above SDN switch can be used to connect to one or more other SDN switches, routers, or servers within the campus network environment.

[0006] According to embodiments of the present disclosure, a method is provided to be performed by a software defined network (SDN) controller in a campus network environment for a dynamic virtual local area network (VLAN). The method may include receiving an authentication request from an SDN switch for a terminal connected to the SDN switch, identifying a VLAN corresponding to the terminal in response to the success of the authentication of the terminal according to the authentication request, and transmitting a VLAN configuration to the SDN switch so that the uplink port of the SDN switch operates according to the VLAN corresponding to the terminal. The uplink port of the SDN switch may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment. The VLAN configuration may be used to configure the uplink port to pass Ethernet frames for the VLAN corresponding to the terminal.

[0007] According to embodiments of the present disclosure, a method is provided to be performed by a software defined network (SDN) switch in a campus network environment for a dynamic virtual local area network (VLAN). The method may include transmitting an authentication request for said terminal to an SDN controller in response to detecting that a terminal is connected to said SDN switch, and receiving a VLAN configuration from said SDN controller if the authentication of said terminal is successful. The VLAN configuration may be used to configure an uplink port of said SDN switch to pass an Ethernet frame for a VLAN corresponding to said terminal. The uplink port of said SDN switch may be used to connect to one or more other SDN switches, routers, or servers within said campus network environment.

[0008] Figure 1 shows an example of a campus network environment using a software defined network (SDN).

[0009] Figure 2 shows an example of a campus network environment using SDN.

[0010] Figure 3 shows the functional components of an SDN switch.

[0011] Figure 4 shows the functional components of the SDN controller.

[0012] Figure 5 shows the signal flow for configuring the uplink port of an SDN switch according to the VLAN (virtual local area network) corresponding to the terminal.

[0013] Figure 6 shows the components of an SDN controller and an SDN switch for configuring the uplink port of an SDN switch according to the VLAN corresponding to the terminal.

[0014] Figure 7 shows the signal flow for configuring the uplink port of the SDN switch according to the disconnection of the terminal.

[0015] Figure 8 shows the components of an SDN controller and an SDN switch for configuring the uplink port of an SDN switch according to the disconnection of a terminal.

[0016] The terms used in this disclosure are used merely to describe specific embodiments and are not intended to limit the scope of other embodiments. A singular expression may include a plural expression unless the context clearly indicates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as generally understood by those skilled in the art described in this disclosure. Terms used in this disclosure that are defined in a general dictionary may be interpreted as having the same or similar meaning as they have in the context of the relevant technology, and are not to be interpreted in an ideal or overly formal sense unless explicitly defined in this disclosure. In some cases, even terms defined in this disclosure are not to be interpreted to exclude the embodiments of this disclosure.

[0017] In the various embodiments of the present disclosure described below, a hardware-based approach is described as an example. However, since the various embodiments of the present disclosure include techniques using both hardware and software, the various embodiments of the present disclosure do not exclude a software-based approach.

[0018] Terms used in the following description to refer to signals (e.g., signal, information, message, signaling), data types (e.g., list, set, subset), operation states (e.g., step, operation, procedure), data (e.g., packet, user stream, information, bit, symbol, codeword), resources, channels, network entities, and device components are examples provided for the convenience of explanation. Accordingly, this disclosure is not limited to the terms described below, and other terms having equivalent technical meanings may be used. Additionally, terms such as '...part', '...device', '...object', and '...body' used below may refer to at least one structural form or a unit that processes a function.

[0019] Additionally, in this disclosure, expressions of "greater than" or "less than" may be used to determine whether a specific condition is satisfied or fulfilled; however, this is merely for the purpose of expressing an example and does not exclude descriptions of "greater than" or "less than." Conditions described as "greater than" may be replaced with "greater than," conditions described as "less than" may be replaced with "less than," and conditions described as "greater than and less than" may be replaced with "greater than and less than." Furthermore, "A" to "B" below refer to at least one of elements from A (including A) to B (including B). Below, "C" and / or "D" refers to including at least one of "C" or "D," i.e., {"C", "D", "C" and "D"}.

[0020] This disclosure describes various embodiments using terms used in some communication standards (e.g., 3GPP (3rd Generation Partnership Project), ETSI (European Telecommunications Standards Institute), ONF (Open Networking Foundation), IETF (Internet Engineering Task Force), IEEE (Institute of Electrical and Electronics Engineers), but these are merely illustrative examples. Various embodiments of this disclosure can be easily modified and applied to other communication systems.

[0021] In the embodiments of the present disclosure, technology for controlling network access to user terminals is described when applying a software defined network (SDN) to a campus network, such as a corporate or public institution (e.g., a campus area network, CAN). Components for SDN and dynamic VLANs (virtual local area networks) in a campus network environment are described through FIGS. 1 and 2.

[0022] Figure 1 illustrates an example of a campus network environment utilizing a software-defined network (SDN). SDN represents a network architecture for controlling and managing a network through software. The SDN can be used to move away from hardware-centric network architectures and to provide more flexible and centralized control. The network architecture may include a control plane and a data plane. The control plane is responsible for determining the flow of network traffic (e.g., data) and generating rules, while the data plane is responsible for delivering network traffic (e.g., data). In hardware-centric network architectures, the control plane and the data plane coexist within individual network devices (e.g., switches, routers), but in SDN, the control plane and the data plane can be separated.

[0023] Referring to FIG. 1, a campus network environment (100) may utilize SDN. The campus network environment (100) utilizing SDN may include an SDN controller (130) for the control plane (100a) and an SDN switch (120) for the data plane (100b). The SDN switch (120) may be configured to perform data processing according to a policy received from the SDN controller (130). Since the SDN switch (120) performs only data processing in the data plane (100b), it may be designed to be relatively simpler than equipment equipped with both a control plane and a data plane. The SDN controller (130) may be configured to centrally control the SDN switch (120). The SDN controller (130) can collect the state of the network and efficiently control the network. As individual network equipment (e.g., SDN switch (120)) is configured to be programmable, the SDN controller (130) can easily apply new technologies or policies to the network (e.g., entities of the campus network environment (100)). For example, the campus network environment (100) may include the SDN controller (130) and a number of SDN switches connected to the SDN controller (130) (e.g., a first SDN switch (121), a second SDN switch (122), a third SDN switch (123), a fourth SDN switch (124), a fifth SDN switch (125), a sixth SDN switch (126), and a seventh SDN switch (127)).

[0024] An SDN switch (120) according to embodiments of the present disclosure may be configured to provide a local area network (LAN) environment. The SDN switch (120) may provide an Ethernet port. The SDN switch (120) may be connected to a terminal (110) in the LAN environment through the Ethernet port. The terminal (110) represents a user device that can be connected to a campus network environment (100). A device that can be connected to an access point that supports a wired connection such as Ethernet or provides a wireless access network via Ethernet may correspond to the terminal (110). For example, the terminal (110) may include a laptop (111) connected to a user port of the first SDN switch (121). For example, the terminal (110) may include an access point (112) connected to a user port of the sixth SDN switch (126). As an example, but not limited to, the terminal (110) may include a mobile device (114) connected to the wireless access network of the access point (112). For example, the terminal (110) may include a desktop (113) connected to a user port of the fourth SDN switch (124). In addition to the above examples, the terminal (110) may include at least one of a personal data assistant (PDA), a server, a workstation, a smart TV, a medical device, an internet protocol (IP) camera, a speaker, a VoIP phone, a printer, a multifunction printer, and / or an equivalent technical device.

[0025] A campus network environment (100) may represent an internet environment that provides a campus area network (CAN). An operator of the campus network environment (100) (e.g., a public institution, a university, or a company) may provide internet access to authenticated users. Multiple buildings and spaces, such as a campus of a public institution or university, or a corporate complex, may be grouped into a single zone (e.g., a campus). Within the zone, network infrastructure including wired networks and / or wireless networks may be provided. In the campus network environment (100), access control or the application of communication policies (e.g., internet usage, QoS) for users may be required for security purposes. A virtual local area access network (VLAN) may be used for communication policies for users. To apply communication policies, VLAN configuration is required on the SDN switch (120) of the campus network environment (100). For example, according to the IEEE 802.1Q standard, a VLAN may be used for the campus network environment (100). The SDN switch (120) can configure VLANs by adding a VLAN header to the packet.

[0026] An SDN switch (120) according to embodiments of the present disclosure may provide VLANs. Although the switch and the cable are physically connected by a single path, traffic through the switch and the cable may be logically separated into multiple networks. For example, multiple VLANs may be configured on the SDN switch (120). Traffic may be separated into multiple VLANs. Each traffic may be distinguished by a VLAN ID (e.g., 0 to 4095). Through logically separated networks, security policies may be applied by service or by user group, and the quality of service (QoS) may be granular. To support VLANs, a static VLAN for manually assigning a VLAN ID to a port of the SDN switch (120) or a dynamic VLAN for automatically assigning a VLAN based on user authentication may be used.

[0027] According to embodiments of the present disclosure, dynamic VLANs can be used for a campus network environment (100). In the case of static VLANs, a network administrator can pre-configure all VLANs on an SDN switch (120) and apply policies according to the ports of the SDN switch (120). In this case, when a user's seat is changed or a policy is changed, the network administrator is required to change the description of the VLAN every time. Instead of a static VLAN that permanently assigns a VLAN ID to a specific port of the SDN switch (120), a dynamic VLAN that utilizes an authentication procedure for users utilizing the campus network environment (100) can be used. A dynamic VLAN can be used to configure VLANs according to users connecting to the network (e.g., CAN) of the campus network environment (100). In the case of dynamic VLANs, according to the authentication (e.g., authentication according to the IEEE 802.1X standard) and policy control of the SDN controller (130), the SDN controller (130) can configure VLANs according to users on the SDN switch (120). Through dynamic VLANs, VLAN operation can be performed even when users change their positions or policies without manual configuration of the network manager's SDN switch (120).

[0028] Figure 2 shows an example of a campus network environment using SDN. The same reference numbers may be used for the same or similar descriptions.

[0029] Referring to FIG. 2, a campus network environment (100) may utilize SDN. The campus network environment (100) utilizing SDN may include an SDN controller (130) for the control plane (100a) and an SDN switch (120) for the data plane (100b). The SDN switch (120) may provide VLANs (e.g., VLANs according to the IEEE 802.1Q standard). Dynamic VLANs may be used to configure VLANs according to users connecting to the network (e.g., CAN) of the campus network environment (100). The SDN controller (130) may configure VLANs according to users in the SDN switch (120) based on the authentication (e.g., authentication according to the IEEE 802.1X standard) and policy control of the SDN controller (130).

[0030] A terminal (110) (e.g., a laptop (111)) can be connected to a user port of a first SDN switch (121). The first SDN switch (121) can provide a VLAN to the terminal (110). For example, when the first SDN switch (121) detects a connection of the laptop (111) to the user port, the first SDN switch (121) can send an authentication request for the laptop (111) to an SDN controller (130). The SDN controller (130) can perform an authentication procedure for the user of the laptop (111) (e.g., entering and verifying an ID (identifier) ​​and a PW (password). According to the authentication procedure, if the authentication of the user of the laptop (111) is successful, the SDN controller (130) can send a setting for the user's VLAN (e.g., a VLAN with VLAN ID 10) to the first SDN switch (121). Afterward, when the laptop (111) is disconnected from the user port and then reconnected, it can access a pre-configured VLAN (e.g., a VLAN with VLAN ID 10) without an additional authentication procedure.

[0031] A terminal (110) (e.g., a laptop (111)) can move. For example, the laptop (111) may be connected to the user port of the first SDN switch (121) and then move to another switch (e.g., a fifth SDN switch (125)) depending on the movement of the user of the laptop (111). The result of authentication for the user applies only to the user port of the first SDN switch (121). Therefore, for the user of the laptop (111) to use the campus network environment (100), it is required that communication from a specific switch to another SDN switch, router, and / or server be allowed. For example, the uplink port of the fifth SDN switch (125) (a port for communication from the SDN switch to another SDN switch, router, and / or server) is required to allow the transmission of packets of the VLAN configured on the laptop (111) (e.g., a VLAN with VLAN ID 10). In order to allow the transmission of the packets to the uplink port, a method of adding the VLAN(s) used in the campus network environment (100) to the uplink port in advance or a method of configuring the uplink port to allow communication for all VLANs may be used. However, in the case of the method of adding the VLANs to be used in advance, there is a problem that the configuration of the switch's uplink port must be changed again if the network policy is changed. In addition, in the case of the method of configuring the uplink port to allow communication for all VLANs, the performance of the SDN switch may be affected as the number of VLANs used increases. For example, as the number of VLANs used increases, a switch with better performance is required, so the cost of operating the network may increase.

[0032] According to embodiments of the present disclosure, a technique is described for configuring the uplink port of an SDN switch (120) (e.g., a fifth SDN switch (125)) to allow a VLAN corresponding to said terminal (110) (e.g., a laptop (111)) connected to a campus network to provide a VLAN. Instead of multiple VLANs being manually configured or pre-configured by a network administrator, the load on the SDN switch (120) can be reduced by automatically configuring the VLAN on the uplink port of the SDN switch (120) by the SDN controller (130). Furthermore, as only the necessary VLAN is assigned to the uplink port depending on the user connected to the SDN switch (120), a campus network environment can be provided to the user with low consumption costs when moving between SDN switches (e.g., moving from the first SDN switch (121) to the fifth SDN switch (125)). Hereinafter, through FIGS. 3 and FIGS. 4, the functional components of the SDN switch (120) and the SDN controller (130), respectively, are described.

[0033] Figure 3 shows the functional components of an SDN switch (e.g., an SDN switch (120)).

[0034] Referring to FIG. 3, the SDN switch (120) may include multiple ports for packet communication. For example, the SDN switch (120) may include a user port (301) used to connect to a user device accessible to the campus network environment (100). For example, the SDN switch (120) may include an uplink port (302) connected to a network. For example, the uplink port (302) of the SDN switch (120) may be used to connect to one or more other SDN switches, routers, or servers. For example, the user port (301) may be configured as an access port for a single VLAN or as a trunk port for multiple VLANs. For example, the uplink port (302) may be configured as a trunk port for multiple VLANs.

[0035] The SDN switch (120) may include a transceiver (310), a processor (320), and a memory (330). The transceiver (310) may perform functions for transmitting and receiving signals in a wired communication environment. For example, the transceiver (310) may support Ethernet communication. The transceiver (310) may include a wired interface for controlling a direct connection between devices through a transmission medium (e.g., copper wire, optical fiber). For example, the transceiver (310) may transmit electrical signals to another device through a copper wire or perform conversion between electrical signals and optical signals. According to one embodiment, the SDN switch (120) may communicate with a terminal (110) (e.g., laptop (111), access point (112), desktop (113)) connected to a user port (301) through the transceiver (310). According to one embodiment, the SDN switch (120) can communicate with other nodes (e.g., servers, other SDN switches, routers, servers) connected to the uplink port (302) via a transceiver (310). According to one embodiment, the SDN switch (120) can communicate with an SDN controller (130) via a transceiver (310). For example, the SDN switch (120) can receive policy information (e.g., a flow table for flow control based on VLAN ID) including forwarding rules (e.g., forwarding entries) and traffic processing methods from the SDN controller (130) via the transceiver (310). For example, the SDN switch (120) can receive control information (e.g., VLAN settings of the uplink port (302)) from the SDN controller (130) via the transceiver (310).

[0036] The transceiver (310) transmits and receives signals as described above. Accordingly, all or part of the transceiver (310) may be referred to as a 'communication unit', 'transmitter unit', 'receiver unit', or 'transmitter-receiver unit'. Furthermore, in the following description, transmission and reception performed via a wireless channel are used to mean that processing as described above is performed by the transceiver (310). Although only the transceiver (310) is shown in FIG. 3, according to other embodiments, the transceiver (310) may include two or more transceivers.

[0037] The processor (320) controls the overall operations of the SDN switch (120). The processor (320) may be referred to as a control unit. For example, the processor (320) transmits and receives signals through the transceiver (310). Additionally, the processor (320) writes and reads data to and from memory (330). Furthermore, the processor (320) can perform functions required by communication standards (e.g., authentication according to 802.1X, VLAN according to 802.1Q, Ethernet communication according to 802.3). The processor (320) may be configured to perform the functions of the SDN switch (120). According to one embodiment, the processor (320) may be configured to detect a user device (e.g., terminal (110)) connected to the user port (301). According to one embodiment, the processor (320) may be configured to obtain VLAN settings from the SDN controller (130). According to one embodiment, the processor (320) may be configured to provide a VLAN to a terminal (110) connected to a user port (301) according to a VLAN setting. According to one embodiment, the processor (320) may be configured to configure an uplink port (302) to pass an Ethernet frame having a specific VLAN according to a VLAN setting. According to one embodiment, the processor (320) may include an authentication processing unit (321). The authentication processing unit (321) may be configured to authenticate a device (e.g., terminal (110)) connected to the user port (301). The authentication processing unit (321) may be linked with an authentication server of an SDN controller (130). The authentication processing unit (321) may obtain user authentication information (e.g., MAC address, ID and PW information for accessing the campus network) from a device connected to the user port (301). The authentication processing unit (321) can perform the authentication procedure by transmitting the authentication information to the SDN controller (130).Based on identifying that the user of the device connected to the user port (301) through the authentication processing unit (321) is an authenticated user, the processor (320) may be configured to provide a VLAN corresponding to the user. Although only the processor (320) is shown in FIG. 3, according to other implementation examples, the SDN switch (120) may include two or more processors.

[0038] The memory (330) stores data such as basic programs, applications, and configuration information for the operation of the SDN switch (120). The memory (330) may be referred to as a storage unit. The memory (330) may be composed of volatile memory, non-volatile memory, or a combination of volatile and non-volatile memory. Additionally, the memory (330) may provide stored data upon request from the processor (320). As a functional component, the memory (330) represents a storage space. For example, the memory (330) may be understood not only as representing memory (e.g., hard disk, flash memory, RAM) placed as a component within the SDN switch (120), but also as representing a space for storing instructions and / or programs. According to one embodiment, the memory (330) may include a VLAN database (331). The VLAN database (331) may store user information (e.g., port information, ID, password, and VLAN information). The VLAN database (331) can be configured to output a VLAN corresponding to a user upon request from the processor (320).

[0039] The configuration of the SDN switch (120) illustrated in FIG. 3 is merely an example, and the examples of components of the electronic device for carrying out the embodiments of the present disclosure are not limited from the configuration illustrated in FIG. 3. In some embodiments, some configurations may be added, deleted, or changed. For example, FIG. 3 shows one uplink port and one user port, but the embodiments of the present disclosure are not limited thereto. For example, the SDN switch (120) may include a plurality of uplink ports. For example, the SDN switch (120) may include a plurality of user ports.

[0040] Figure 4 shows the functional components of an SDN controller (e.g., an SDN controller (130)).

[0041] Referring to FIG. 4, the SDN controller (130) may include a transceiver (410), a processor (420), and a memory (430). The transceiver (410) may perform functions for transmitting and receiving signals in a wired communication environment. The transceiver (410) may include a wired interface for controlling a direct connection between devices through a transmission medium (e.g., copper wire, optical fiber). For example, the transceiver (410) may transmit an electrical signal to another device through a copper wire or perform conversion between an electrical signal and an optical signal. The SDN controller (130) may be connected to an SDN switch (120) through the transceiver (410). For example, the SDN controller (130) may be connected to each of the first SDN switch (121), the second SDN switch (122), the third SDN switch (123), the fourth SDN switch (124), the fifth SDN switch (125), the sixth SDN switch (126), and the seventh SDN switch (127). According to one embodiment, the SDN controller (130) may receive an authentication request for a terminal from the SDN switch (120) via a transceiver (410). According to one embodiment, the SDN controller (130) may transmit policy information (e.g., forwarding rules (e.g., forwarding entries) and traffic processing methods) to each SDN switch via the transceiver (410). According to one embodiment, the SDN controller (130) can receive control information for each SDN switch (e.g., VLAN settings of the uplink port (302)) from each SDN switch through the transceiver (410).

[0042] The transceiver (410) transmits and receives signals as described above. Accordingly, all or part of the transceiver (410) may be referred to as a 'communication unit', 'transmitter unit', 'receiver unit', or 'transmitter-receiver unit'. Furthermore, in the following description, transmission and reception performed via a wireless channel are used to mean that processing as described above is performed by the transceiver (410). Although only the transceiver (410) is shown in FIG. 3, according to other embodiments, the transceiver (410) may include two or more transceivers.

[0043] The processor (420) controls the overall operations of the SDN controller (130). The processor (420) may be referred to as a control unit. For example, the processor (420) transmits and receives signals through the transceiver (410). Additionally, the processor (420) writes and reads data to and from memory (430). Furthermore, the processor (420) can perform functions required by communication standards (e.g., authentication according to 802.1X, VLAN according to 802.1Q, Ethernet communication according to 802.3). The processor (420) may be configured to perform the functions of the SDN controller (130). According to one embodiment, the processor (420) may be configured to perform the functions of an authentication server for a dynamic VLAN. The processor (420) can process authentication requests for terminals (110) obtained through the transceiver (410). For example, the processor (420) may include an authentication processing module for authenticating a user for a dynamic VLAN. The processor (420) may be configured to set a VLAN corresponding to the terminal (110) to the uplink port (e.g., uplink port (302)) of the SDN switch (120) in response to the success of authentication for the terminal (110). For example, the processor (420) may include a dynamic VLAN module for providing VLAN settings to the SDN switch (120) to which the user is connected. Although only the processor (420) is shown in FIG. 4, according to other implementation examples, the SDN controller (130) may include two or more processors.

[0044] Memory (430) stores data such as basic programs, applications, and configuration information for the operation of the SDN controller (130). Memory (430) may be referred to as a storage unit. Memory (430) may be composed of volatile memory, non-volatile memory, or a combination of volatile and non-volatile memory. Additionally, memory (430) may provide stored data upon request from the processor (420). Memory (430) represents a storage space as a functional component. For example, memory (430) may be understood not only as representing memory (e.g., hard disk, flash memory, RAM) placed as a component within the SDN controller (130), but also as representing a space for storing instructions and / or programs. According to one embodiment, memory (430) may store user information for a campus network (e.g., campus network environment (100)). According to one embodiment, memory (430) may store policy information regarding flow control according to a user, user group, or SDN switch. According to one embodiment, the memory (430) can store traffic statistics of VLANs associated with each SDN switch.

[0045] FIG. 5 shows a signal flow for configuring an uplink port (e.g., uplink port (302)) of an SDN switch (e.g., SDN switch (120)) according to a VLAN (virtual local area network) corresponding to a terminal.

[0046] Referring to FIG. 5, in operation (501), the SDN switch (120) can detect that the terminal (110) is connected to a user port (e.g., user port (301)). For example, the user of the terminal (110) can connect the terminal (110) to an Ethernet port. The Ethernet port can be connected to the user port (301) of the SDN switch (120). In response to detecting that the terminal (110) is connected to the user port (301), the SDN switch (120) can obtain authentication information for the terminal (110) through the user port (301). For example, the authentication information may include the MAC address of the terminal (110), the ID of the user of the terminal (110), and a password corresponding to the ID. The ID and password may be used as identification information to authenticate the user in a campus network.

[0047] In operation (503), the SDN switch (120) can transmit an authentication request to the SDN controller (130). For example, the authentication request may include the authentication information. The authentication request may include the MAC address of the terminal (110), the ID of the user of the terminal (110), and a password corresponding to the ID.

[0048] In operation (505), the SDN controller (130) can perform an authentication procedure. The SDN controller (130) can identify the terminal (110) from the authentication information included in the authentication request. If information about the terminal (110) (e.g., MAC address, ID, PW) is registered in the authentication server (e.g., authentication-related database) of the SDN controller (130), the SDN controller (130) can determine that the authentication of the user of the terminal (110) is successful. Although not shown in FIG. 5, if the MAC address of the terminal (110), or the ID or PW of the user of the terminal (110) does not match the information registered in the authentication server or is missing, the SDN controller (130) can determine that the authentication of the user of the terminal (110) is a failure. If the authentication of the user fails, the SDN controller (130) may not perform VLAN configuration for the user.

[0049] In operation (511), the SDN controller (130) can check the VLAN settings. If the authentication of the user of the terminal (110) is successful, the SDN controller (130) can identify the VLAN corresponding to the terminal (110) (e.g., VLAN with VLAN ID '10'). The SDN controller (130) can check the VLAN settings of the SDN switch (120) in order to set the VLAN corresponding to the terminal (110) (e.g., VLAN with VLAN ID '10') to the SDN switch (120). For example, if the SDN controller (130) does not have a VLAN setting for the terminal (110) on the SDN switch (102), the SDN controller (130) can proceed with the VLAN setting procedure. A VLAN configuration procedure according to embodiments of the present disclosure may include configuring a VLAN corresponding to a terminal (110) (e.g., a VLAN with VLAN ID '10') on a user port (e.g., user port (301)) of an SDN switch (120) and configuring an uplink port (e.g., uplink port (302)) of an SDN switch (120).

[0050] In operation (513), the SDN controller (130) can transmit VLAN settings to the SDN switch (120). The VLAN settings may include a control command to set a VLAN corresponding to the terminal (110) (e.g., a VLAN with VLAN ID '10') on the user port (e.g., user port (301)) of the SDN switch (120). The VLAN settings may include a control command to set an uplink port (e.g., uplink port (302)) of the SDN switch (120).

[0051] In operation (515), the SDN switch (120) can configure the uplink port (302) according to the VLAN configuration. According to one embodiment, the uplink port (302) of the SDN switch (120) can be configured to pass Ethernet frames for a VLAN (e.g., a VLAN with VLAN ID '10') corresponding to a terminal (110) within a campus network (e.g., a campus network environment (100)).

[0052] In operation (517), the SDN switch (120) can configure the user port (301) according to the VLAN configuration. According to one embodiment, the user port (301) of the SDN switch (120) can be configured to provide a VLAN of the campus network (e.g., campus network environment (100)) to a device connected to the port (e.g., a VLAN with VLAN ID '10' or a VLAN associated with the VLAN with VLAN ID '10'). For example, packets transmitted or received through the user port (301) can be associated with the VLAN. For example, traffic from a terminal (110) in the campus network can be identified as traffic of the VLAN with VLAN ID '10'.

[0053] In operation (521), the SDN switch (120) can perform VLAN communication with the terminal (110). For example, the VLAN communication may include the transmission or reception of packets between the SDN switch (120) and the terminal (110) over a VLAN with VLAN ID '10'. As an example, the SDN switch (120) may be configured to transmit packets transmitted by a device connected to another SDN switch through the VLAN with VLAN ID '10' to the terminal (110) via the user port (301). As an example, the SDN switch (120) may be configured to transmit packets from the terminal (110) received through the user port (301) to another node through the VLAN with VLAN ID '10'.

[0054] FIG. 6 shows the components of an SDN controller (e.g., SDN controller (130)) and an SDN switch (e.g., SDN switch (120)) for configuring an uplink port (e.g., uplink port (302)) of an SDN switch (e.g., SDN switch (120)) according to a VLAN corresponding to a terminal.

[0055] Referring to FIG. 6, the SDN switch (120) may include an authentication client (621) and a VLAN DB (622). For example, the authentication client (621) may correspond to at least some of the functions of the processor (320) of FIG. 3 and / or at least some of the functions of the memory (330). As an example, but not limited to, the authentication client (621) may correspond to the authentication processing unit (321) of FIG. 3. For example, the VLAN DB (622) may correspond to at least some of the functions of the memory (330) of FIG. 3. As an example, but not limited to, the VLAN DB (622) may correspond to the VLAN database (331) of FIG. 3.

[0056] The SDN controller (130) may include an authentication module (630). According to one embodiment, the authentication module (630) may be configured to perform the functions of an authentication server for dynamic VLANs. The authentication module (630) may be configured to perform an authentication service (633). For example, the authentication module (630) may include a policy store (631) and a user information store (632). The policy store (631) may include VLAN settings (e.g., VLAN ID, QoS, flow control) for each user or group to which a user belongs in a campus network. The user information store (632) may store user authentication information (e.g., MAC address, ID / PW). For example, the user information store (632) may include a set of data including an ID and a PW. The ID and PW may represent personal information assigned for access to the campus network. For example, the user information store (632) may include a set of data including a MAC address, an ID, and a PW. The authentication module (630) can perform authentication services (633) based on the policy store (631) and the user information store (632).

[0057] The SDN controller (130) may include a dynamic VLAN module (640). According to one embodiment, the dynamic VLAN module (640) may be configured to perform monitoring (643) of the SDN switch (120). For example, the dynamic VLAN module (640) may perform monitoring for the addition, modification, and / or deletion of VLANs on individual SDN switches. According to one embodiment, the dynamic VLAN module (640) may be configured to collect traffic statistics (644). For example, the dynamic VLAN module (640) may collect traffic statistics (644) to remove unused VLANs from the SDN switch. If traffic in a VLAN is below a threshold, the dynamic VLAN module (640) may control the SDN switch to remove the VLAN. According to one embodiment, the dynamic VLAN module (640) may be configured to perform VLAN configuration services (645) of the SDN switch (120). The dynamic VLAN module (640) can configure the SDN switch (120) to use a VLAN corresponding to the terminal of a user (e.g., terminal (110)) that has successfully authenticated, according to the VLAN configuration service (645). The uplink port (302) of the SDN switch (120) can be configured to transmit Ethernet frames for the corresponding VLAN to other nodes on campus (e.g., SDN switch, router, server) according to the VLAN configuration according to the VLAN configuration service (645). According to one embodiment, the dynamic VLAN module (640) may include a UE inventory (641) and a device inventory (642). For example, the dynamic VLAN module (640) can monitor VLANs for each user or configure VLANs for the user based on the UE inventory (641). For exampleThe dynamic VLAN module (640) can monitor VLAN(s) on an SDN switch or set VLANs for ports (e.g., user port (301), uplink port (302)) of the SDN switch based on the device inventory (642).

[0058] Based on the components described above, operations (e.g., operations (S601) to (S608)) for adding VLAN settings to the SDN switch (120) can be performed. In operation (S601), the terminal (110) can be connected to a port (e.g., user port (301)) of the SDN switch (120). For example, the port may be a port with authentication configured according to a communication standard (e.g., IEEE 802.1X). ​​In operation (S602), the authentication client (621) of the SDN switch (120) can collect authentication information (e.g., MAC address, ID / PW information) of the terminal (110) through the user port (301). In operation (S603), the SDN switch (120) can transmit an authentication request for the terminal (110) to the SDN controller (130).

[0059] In operation (S604), the authentication module (630) of the SDN controller (130) can perform an authentication procedure. The authentication module (630) can determine whether the information of the terminal (110) is registered in the user information store (632). The authentication module (630) can determine the success of the authentication of the terminal (110) based on the determination that the information of the terminal (110) is registered in the user information store (632). In response to the success of the authentication, the authentication module (630) can identify the VLAN corresponding to the terminal (110) from the policy store (631). For example, the VLAN corresponding to the terminal (110) can be identified according to the group to which the terminal (110) belongs (e.g., research department, user status, role). For example, the VLAN corresponding to the terminal (110) can be identified according to the group to which the terminal (110) and the SDN switch (120) belong (e.g., affiliation related to building, region). For example, the VLAN corresponding to the terminal (110) may be common to all users for the campus network. The authentication module (630) may determine the failure of authentication of the terminal (110) based on the determination that the information of the terminal (110) is not registered in the user information store (632).

[0060] In operation (S605), the authentication module (630) can transmit the authentication result for the terminal (110) to the dynamic VLAN module (640). The dynamic VLAN module (640) can obtain the authentication result for the terminal (110) from the authentication module (630). In operation (S606), the dynamic VLAN module (640) can identify the SDN switch (120) to which the terminal (110) is connected. The dynamic VLAN module (640) can update the authentication information for the terminal (110). The dynamic VLAN module (640) can determine whether to perform VLAN configuration on the SDN switch (120) to which the terminal (110) is connected. For example, if the authentication for the terminal (110) is successful, the dynamic VLAN module (640) can perform VLAN configuration. For example, if authentication for the terminal (110) fails, the dynamic VLAN module (640) may not proceed with VLAN configuration. For example, if the VLAN corresponding to the terminal (110) has already been configured on the user port (301) and uplink port (302) of the SDN switch (120), the dynamic VLAN module (640) may not proceed with VLAN configuration.

[0061] In operation (S607), the dynamic VLAN module (640) can add VLAN settings for a VLAN corresponding to the terminal (110) to the SDN switch (120) to which the terminal (110) is connected. The dynamic VLAN module (640) can transmit VLAN settings to the SDN switch (120) so that the uplink port (302) of the SDN switch (120) operates according to the VLAN corresponding to the terminal (110). According to the VLAN settings, the SDN switch (120) can include the VLAN corresponding to the terminal (110) in the allowed VLAN list of the uplink port (302). As an example not limited to, the uplink port (302) can be used as a trunk port. The dynamic VLAN module (640) can transmit VLAN settings to the SDN switch (120) so that the user port (301) of the SDN switch (120) operates according to the VLAN corresponding to the terminal (110). According to the above VLAN settings, the SDN switch (120) can assign a VLAN corresponding to the terminal (110) to the user port (301). In operation (S608), the SDN switch (120) can be configured to allow communication using the VLAN corresponding to the terminal (110) according to the above VLAN settings.

[0062] In FIG. 6, an authentication module (630) functioning as an authentication server is described as being included within the SDN controller (130), but embodiments of the present disclosure are not limited thereto. At least some of the components of the authentication module (630) may be placed on an external server (e.g., an OTA (over the air) server) configured independently of the SDN controller (130). The SDN controller (130) can perform an authentication procedure for the terminal (110) through communication with the external server.

[0063] FIG. 7 shows a signal flow for setting up an uplink port (e.g., uplink port (302)) of an SDN switch (e.g., SDN switch (120)) according to the disconnection of a terminal.

[0064] In operation (701), the SDN switch (120) can detect that the terminal (110) connected to the user port (e.g., user port (301)) is disconnected from the user port. For example, the user of the terminal (110) can disconnect the terminal (110) from the Ethernet port. For another example, the user of the terminal (110) can set the Ethernet port of the terminal (110) to unused. The Ethernet port can be connected to the user port (301) of the SDN switch (120). The SDN switch (120) can obtain disconnection information in response to detecting that the terminal (110) is disconnected from the user port (301). For example, the disconnection information may indicate that the connection between the terminal (110) and the user port (301) of the SDN switch (120) has been disconnected.

[0065] In operation (703), the SDN switch (120) can transmit disconnection information to the SDN controller (130). After receiving the disconnection information, the SDN switch (120) can update the authentication information.

[0066] In operation (705), the SDN controller (130) can send a disconnection response to the SDN switch (120).

[0067] In operation (711), the SDN controller (130) can collect traffic information by VLAN. The SDN controller (130) can identify one or more VLANs configured on the SDN switch (120) that transmitted disconnection information. The SDN controller (130) can collect traffic information based on traffic statistics for each of the one or more VLANs.

[0068] In operation (713), the SDN controller (130) can identify unused VLANs. The SDN controller (130) can identify unused VLANs among one or more VLANs configured on the SDN switch (120). The SDN controller (130) can identify unused VLANs based on traffic information per VLAN. For example, if there is no traffic for one VLAN on the SDN switch (120) or if the amount of traffic is below a threshold (e.g., a threshold amount per unit time), the SDN switch (120) can determine that said one VLAN is an unused VLAN. If the amount of traffic for said one VLAN is above the threshold, said one VLAN can be determined not to be an unused VLAN.

[0069] In operation (715), the SDN controller (130) may send a delete command for an unused VLAN to the SDN switch (120). The SDN controller (130) may send the delete command to the SDN switch (120) as an operation in the control plane. The delete command may indicate to delete the configuration related to the unused VLAN among the configurations for one or more VLANs configured in the SDN switch (120).

[0070] In operation (717), the SDN switch (120) may be configured not to allow communication for an unused VLAN. For example, the unused VLAN may be a VLAN with VLAN ID '99'. As the VLAN (e.g., the VLAN with VLAN ID '99') is excluded from the VLAN configurations that can be processed by the SDN switch (120), the SDN switch (120) may not process packets (or Ethernet frames) for the VLAN with VLAN ID '99'.

[0071] FIG. 8 shows the components of an SDN controller (e.g., SDN controller (130)) and an SDN switch (e.g., SDN switch (120)) for configuring an uplink port (e.g., uplink port (302)) of an SDN switch (e.g., SDN switch (120)) according to the disconnection of a terminal.

[0072] Referring to FIG. 8, the SDN switch (120) may include an authentication client (621) and a VLAN DB (622). For example, the authentication client (621) may correspond to at least some of the functions of the processor (320) of FIG. 3 and / or at least some of the functions of the memory (330). As an example, but not limited to, the authentication client (621) may correspond to the authentication processing unit (321) of FIG. 3. For example, the VLAN DB (622) may correspond to at least some of the functions of the memory (330) of FIG. 3. As an example, but not limited to, the VLAN DB (622) may correspond to the VLAN database (331) of FIG. 3.

[0073] The SDN controller (130) may include an authentication module (630). According to one embodiment, the authentication module (630) may be configured to perform an authentication service (633). For example, the authentication module (630) may include a policy store (631) and a user information store (632). The policy store (631) may include VLAN settings (e.g., VLAN ID, QoS, flow control) per user or per group to which a user belongs in a campus network. The user information store (632) may store user authentication information (e.g., MAC address, ID / PW). For example, the user information store (632) may include a set of data including an ID and a PW. The ID and PW may represent personal information granted for access to the campus network. For example, the user information store (632) may include a set of data including a MAC address, an ID, and a PW. The authentication module (630) can perform authentication services (633) based on the policy store (631) and the user information store (632).

[0074] The SDN controller (130) may include a dynamic VLAN module (640). According to one embodiment, the dynamic VLAN module (640) may be configured to perform monitoring (643) of the SDN switch (120). For example, the dynamic VLAN module (640) may perform monitoring for the addition, modification, and / or deletion of VLANs on individual SDN switches. According to one embodiment, the dynamic VLAN module (640) may be configured to collect traffic statistics (644). For example, the dynamic VLAN module (640) may collect traffic statistics (644) to remove unused VLANs from the SDN switch. If traffic in a VLAN is below a threshold, the dynamic VLAN module (640) may control the SDN switch to remove the VLAN. According to one embodiment, the dynamic VLAN module (640) may be configured to perform VLAN configuration services (645) of the SDN switch (120). The dynamic VLAN module (640) can configure the SDN switch (120) to use a VLAN corresponding to the terminal of a user (e.g., terminal (110)) that has successfully authenticated, according to the VLAN configuration service (645). The uplink port (302) of the SDN switch (120) can be configured to transmit Ethernet frames for the corresponding VLAN to other nodes on campus (e.g., SDN switch, router, server) according to the VLAN configuration according to the VLAN configuration service (645). According to one embodiment, the dynamic VLAN module (640) may include a UE inventory (641) and a device inventory (642). For example, the dynamic VLAN module (640) can monitor VLANs for each user or configure VLANs for the user based on the UE inventory (641). For exampleThe dynamic VLAN module (640) can monitor VLAN(s) on an SDN switch or set VLANs for ports (e.g., user port (301), uplink port (302)) of the SDN switch based on the device inventory (642).

[0075] Based on the components described above, operations (e.g., operations (S801) to (S808)) for removing VLAN settings from the SDN switch (120) can be performed.

[0076] In operation (S801), the terminal (110) may be disconnected from a port (e.g., user port (301)) of the SDN switch (120). For example, the user may disconnect the terminal (110) from the Ethernet port connected to the user port (301). For example, the port may be a port with authentication configured according to a communication standard (e.g., IEEE 802.1X). ​​In operation (S802), the SDN switch (120) may transmit disconnection information for the terminal (110) to the SDN controller (130). The disconnection information may indicate that the connection between the terminal (110) and the user port (301) of the SDN switch (120) has been disconnected. In operation (S803), the authentication module (630) of the SDN controller (130) may transmit a disconnection response to the SDN switch (120) in response to the disconnection information from the SDN switch (120). In operation (S804), the authentication module (630) of the SDN controller (130) can update the authentication information by transmitting the disconnection information of the terminal (110) to the dynamic VLAN module (640).

[0077] In operation (S805), the dynamic VLAN module (640) of the SDN controller (130) can collect VLAN-specific traffic information (e.g., traffic statistics (644))) for the SDN switch (120). In operation (S806), the dynamic VLAN module (640) of the SDN controller (130) can determine the VLAN to be deleted from the SDN switch (120), i.e., the unused VLAN, based on the collected traffic information. For example, the dynamic VLAN module (640) can determine the specific VLAN as an unused VLAN if there is no traffic for the specific VLAN on the SDN switch (120) or if the traffic is below a threshold. The dynamic VLAN module (640) can decide to delete the specific VLAN. For example, the dynamic VLAN module (640) can decide not to delete the specific VLAN if the traffic for the specific VLAN on the SDN switch (120) is above a threshold.

[0078] In operation (S807), the dynamic VLAN module (640) may transmit a control command to the SDN switch (120) to which the terminal (110) is connected to delete the VLAN setting for the unused VLAN. In accordance with the control command, the SDN switch (120) may exclude the VLAN corresponding to the terminal (110) from the allowed VLAN list of the uplink port (302). In accordance with the control command, the SDN switch (120) may delete the VLAN corresponding to the terminal (110) assigned to the user port (301). In operation (S808), the SDN switch (120) may be configured not to allow communication for the unused VLAN.

[0079] In FIG. 8, an authentication module (630) functioning as an authentication server is described as being included within the SDN controller (130), but embodiments of the present disclosure are not limited thereto. At least some of the components of the authentication module (630) may be placed on an external server (e.g., an OTA (over the air) server) configured independently of the SDN controller (130). The SDN controller (130) can perform an authentication procedure for the terminal (110) through communication with the external server.

[0080] In the embodiments of the present disclosure, methods for configuring the uplink of an SDN switch and deleting unused VLANs during VLAN configuration in a campus network environment utilizing SDN are described. Through the embodiments of the present disclosure, a campus network supporting dynamic VLANs can be designed even with switches of relatively low specifications (e.g., switches capable of operating a limited number of VLAN IDs). Furthermore, as user terminals are connected to or disconnected from a port, VLAN-related configurations (or policies) on the SDN switch are adaptively performed, thereby enabling the configuration of a campus network that is flexible to user mobility.

[0081] The effects obtainable from the present disclosure are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art to which the present disclosure belongs from the description below.

[0082] According to embodiments of the present disclosure, in a campus network environment for a dynamic virtual local area network (VLAN), a software defined network (SDN) controller (130) is provided. The SDN controller (130) may include at least one transceiver including a communication circuit; at least one processor including a processing circuit; and a memory including one or more storage media for storing instructions. When the above instructions are executed collectively or individually by the at least one processor, the SDN controller (130) may receive an authentication request from the SDN switch (120) for a terminal (110) connected to the SDN switch (120) through the at least one transceiver, and in response to the success of the authentication of the terminal (110) according to the authentication request, identify a VLAN corresponding to the terminal (110), and cause the SDN switch (120) to transmit VLAN settings through the at least one transceiver so that the uplink port (302) of the SDN switch (120) operates according to the VLAN corresponding to the terminal (110). The uplink port (302) of the SDN switch (120) may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment. The above VLAN setting can be used to configure the uplink port (302) to pass an Ethernet frame having a VLAN corresponding to the terminal (110).

[0083] For example, the user port (301) of the SDN switch (120) may be used to connect with the terminal (110). The VLAN setting may be used to associate packets transmitted or received through the user port (301) with a VLAN corresponding to the terminal (110).

[0084] For example, when the above instructions are executed collectively or individually by the at least one processor, the SDN controller (130) may receive disconnection information of the terminal (110) from the SDN switch (120), collect traffic information for each VLAN among at least one VLAN associated with the SDN switch (120) based on the disconnection information, identify unused VLANs based on the collected traffic information, and cause the SDN switch (120) to control such that communication to the unused VLANs is not allowed on the uplink port (302).

[0085] For example, when the above instructions are executed collectively or individually by the at least one processor, the SDN controller (130) may, in response to receiving the authentication request, determine whether the terminal (110) is registered with the authentication server of the SDN controller (130), determine the success of authentication for the terminal (110) based on the determination that the terminal (110) is registered with the authentication server, and in response to the success, cause the SDN controller (130) to identify a VLAN corresponding to the user group to which the terminal (110) belongs based on policy information within the SDN controller (130).

[0086] For example, the authentication request may include an ID for a user of the terminal (110), password information for the ID, and a MAC (medium access control) address of the terminal (110).

[0087] For example, the uplink port (302) may correspond to a trunk port. The VLAN setting may be used to include the VLAN ID (identifier) ​​of the VLAN corresponding to the terminal (110) in the allowed VLAN list of the trunk port.

[0088] For example, when the above instructions are executed collectively or individually by the at least one processor, the SDN controller (130) may receive an authentication request for the terminal (110) from the second SDN switch when the terminal (110) connects to the second SDN switch, and in response to the success of the authentication for the terminal (110) according to the authentication request of the second SDN switch, identify the VLAN corresponding to the terminal (110), and cause the second VLAN setting to be transmitted to the second SDN switch so that the uplink port (302) of the second SDN switch operates according to the VLAN corresponding to the terminal (110). The uplink port (302) of the second SDN switch may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment. The above second VLAN setting can be used to configure the uplink port (302) of the second SDN switch to pass an Ethernet frame having a VLAN corresponding to the terminal (110).

[0089] According to embodiments of the present disclosure, in a campus network environment for a dynamic virtual local area network (VLAN), a software defined network (SDN) switch (120) is provided. The SDN switch (120) may include at least one transceiver including a communication circuit; at least one processor including a processing circuit; and a memory including one or more storage media for storing instructions. When the instructions are executed collectively or individually by the at least one processor, the SDN switch (120) may transmit an authentication request for the terminal (110) to an SDN controller (130) via the at least one transceiver in response to the SDN switch (120) detecting that a terminal (110) is connected to the SDN switch (120), and if the authentication for the terminal (110) is successful, cause the SDN controller (130) to receive a VLAN configuration via the at least one transceiver. The above VLAN configuration can be used to configure the uplink port (302) of the SDN switch (120) to pass Ethernet frames having a VLAN corresponding to the terminal (110). The uplink port (302) of the SDN switch (120) can be used to connect to one or more other SDN switches, routers, or servers within the campus network environment.

[0090] For example, the user port (301) of the SDN switch (120) may be used to connect with the terminal (110). The VLAN setting may be used to associate packets transmitted or received through the user port (301) with a VLAN corresponding to the terminal (110).

[0091] For example, when the above instructions are executed collectively or individually by the at least one processor, the SDN switch (120) may transmit information of the terminal (110) disconnected to the SDN controller (130) via the at least one transceiver in response to the SDN switch (120) detecting that the terminal (110) is disconnected from the user port (301), and after transmitting the information of the terminal (110) disconnected, cause the SDN controller (130) to receive a control command via the at least one transceiver to not allow communication to an unused VLAN on the uplink port (302). The unused VLAN may belong to at least one associated VLAN configured in the SDN switch (120).

[0092] According to embodiments of the present disclosure, a method is provided to be performed by a software defined network (SDN) controller (130) in a campus network environment for a dynamic virtual local area network (VLAN). The method may include receiving an authentication request from an SDN switch for a terminal (110) connected to the SDN switch (120), identifying a VLAN corresponding to the terminal (110) in response to the success of the authentication of the terminal (110) according to the authentication request, and transmitting a VLAN setting to the SDN switch (120) so that the uplink port (302) of the SDN switch (120) operates according to the VLAN corresponding to the terminal (110). The uplink port (302) of the SDN switch (120) may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment. The above VLAN setting can be used to configure the uplink port (302) to pass an Ethernet frame having a VLAN corresponding to the terminal (110).

[0093] For example, the user port (301) of the SDN switch (120) may be used to connect with the terminal (110). The VLAN setting may be used to associate packets transmitted or received through the user port (301) with a VLAN corresponding to the terminal (110).

[0094] For example, the method may include receiving disconnection information of the terminal (110) from the SDN switch (120), collecting traffic information for each VLAN among at least one VLAN associated with the SDN switch (120) based on the disconnection information, identifying unused VLANs based on the collected traffic information, and controlling the SDN switch (120) so that communication to the unused VLANs is not allowed on the uplink port (302).

[0095] For example, identifying the VLAN may include determining whether the terminal (110) is registered with the authentication server of the SDN controller (130) in response to receiving the authentication request, determining the success of authentication for the terminal (110) based on the determination that the terminal (110) is registered with the authentication server, and identifying the VLAN corresponding to the user group to which the terminal (110) belongs based on policy information within the SDN controller (130) in response to the success.

[0096] For example, the authentication request may include an ID for a user of the terminal (110), password information for the ID, and a MAC (medium access control) address of the terminal (110).

[0097] For example, the uplink port (302) may correspond to a trunk port. The VLAN setting may be used to include the VLAN ID (identifier) ​​of the VLAN corresponding to the terminal (110) in the allowed VLAN list of the trunk port.

[0098] For example, the above method may include receiving an authentication request for the terminal (110) from the second SDN switch when the terminal (110) connects to the second SDN switch, identifying the VLAN corresponding to the terminal (110) in response to the success of authentication for the terminal (110) according to the authentication request of the second SDN switch, and transmitting a second VLAN setting to the second SDN switch so that the uplink port (302) of the second SDN switch operates according to the VLAN corresponding to the terminal (110). The uplink port (302) of the second SDN switch may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment. The second VLAN setting may be used to configure the uplink port (302) of the second SDN switch to pass Ethernet frames having the VLAN corresponding to the terminal (110).

[0099] According to embodiments of the present disclosure, a method is provided to be performed by a software defined network (SDN) switch (120) in a campus network environment for a dynamic virtual local area network (VLAN). The method may include transmitting an authentication request for the terminal (110) to an SDN controller (130) in response to detecting that the terminal (110) is connected to the SDN switch (120), and receiving a VLAN configuration from the SDN controller (130) when the authentication for the terminal (110) is successful. The VLAN configuration may be used to configure an uplink port (302) of the SDN switch (120) to pass an Ethernet frame having a VLAN corresponding to the terminal (110). The uplink port (302) of the SDN switch (120) may be used to connect to one or more other SDN switches, routers, or servers within the campus network environment.

[0100] For example, the user port (301) of the SDN switch (120) may be used to connect with the terminal (110). The VLAN setting may be used to associate packets transmitted or received through the user port (301) with a VLAN corresponding to the terminal (110).

[0101] For example, the above method may include transmitting disconnection information of the terminal (110) to the SDN controller (130) in response to detecting that the terminal (110) is disconnected from the user port (301), and receiving a control command from the SDN controller (130) to not allow communication to an unused VLAN on the uplink port (302) after transmitting the disconnection information of the terminal (110). The unused VLAN may belong to at least one associated VLAN configured on the SDN switch (120).

[0102] For one or more embodiments, at least one of the components described in one or more of the prior art drawings may be configured to perform one or more operations, techniques, processes and / or methods as described in the present disclosure. For example, a processor (e.g., a baseband processor) described in the present disclosure in relation to one or more of the prior art drawings may be configured to operate according to one or more examples described in the present disclosure. As another example, circuits associated with user equipment (UE), a base station, a network element, etc., as described above in relation to one or more of the prior art drawings may be configured to operate according to one or more examples described herein.

[0103] Any of the embodiments described above may be combined with any other embodiment (or combination of embodiments) unless otherwise explicitly stated. The foregoing description of one or more embodiments is for illustrative and explanatory purposes only, and is not intended to limit or exhaust the scope of the embodiments in the exact form disclosed. Modifications and variations are possible in light of the foregoing teachings or may be obtained from the practice of various embodiments.

[0104] Methods according to the claims or embodiments described in the specification of the present disclosure may be implemented in the form of hardware, software, or a combination of hardware and software.

[0105] When implemented in software, a computer-readable storage medium (e.g., a non-transient computer-readable storage medium) storing one or more programs (software modules) may be provided. One or more programs stored in the computer-readable storage medium are configured for execution by one or more processors within an electronic device. One or more programs include instructions that cause the electronic device to execute methods according to the claims or embodiments described in the specification of this disclosure. The one or more programs may be provided as a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)), or distributed online (e.g., download or upload) through an application store (e.g., Play Store™) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created on a device-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0106] Such programs (software modules, software) may be stored in random access memory, non-volatile memory including flash memory, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic disc storage devices, compact disc-ROM (CD-ROM), digital versatile discs (DVDs), or other forms of optical storage devices, magnetic cassettes. Alternatively, they may be stored in memory composed of some or all of these. Additionally, each constituent memory may include multiple units.

[0107] Additionally, the program may be stored on an attachable storage device that can be accessed via a communication network such as the Internet, Intranet, LAN (local area network), WAN (wide area network), or SAN (storage area network), or a combination thereof. Such a storage device may be connected to a device performing an embodiment of the present disclosure through an external port. Additionally, a separate storage device on a communication network may be connected to a device performing an embodiment of the present disclosure.

[0108] In the specific embodiments of the present disclosure described above, the components included in the disclosure are expressed in a singular or plural form according to the specific embodiments presented. However, the singular or plural expression is selected to suit the situation presented for convenience of explanation, and the present disclosure is not limited to singular or plural components; even if a component is expressed in the plural form, it may be composed of a singular form, and even if a component is expressed in the singular form, it may be composed of a plural form.

[0109] According to the embodiments, one or more of the aforementioned components or operations may be omitted, or one or more other components or operations may be added. Generally or additionally, a plurality of components (e.g., a module or a program) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the plurality of components in the same or similar manner as those performed by the corresponding component among the plurality of components prior to the integration. According to the embodiments, operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

[0110] Meanwhile, although specific embodiments have been described in the detailed description of the present disclosure, it is understood that various modifications are possible within the scope of the present disclosure.

Claims

In a campus network environment for dynamic VLANs (virtual local area networks), regarding an SDN (software defined network) controller, At least one transceiver including a communication circuit; At least one processor including a processing circuit; and The memory includes one or more storage media for storing instructions, and When the above instructions are executed collectively or individually by the at least one processor, the SDN controller: An authentication request for a terminal connected to the SDN switch is received from the SDN switch through the at least one transceiver, and In response to the success of authentication for the terminal in accordance with the above authentication request, identify the VLAN corresponding to the terminal, and Causing the SDN switch to transmit VLAN settings to the SDN switch through the at least one transceiver so that the uplink port of the SDN switch operates according to the VLAN corresponding to the terminal, and The uplink port of the above SDN switch is used to connect to one or more other SDN switches, routers, or servers within the campus network environment, and The above VLAN configuration is used to configure the uplink port to pass Ethernet frames for the VLAN corresponding to the terminal, SDN controller. In claim 1, The user port of the above SDN switch is used to connect with the terminal, and The above VLAN configuration is used to associate packets transmitted or received through the user port with a VLAN corresponding to the terminal. SDN controller. In claim 1, When the above instructions are executed collectively or individually by the at least one processor, the SDN controller: Receives disconnection information of the terminal from the above SDN switch, and Based on the above disconnection information, traffic information for each VLAN among at least one VLAN associated with the SDN switch is collected, and Identify unused VLANs based on the collected traffic information above, and Causing the SDN switch to be controlled so that communication for the unused VLAN is not allowed on the uplink port, SDN controller. In claim 1, when the instructions are executed collectively or individually by the at least one processor, the SDN controller: In response to receiving the above authentication request, determine whether the terminal is registered with the authentication server of the SDN controller, and Based on the determination that the above terminal is registered with the above authentication server, the success of authentication for the above terminal is determined, and In response to the above success, causing to identify a VLAN corresponding to the user group to which the terminal belongs based on policy information within the SDN controller, SDN controller. In claim 1, The above authentication request includes an ID for the user of the terminal, password information for the ID, and a MAC (medium access control) address of the terminal. SDN controller. In claim 1, The above uplink port corresponds to a trunk port, and The above VLAN setting is used to include the VLAN ID (identifier) ​​of the VLAN corresponding to the terminal in the allowed VLAN list of the trunk port. SDN controller. In claim 1, when the instructions are executed collectively or individually by the at least one processor, the SDN controller: When the above terminal connects to the second SDN switch, an authentication request for the terminal is received from the second SDN switch, and In response to the success of authentication for the terminal in accordance with the authentication request of the second SDN switch, the VLAN corresponding to the terminal is identified, and Causing the second VLAN setting to be transmitted to the second SDN switch so that the uplink port of the second SDN switch operates according to the VLAN corresponding to the terminal, and The uplink port of the second SDN switch is used to connect to one or more other SDN switches, routers, or servers within the campus network environment, and The above second VLAN configuration is used to configure the uplink port of the second SDN switch to pass Ethernet frames for the VLAN corresponding to the terminal. SDN controller. In a campus network environment for dynamic VLANs (virtual local area networks), regarding SDN (software defined network) switches, At least one transceiver including a communication circuit; At least one processor including a processing circuit; and The memory includes one or more storage media for storing instructions, and When the above instructions are executed collectively or individually by the at least one processor, the SDN switch: In response to detecting that a terminal is connected to the above SDN switch, an authentication request for the terminal is transmitted to the SDN controller through the at least one transceiver, and If authentication for the above terminal is successful, it causes the SDN controller to receive VLAN settings through the at least one transceiver, and The above VLAN configuration is used to configure the uplink port of the SDN switch to pass Ethernet frames for the VLAN corresponding to the terminal, and The uplink port of the above SDN switch is used to connect to one or more other SDN switches, routers, or servers within the campus network environment, SDN Switch. In claim 8, The user port of the above SDN switch is used to connect with the terminal, and The above VLAN configuration is used to associate packets transmitted or received through the user port with a VLAN corresponding to the terminal. SDN Switch. In claim 9, When the above instructions are executed collectively or individually by the at least one processor, the SDN switch: In response to detecting that the terminal is disconnected from the user port, the disconnection information of the terminal is transmitted to the SDN controller through the at least one transceiver, and After transmitting the disconnection information of the above terminal, cause to receive a control command from the SDN controller through the at least one transceiver to not allow communication for an unused VLAN on the uplink port, and The above unused VLAN belongs to at least one associated VLAN configured on the SDN switch, SDN Switch. In a method performed by an SDN (software defined network) controller in a campus network environment for dynamic VLANs (virtual local area networks), Receiving an authentication request from an SDN switch for a terminal connected to the said SDN switch, and Identifying a VLAN corresponding to the terminal in response to the success of authentication for the terminal in accordance with the above authentication request, and It includes transmitting VLAN settings to the SDN switch so that the uplink port of the SDN switch operates according to the VLAN corresponding to the terminal, and The uplink port of the above SDN switch is used to connect to one or more other SDN switches, routers, or servers within the campus network environment, and The above VLAN configuration is used to configure the uplink port to pass Ethernet frames for the VLAN corresponding to the terminal, method. In claim 11, The user port of the above SDN switch is used to connect with the terminal, and The above VLAN configuration is used to associate packets transmitted or received through the user port with a VLAN corresponding to the terminal. method. In claim 11, Receiving disconnection information of the terminal from the above SDN switch, and Based on the above disconnection information, collecting traffic information for each VLAN among at least one VLAN associated with the SDN switch, and Identifying unused VLANs based on the above-mentioned collected traffic information, and Controlling the SDN switch so that communication for the unused VLAN is not allowed on the uplink port, method. In claim 11, identifying the VLAN is: In response to receiving the above authentication request, determining whether the terminal is registered with the authentication server of the SDN controller, and Determining the success of authentication for the terminal based on the determination that the terminal is registered with the authentication server, and In response to the above success, the method includes identifying a VLAN corresponding to the user group to which the terminal belongs based on policy information within the SDN controller. method. In claim 11, The above authentication request includes an ID for the user of the terminal, password information for the ID, and a MAC (medium access control) address of the terminal. method.

Images