JP4313779B2 - Congestion control method, congestion control program, and congestion control apparatus - Google Patents

Description

  The present invention relates to a congestion control method, a congestion control program, and a congestion control apparatus.

  Due to the widespread use of broadband lines, the decline in broadband line unit prices is expected to continue. Therefore, a provider that uses a line for a user can add value by means of SLA (Service Level Agreement) that guarantees the quality of the provided line in order to differentiate it from the communication service provided by another provider. A high line is provided as a service. If a line that complies with the SLA is provided, the user's satisfaction with using the line is improved. On the other hand, if the line quality is poor and falls below the SLA standard, the user's satisfaction level is lowered.

  There are various indicators for guaranteed communication quality, such as bandwidth, communication delay, and low unavailable time. Since these communication qualities are affected by congestion, which is a network congestion state, it is important for provider providers to suppress congestion.

  In order to suppress congestion, first, there is a method of increasing the sum of communication bands used for all users. One simple means is to increase the communication bandwidth of the line by capital investment. However, it is costly to replace the already installed communication devices with higher-performance communication devices for capital investment in line with the increase in traffic, so it is easy for provider providers to adopt. Is difficult. Furthermore, since there are applications that use the available bandwidth as much as possible, it is difficult to establish a standard that congestion does not occur if capital investment is made up to this point.

  There is also a means for improving the utilization efficiency of network resources such as existing lines instead of increasing the communication band of the lines. However, although the total communication bandwidth used by the user can be increased, the amount of packets from the user continues to fluctuate, so the tolerance to fluctuations in the amount of communication decreases and congestion is likely to occur.

  Therefore, there is a technique for realizing fair use of the communication line by each user, instead of increasing the sum of the communication bands used by all users. For example, when 100 people use a free bandwidth of 100 [Mbps], one person should use 1 [Mbps] fairly. If a specific user occupies 50 [Mbps] and other users can use only about 0.5 [Mbps], the communication of the specific user occupying the band should be restricted. It is. On the other hand, if there are only two users currently using 100 [Mbps] on the communication line, if 50 [Mbps] are allocated to each of the two users, fair use can be realized and it is subject to regulation. Must not.

  The reason why a specific user improperly occupies the communication band is that the flow through which the specific user communicates becomes a malignant flow. In other words, the flow of communication packets is a malignant flow that causes congestion on the communication line when the amount of packets flowing on the flow becomes excessive with respect to the communication line that is the path of the flow. Become. On the other hand, if the amount of packets flowing on the flow does not give a load that causes congestion on the communication line, the flow is a benign flow. Although the number of flows occupying the entire malignant flow is small, the band occupancy rate of the malignant flow is large, so that congestion occurs and affects the benign flows of the majority of users.

  As a conventional communication control method, there is a shaping method in which a bandwidth of a flow having a large bandwidth usage amount for a predetermined period is narrowed at the end of the network regardless of congestion (see Patent Document 1). FIG. 13 is an explanatory diagram showing a predetermined amount of shaping processing.

In addition, as an application of the shaping method, when the flow of an application that generates communication that is likely to cause congestion is identified from the port number and specified by the communication device at the network end, bandwidth control is performed to prevent congestion from occurring in advance. There is also a method (see Patent Document 2). FIG. 14 is an explanatory diagram showing a bandwidth control process in which a port number is designated.
JP-A-8-79265 JP 2002-185459 A

  Although the conventional communication control method implements several methods for flow control, it classifies multiple flows on the network into malignant flows to be controlled or benign flows that continue to be used. No approach has been proposed. Therefore, flows were classified on a trial and error basis based on the experience and intuition of network administrators.

  For this reason, the malignant flow estimated by the network administrator may deviate from the actual malignant flow. For example, by estimating the benign flow as a malignant flow and excessively suppressing the benign flow, the convenience of the user is remarkably reduced, or the malignant flow is estimated as a benign flow, and the malignant flow that should be controlled is left unattended. , Had increased congestion. Hereinafter, the problems of the conventional congestion control method will be specifically described.

  First, in the method of the shaping method (Patent Document 1), a flow having a large bandwidth usage amount for a predetermined period is controlled. However, in this method, the determination is made only by the bandwidth usage amount for a predetermined period regardless of the presence or absence of congestion, and therefore, the benign flow of the user who uses the bandwidth fairly is excessively regulated. Therefore, although there is a surplus in the bandwidth that can be used by the user, the bandwidth is controlled more than necessary, and the use efficiency of the network is reduced. FIG. 15 is an explanatory diagram showing problems in a predetermined amount of shaping processing.

  Next, Patent Document 2 associates an application to be controlled with a port number used by the application, and suppresses a flow using the port number. However, since the application changes the port number for convenience, the application and the port number do not have a one-to-one correspondence, and some applications may use the same port number. In addition, since there is an application that continuously changes the port number to be used, even if the port number and the application are statically associated in order to estimate the malicious flow, it is not effective. FIG. 16 is an explanatory diagram showing a problem in the bandwidth control process in which the port number is designated.

  In addition, a particular application may generate both malignant and benign flows. When analyzing the communication of the malicious flow, not only obviously illegal security attacks such as DDoS (Distributed Denial of Service), but also users such as P2P (Peer to Peer) may become applications used daily. And in some applications such as P2P, which is currently mainstream, communication is performed using the corresponding band when the band is free regardless of the user's intention, so the user who starts the application is not malicious. Even generate malignant flows.

  Therefore, the main object of the present invention is to solve the above-described problems and control congestion without excessively restricting user communication.

In order to solve the above-described problem, the present invention provides a congestion control method for controlling a malignant flow that causes a congestion that has occurred in a controlled network having a communication device that relays a flow. And a congestion detection unit that detects a congestion device that is the communication device in which congestion has occurred in the control target network. A route connecting the user terminal and the congestion device with reference to a route table indicating a route from the congestion device detected by the congestion detection procedure to the flow of the flow on the control target network. A passing device specifying procedure for specifying a passing device for a malignant flow above, and the malignant flow specifying unit relating to the passing device specified by the passing device specifying procedure A malignant flow identification procedure that identifies a malignant flow based on a raw measurement result, and a communication control in which the communication control unit executes communication control of the malignant flow identified by the malignant flow identification procedure with respect to the communication device And executing a procedure.

  As a result, without restricting even users who use the bandwidth fairly, the bandwidth control target is identified from the characteristic flow information of the malicious flow, and the bandwidth is controlled more than necessary to reduce the user's throughput. Therefore, it is possible to perform band control with an optimum degree of control.

  The present invention is characterized in that, when the malignant flow specifying procedure specifies a plurality of malignant flows, the computer further executes a control order specifying procedure for specifying the order of malignant flows controlled by the communication control procedure.

  As a result, the malignant flow having a high degree of influence on the congestion is preferentially controlled, thereby shortening the time until the congestion is recovered.

  According to the present invention, a computer that executes any one of the congestion detection procedure, the passing device specifying procedure, the malignant flow specifying procedure, and the communication control procedure is a computer that executes another procedure. It is a different computer.

  As a result, flow information for determining the occurrence of congestion is gathered in one place, so that there is an advantage that a wide range of network conditions can be known at a time and management is easy for the network administrator.

  The present invention is characterized in that a computer that executes at least one of the congestion detection procedure, the passing device specifying procedure, the malignant flow specifying procedure, and the communication control procedure is the communication device. .

  As a result, the flow information for determining the occurrence of congestion is distributed, which has the advantage of being resistant to partial failures.

  The present invention is characterized in that the passing device specifying procedure refers to a packet tagged with a device ID by the communication device, and specifies the communication device corresponding to a tag with a large number of packets as the passing device. .

  As a result, the generation source can be identified more easily than searching for a large number of IP addresses. Further, when the address systems of the congestion generation network and the generation source network are different, they can be used as common information in both networks.

  The present invention is characterized in that the passing device specifying procedure refers to a packet whose device address is encapsulated by the communication device, and specifies the communication device corresponding to a device address having a large number of packets as the passing device. .

  Thereby, the passage device specifying unit can directly specify the passage device without a database.

  The present invention is characterized in that the passing device specifying procedure refers to the user terminal IP address of a packet and specifies the communication device located on the route of the user terminal having a large number of packets as the passing device. .

  As a result, it is possible to identify the passing device without processing the packet passing through the communication device halfway to the congestion device.

  The present invention is characterized in that the passing device specifying procedure specifies the passing device based on a packet in an overflow queue that stores discarded packets.

  As a result, the communication device only needs to count a part of the packets when performing the count for specifying the passing device, so that the processing amount of the communication device can be reduced.

  The present invention is characterized in that the passing device specifying procedure specifies the passing device based on a packet in a copy queue that accumulates arrived packets.

  As a result, the communication device only needs to count a part of the packets when performing the count for specifying the passing device, so that the processing amount of the communication device can be reduced.

  The present invention is characterized in that the passing device specifying procedure specifies the passing device based on a packet in a threshold exceeding queue that accumulates packets exceeding the threshold among the arrived packets.

  As a result, the communication device only needs to count a part of the packets when performing the count for specifying the passing device, so that the processing amount of the communication device can be reduced.

  The present invention is characterized in that the passing device specifying procedure specifies, as the passing device, the communication device that is the starting point of the LSP in which the flow communication total amount difference between the communication devices at both ends of an LSP (Label Switched Path) is larger than a predetermined value. And

  Accordingly, it is possible to easily identify a congestion and malignant flow passage device from a small amount of information without collecting and collecting a large amount of information.

  The present invention is characterized in that the passing device specifying procedure specifies, as the passing device, the communication device that is a starting point of an LSP having a quotient of (total flow communication in LSP / number of flows in LSP) greater than a predetermined value. .

  Thereby, since LSP containing a malignant flow can be specified, the passage location of a malignant flow can be specified correctly by a simpler method.

  The present invention is characterized in that the malignant flow identification procedure identifies a flow having a parameter equal to or greater than a threshold value as a malignant flow.

  Thereby, since the malignant flow specification unit can specify the malignant flow only by exchanging with the communication device that has measured the flow, the malignant flow can be specified in a short time.

  The present invention is characterized in that the malignant flow specifying procedure specifies a flow having a parameter as a threshold and passing through the congestion device as a malignant flow.

  Thereby, since it is confirmed whether the candidate of a malignant flow is passing the communication apparatus with which congestion generate | occur | produced, a malignant flow can be specified clearly.

  The present invention is characterized in that the malignant flow specifying procedure specifies a flow having a matching parameter as a malignant flow by comparing a packet of the congestion device and a packet of the passing device with a parameter being a threshold value.

  Thereby, since it is confirmed whether the candidate of a malignant flow is passing the communication apparatus with which congestion generate | occur | produced, a malignant flow can be specified clearly.

The present invention, the computer, when performing the communication control procedures, in the order in which the control sequence specific procedure is determined, until the congestion is relieved, and wherein the benzalkonium communicate control malignant flow sequentially To do.

  Accordingly, by confirming the congestion state of the communication apparatus in which congestion occurs in the process of sequentially controlling the flows, it is possible to identify the flow causing the congestion and to avoid communication control of unrelated flows.

  The present invention is characterized in that communication control of a plurality of malignant flows specified by the malignant flow specifying procedure is performed collectively before executing the congestion mitigation detection procedure.

  Thereby, congestion can be alleviated quickly by reducing all N flows by a predetermined amount.

  The present invention is characterized in that the communication control performs communication control at a flow rate calculated based on congestion and malignant flow information.

  As a result, it is possible to determine the flow rate while confirming the congestion state, so that it is possible to prevent communication control more than necessary and keep the user's throughput as high as possible.

  The present invention is characterized in that the congestion and malignant flow information is collected based on a monitoring packet transmitted from the passing device.

  As a result, the flow rate X [bps] suitable for alleviating congestion is known, and as a result, only the minimum communication control necessary for congestion alleviation is performed to avoid excessively narrowing the bandwidth of the malignant flow. Can keep the throughput as high as possible.

  The present invention is characterized in that the congestion and malicious flow information is a packet loss rate of the congestion device.

  As a result, the flow rate suitable for mitigating congestion is known, and as a result, only the minimum communication control necessary for mitigating congestion is performed, avoiding excessively narrowing the bandwidth of malignant flows, and maximizing user throughput. It can be kept as high as possible.

  The present invention is a congestion control program for causing a computer to execute the congestion control method.

  As a result, without restricting even users who use the bandwidth fairly, the bandwidth control target is identified from the characteristic flow information of the malicious flow, and the bandwidth is controlled more than necessary to reduce the user's throughput. Therefore, it is possible to perform band control with an optimum degree of control.

The present invention relates to a congestion control device that controls a malignant flow that is a cause of congestion that has occurred in a control target network having a communication device that relays a flow, wherein the communication device in which congestion occurs in the control target network. Connect a user terminal and the congestion device from a congestion detection unit that detects a congestion device and a route table that indicates a route that relays a flow on the control target network from the congestion device detected by the congestion detection unit. A malignant flow identifying unit for identifying a malignant flow based on a flow measurement result relating to the passing device identified by the passing device identifying unit; A communication control unit that executes communication control of the malignant flow specified by the malignant flow specifying unit with respect to the communication device. .

  As a result, without restricting even users who use the bandwidth fairly, the bandwidth control target is identified from the characteristic flow information of the malicious flow, and the bandwidth is controlled more than necessary to reduce the user's throughput. Therefore, it is possible to perform band control with an optimum degree of control.

  The present invention further includes a control order specifying unit that specifies the order of malignant flows controlled by the communication control unit when the malignant flow specifying unit specifies a plurality of malignant flows.

  As a result, the malignant flow having a high degree of influence on the congestion is preferentially controlled, thereby shortening the time until the congestion is recovered.

  In the present invention, the congestion detection result is fed back to the specific processing of the malignant flow. In other words, from the characteristic flow information common to malignant flows such as the flow rate, duration, burst size, etc. collected by the communication device that the malignant flow candidate is estimated to pass through after the congestion has occurred. Specify the bandwidth control target.

  As a result, the target to be controlled can be narrowed down, and communication is not restricted to users who use the bandwidth fairly. In other words, it is possible to identify a flow to be controlled from the port number, or to control the bandwidth more than necessary without knowing the optimum degree of control, and to suppress a reduction in user throughput.

  Hereinafter, an embodiment of a congestion control system to which the present invention is applied will be described in detail with reference to the drawings. First, the configuration of the congestion control system of this embodiment will be described with reference to FIGS.

  FIG. 1 is a configuration diagram showing a control target network 10. The control target network 10 is a communication network that controls congestion, and connects the core router 14 and the edge router 16. And the user terminal 18 is a terminal which communicates via the communication apparatus 12, and generates a malignant flow or a benign flow.

  The core router 14 is the communication device 12 in the control target network, and is not connected to the outside of the control target network 10. The core router 14 in which congestion has occurred is assumed to be a congestion device. Then, when congestion occurs, the core router 14 performs LSP (Label-Switched Path) or line-based flow measurement by counting tags identifying the edge router 16 attached to the packet.

  The edge router 16 is the communication device 12 in the control target network, and has a connection line to the outside of the control target network 10. The edge router 16 through which the malicious flow passes is used as a passing device, and the passing device is located on a path connecting the user terminal 18 that generates the malicious flow and the congestion device. The edge router 16 attaches the tag that identifies the device itself to the flow that passes.

  FIG. 2 is a configuration diagram illustrating the congestion control apparatus 1 that controls congestion that occurs in the control target network 10.

  The congestion control device 1 is configured as a computer including at least a memory serving as a storage unit used when performing arithmetic processing and an arithmetic processing device that performs the arithmetic processing. The memory is constituted by a RAM (Random Access Memory) or the like. Arithmetic processing is realized by an arithmetic processing unit configured by a CPU (Central Processing Unit) executing a program on a memory.

  The congestion control device 1 includes a congestion detection unit 20, a passing device specifying unit 30, a malignant flow specifying unit 40, and a communication control unit 70. Furthermore, the congestion control device 1 may include a control order specifying unit 60. First, the congestion detection unit 20 collects data from the control target network 10 and detects congestion. Next, the passing device specifying unit 30 specifies the passing device of the malignant flow related to the congestion from the congestion estimated by the congestion detecting unit 20. Then, the malignant flow specifying unit 40 specifies the malignant flow from the passing device specified by the passing device specifying unit 30. Furthermore, the control order specifying unit 60 determines the communication control order for the malignant flow specified by the malignant flow specifying unit 40. And the communication control part 70 performs communication control of a malignant flow according to the instruction | indication of communication control. Hereinafter, each component of the congestion control apparatus 1 is demonstrated concretely.

  The passing device specifying unit 30 has a correspondence database of tags and intra-network communication devices 12. The malignant flow identification unit 40 that should issue an instruction to control the malignant flow with reference to the database is notified. Malignant flow passing device candidates are estimated, and information notification / instruction is given to the malignant flow specifying unit 40 related to the occurrence of congestion.

  FIG. 3 is a configuration diagram illustrating the congestion detection unit 20. The congestion detection information management unit 22 periodically collects and holds flow information necessary for congestion detection from the core router 14 of the control target network 10. The flow information is, for example, input packet information periodically collected from the core router 14 and discard packet information. The passage device analysis unit 24 includes an algorithm for specifying a passage device based on the information of the congestion detection information management unit 22, and specifies a candidate for a passage device for a malignant flow based on the collected information.

  The communication device management unit 26 of FIG. 3 has a correspondence database of the device ID (IDentifier) of the communication device 12 and the malignant flow specifying unit 40, and from the candidates for the passage device of the malignant flow analyzed by the passage device analysis unit 24, The malignant flow specifying unit 40 to be notified of the occurrence of congestion is determined. The congestion occurrence notification unit 28 notifies the malignant flow identification unit 40 determined by the communication device management unit 26 of the occurrence of congestion. The control interface 29 is a control interface for transmitting / receiving information to / from the outside.

  The congestion occurrence notifying unit 28 may notify the route calculation means in addition to the malicious flow specifying unit 40 of the occurrence of congestion. The route calculation means operates a routing protocol or the like to create a route table (routing table) indicating a route through which the communication device 12 relays a flow. The route calculation means calculates the route so as not to pass through the congestion device or the network in which the congestion occurs by receiving the notification of the occurrence of the congestion. The route calculation means may be in a network where congestion has occurred, or may be in another provider network.

  FIG. 4 is a configuration diagram showing the malignant flow identification unit 40. The trigger control unit 42 receives a notification of information related to a candidate for a passage device for a malignant flow from the passage device specifying unit 30 and notifies the edge router of a flow measurement start trigger. The flow information management unit 44 holds packet count information for each flow collected from the edge router 16. The malignant flow analysis unit 46 includes an algorithm for identifying a malignant flow based on packet count information for each flow, and identifies a malignant flow from the collected flow information.

  The analysis algorithm management unit 48 in FIG. 4 holds an algorithm used when the malignant flow analysis unit 46 specifies a malignant flow. The malignant flow notification unit 50 notifies the control sequence specifying unit 60 or the communication control unit 70 of the specified malignant flow. The control instruction unit 52 instructs the communication control unit 70 to perform malignant flow control. When a plurality of malignant flows are detected, the control order of the malignant flows may follow the order determined by the control order analysis unit 64. The control interface 54 is a control interface for transmitting / receiving information to / from the outside.

  FIG. 5 is a configuration diagram showing the control order specifying unit 60. The malignant flow information management unit 62 holds the malignant flow information collected from the malignant flow specifying unit 40. The control order analysis unit 64 includes an algorithm that determines the order and degree of control of the malignant flow based on the malignant flow information of the malignant flow information management unit 62. The control interface 68 is a control interface for transmitting / receiving information to / from the outside.

  The congestion state confirmation unit 66 in FIG. 5 collects congestion state information from the congestion detection unit 20. The congestion state information is referred to in order to determine whether or not to perform communication control of the malignant flow, and if so, the degree of control. If the congestion state is confirmed and it is determined that communication control is still necessary, the malignant flow identification unit 40 instructs communication control of the next malignant flow. As a result, the optimum control degree is not known, and the bandwidth is controlled more than necessary to prevent the user's throughput from decreasing.

  The congestion control process performed by the congestion control apparatus 1 described above is shown in the flowchart of FIG.

  First, the edge router 16 between the user terminal 18 and the control target network 10 writes a tag for identifying its own device in the flow that passes (S11). Examples of tag implementation include a ToS (Type of Service) field of an IP (Internet Protocol) header, an IPv6 header flow label, or an MPLS (Multi-Protocol Label Switching) label.

  Next, the congestion detection unit 20 collects flow information from the core router 14 in the control target network 10 and periodically checks whether congestion has occurred (S12). As a method for checking the occurrence of congestion, the flow information possessed by the communication device 12 is collected, the packet loss rate and the like are calculated to determine whether or not there is congestion, and a test packet such as ping is sent through the network and returned. There is an active method for judging whether or not there is congestion from a delay or loss at the time of arrival. Then, when detecting the occurrence of congestion (S13) in the control target network 10 (S14), the congestion detection unit 20 notifies the passing device specifying unit 30 of the detection information (S15).

  And the passage device specific | specification part 30 receives the notification, and acquires the specific information of a passage device in order to specify the passage device of a malignant flow (S16). The identification information of the passing device is, for example, device ID tag count information of a packet held by the congestion device.

  Furthermore, the passage device specifying unit 30 refers to the communication device management unit 26 on the basis of the acquired information on the passage device, and specifies candidates for the passage device of the malignant flow (S17). In a network configuration in which the number of communication devices 12 is large, a plurality of malignant flow specifying units 40 may be installed, and a distributed processing configuration in which the communication devices 12 in charge of each malignant flow specifying unit 40 are assigned may be adopted. Good. At that time, the congestion control device 1 stores the correspondence between the device ID of the communication device 12 and the malignant flow identification unit 40 in charge in the database. And the passage device specific | specification part 30 acquires the malignant flow specification part 40 corresponding to the passage device specified by S17 from a database. Acquisition from the database is performed several times in order to trace back to the passing device that performs flow measurement for finally identifying the malignant flow when the number of the malignant flow specifying unit 40 and the communication device 12 is large. May be.

  Then, the passing device specifying unit 30 notifies the malignant flow specifying unit 40 specified in S17 of the occurrence of congestion and information on the communication device 12 (S18). Then, the malignant flow identification unit 40 receives the notification and issues a trigger for starting the flow measurement for identifying the malignant flow to the edge router 16 that is a malignant flow passage device (S19). Furthermore, the edge router 16 receives the trigger, starts flow measurement, and passes the flow measurement result for a predetermined time to the malignant flow identification unit 40 (S20). Then, the malignant flow specifying unit 40 receives the flow measurement result and specifies the malignant flow from the received information (S21).

  Further, once the malignant flow is specified, the malignant flow specifying unit 40 notifies the control order specifying unit 60 of characteristic information (rate, duration, address, etc. of the malignant flow) (S22) and controls the flow. Ask for the order. And the control order specific | specification part 60 determines the order to control about the notified malignant flow (S23). The order of controlling the malignant flow is, for example, the flow information received from the malignant flow specifying unit 40 in the order of the flow having the largest size, the order of the dictionary sequence (the order of young address number, the order in which the information arrived, etc.) The order calculated by the algorithm and the order determined from the network information collected by the control order specifying unit 60 can be given. FIG. 7 is an explanatory diagram showing communication control processing performed in order for congestion.

  Then, the malignant flow specifying unit 40 instructs the communication control unit 70 to perform communication control on the specified malignant flow according to the order determined by the control order specifying unit 60 (S24). Then, the communication control unit 70 controls the communication (bandwidth etc.) of the malignant flow (S25).

Hereinafter, the method of specifying the passage device for the malignant flow (S16, S17) will be described in detail. The congestion control device 1 identifies the passing device by any one of the following methods.

  Method 1-A is a method of identifying a passing device from a tagged packet. That is, the core router 14 that is a congestion device counts the number of tags by referring to the tags of all the packets that have arrived during X hours after the occurrence of congestion. The passing device specifying unit 30 receives information on the number of tags counted by the congestion device, specifies the communication device 12 corresponding to a large number of tags as a passing device, and holds the tag value held and the address of the communication device 12. By referring to the database, the passing device is specified (see FIG. 8).

  When the communication device 12 adds a tag, the tag may be written in all packets, or may be written only in a packet with a large size. Information that can be identified by the communication control unit 70 attached to the communication device 12 may be written in the tag. The passing device may be finally specified by performing this method stepwise. Examples of tags include an MPLS network label, an IPv4 header ToS field, an IPv6 header flow label, and the like.

  Method 1-B is a method of specifying a passing device from the encapsulated packet. In other words, the address of the communication device 12 is encapsulated on the user terminal IP address in the flow passing through the communication device 12, and the congested device refers to the encapsulated address of all packets that arrive during X hours after the occurrence of the congestion. The passing device specifying unit 30 receives information on the number of addresses counted by the congestion device, and specifies the communication device 12 corresponding to the large number of addresses as the passing device.

  When the communication device 12 performs the encapsulation, the encapsulation may be performed for all packets or only for a packet having a large size flow. The address to be encapsulated may be the address of the communication control unit 70 attached to the communication device 12. Examples of encapsulation include a label in the MPLS network, IPoverIP, and the like.

  Method 1-C is a method of identifying a passing device from the user terminal IP address of a packet. That is, the congestion device refers to the user terminal IP addresses of all packets that arrive during X hours after the occurrence of congestion, and counts for each IP address. The passing device specifying unit 30 determines the number of IP addresses counted by the congestion device. Of the communication device 12 having the communication control unit 70 that holds the information in advance and checks the route from the large number of IP addresses to the congestion device by referring to the routing database held by the route calculation means. By comparing with the database, the passing device on the route is specified.

  Method 1-D is a method of identifying a passing device from packets in the overflow queue. That is, instead of referring to all packets arriving during the X hours after the occurrence of congestion in the congestion device, the communication device 12 has means for storing the discarded packets in the overflow queue, and the communication device 12 in which the congestion occurs For a packet stored in the overflow queue, a passing device is specified by any one of methods 1-A to 1-C (see FIG. 9).

  Method 1-E is a method of specifying a passing device from a packet in the copy queue. That is, instead of referring to all packets arriving during the X hours after the occurrence of congestion in the congestion device, the communication device 12 has means for copying the packets within the latest X time stored in the queue to the copy queue, The communication device 12 in which the congestion has occurred specifies a passing device by any one of the methods 1-A to 1-C with respect to the packet stored in the copy queue (see FIG. 9).

  Method 1-F is a method of identifying a passing device from a packet in the queue exceeding the threshold. That is, instead of referring to all packets that arrive during X hours after congestion occurs in the congestion device, a threshold is provided in the queue of the communication device 12, and packets that have arrived in the queue after packets exceeding the threshold have accumulated in the queue The communication device 12 is provided with a means for copying to the threshold value exceeding queue, and the communication device 12 in which congestion occurs causes any one of method 1-A to method 1-C to target the address of the packet stored in the threshold value exceeding queue. The passing device is specified by this method (see FIG. 9).

  In method 1-A to method 1-F, the communication device 12 corresponding to all the referenced addresses may be the target of the passing device, or the top X may be the target of the passing device.

  Here, a feature for determining whether or not the flow that passes through the connection-type network in which the flow passes through the LSP is a malignant flow will be described. Note that connection type networks include an ATM (Asynchronous Transfer Mode) network, an MPLS network, and the like. A characteristic of the malignant flow flowing through the LSP is that the number of malignant flows in the total number of flows is small, but the band occupation rate of the malignant flows is large.

  Packets that have passed through the queue are distributed to the destination LSP for each address. Looking at an LSP for a certain period of time, an LSP that accommodates many flows that are large in size and likely to become malignant flows (see FIG. 10A), an LSP that accommodates a small number of large flows and many normal flows (see FIG. 10). 10 (b)), and various patterns of LSPs exist, such as an LSP that accommodates a normal size flow (see FIG. 10C).

  Method 1-G utilizes the following features. When congestion occurs due to packets not being able to enter the queue or the like, the packets are randomly discarded when the priority of all the packets is equal. Therefore, the larger the flow size, the larger the number of discarded packets. Therefore, if statistics of discarded packets are taken, a flow having a large size can be identified.

  Therefore, method 1-G is a method of identifying a passing device from an LSP in which the difference in the total communication amount of the flows of the communication devices 12 at both ends of the LSP is greater than a predetermined value. That is, when the control target network 10 is a connection type network, the passing device specifying unit 30 refers to the LSP of the network and the start / end point communication device database held in advance, and the start / end point communication at both ends of the LSP of the corresponding network. The total communication amount of the LSP inflow flow and the total communication amount of the LSP outflow flow that the device 12 has are collected and the difference is calculated to obtain the total communication amount of the flow lost in the network. It is determined that congestion has occurred in the passing communication device 12, and the start point communication device 12 of the LSP is identified as a passing device (see FIG. 11).

  Method 1-H utilizes the following features. Since the number of packets output from a node in a certain predetermined time is limited, an LSP that accommodates a flow that causes congestion is large in average flow size. The average flow size is a quotient of (total communication amount of flow / number of flows).

  Therefore, method 1-H is a method of specifying a passing device from an LSP whose average flow size is larger than a predetermined value. That is, when the control target network 10 is a connection type network, the passing device specifying unit 30 refers to the network LSP stored in advance and its path information database, and the LSP passes through the communication device 12 in which congestion has occurred. Is collected from the communication device 12 where the congestion has occurred or the communication device 12 at the LSP end, and the start point communication device 12 of the LSP having a large average flow size is identified as the passing device ( (See FIG. 12).

  In methods 1-G and 1-H, the top X starting points may be used as the passing device, or all starting points of LSPs equal to or greater than the threshold may be used as the passing device. Further, the passing device may be finally identified by using the method 1-G or the method 1-H together with any one of the methods 1-A to 1-A.

Hereinafter, the method of identifying the malignant flow (S21) will be specifically described. The congestion control device 1 identifies the malignant flow by any one of the following methods.

  Method 2-A is a method for identifying a flow having a parameter equal to or greater than a threshold value as a malignant flow. In other words, the malignant flow specifying unit 40 selects all the flows having a predetermined parameter equal to or higher than the threshold value or the top X flows having a predetermined parameter equal to or higher than the threshold value from the flow information measured in the candidate malignant flow passage devices. Is specified.

  Method 2-B is a method for identifying a flow that passes through a congestion device with a parameter as a threshold value as a malignant flow. In other words, the malignant flow specifying unit 40 selects all the flows whose predetermined parameters are equal to or higher than the threshold or the top X flows whose flow is equal to or higher than the threshold from the flow information measured in the candidates for the malignant flow passage device. The route information of the flow is referred to the route information held by the route calculation unit having the routing database, and it is confirmed whether the corresponding flow passes through the congestion device. From the result, the predetermined parameter is equal to or greater than the threshold value and A flow passing through the congestion device is identified as a malignant flow.

  In Method 2-B, for example, the malignant flow specifying unit 40 collects flow information measured in a candidate for a malignant flow passage device, and a predetermined parameter out of the information is obtained from a threshold stored in a threshold database. Select all large flows, or the top X flows, refer to the route information held by the route calculation unit with the routing database, check whether the flow passes through the congestion device, and determine the result beforehand. A flow whose parameter is greater than or equal to the threshold and is passing through the congestion device is identified as a malignant flow.

  Method 2-C is a method for identifying a flow having a parameter having a threshold value and matching packet addresses as a malignant flow. That is, the malicious flow identification unit 40 receives the packet information from the means for holding the packet information accumulated in the congestion device queue before and after the occurrence of the congestion, and collects the information and the candidates for the passage device of the malicious flow. All the flows in which the predetermined parameter in the flow information is larger than the threshold stored in the threshold database, or the information of the top X flows are collated.

  In method 2-C, when the address of the packet included in the packet information of the congestion device and the address of the packet included in the flow information measured by the candidate of the passing device match, the candidate for the malignant flow passes through the congestion device. A flow in which a predetermined parameter is larger than the threshold value stored in the threshold value database and passes through the congestion device is identified as a malignant flow.

  In the method 2-A to the method 2-C, as an example of the parameter, there is a value obtained by counting the number of packets arriving during a certain X minute with the sampling rate f. A flow having a large number of packets arriving at the edge router 16 during a predetermined time is probabilistically estimated to have a large bandwidth occupancy rate, and a flow having a packet count value equal to or greater than a threshold is identified as a malignant flow. Other examples of parameters include burst size and duration.

Hereinafter, the method of the malignant flow control process (S25) will be described in detail. The congestion control device 1 controls the malignant flow by any one of the following methods.

  Method 3-A is a method in which the communication control unit 70 sequentially controls N malignant flows. That is, when communication control is performed on the specified N malignant flows, the control order specifying unit 60 receives information on the N malignant flows from the malignant flow specifying unit 40, determines the order of communication control, and follows the order. The malignant flow identification unit 40 issues an instruction, the malignant flow identification unit 40 issues an instruction to the target communication control unit 70, and the communication control unit 70 performs communication control. In the meantime, the control order specifying unit 60 receives information on the congestion state from the congestion detection unit 20 and instructs communication control in order until the congestion is alleviated. If the congestion is not alleviated, an instruction is issued to the malignant flow identification unit 40 corresponding to the communication control unit 70 in the next order.

  Method 3-B is a method in which the communication control unit 70 controls N malignant flows in a batch and then sequentially controls them. That is, when communication control is performed on the specified N number of malignant flows, the control order specifying unit 60 determines the order of communication control of the N number of malignant flows, and first performs communication control for a predetermined amount of all the N flows. Then, the malignant flow specifying unit 40 is instructed by the method 3-A.

  Method 3-C is a method in which calculation of the flow rate and control at the flow rate are repeated until the communication control unit 70 is relieved of congestion. That is, when communication control is performed on the identified N malignant flows, the control order specifying unit 60 refers to the information on the congestion state confirmed by the congestion detection unit 20 by the control order specifying unit 60, and the information Using the malignant flow information received from the flow specifying unit 40 as a parameter, the flow rate calculation algorithm is used to determine the flow rate after control of each malignant flow, and the malignant flow specifying unit 40 is instructed to perform communication control at that flow rate. From this, the malignant flow identification unit 40 further instructs the communication control unit 70.

Specifically, while the communication control unit 70 performs communication control, the congestion state confirmation unit 66 confirms the latest congestion state acquired from the congestion device, and sequentially instructs communication control until the congestion state is resolved. Is output to the communication control unit 70. The flow rate calculation algorithm is, for example, Equation 1 below. For the variables of Equation 1, R is the flow rate [bps], D is the amount of data received [bit], and T is the count time [seconds].
R = D / T (Formula 1)

  Method 3-D is a method in which the communication control unit 70 monitors a congestion state with a monitoring packet and performs control at a flow rate suitable for the congestion state. In other words, when communication control is performed for the identified N malignant flows, monitoring packets such as ping are skipped from the malignant flow passing device, and the malignant flow specifying unit 40 is suitable for congestion mitigation while monitoring the congestion state of the network. A flow rate is calculated using the flow rate calculation algorithm to control communication of a malicious flow.

  Method 3-E is a method in which the communication control unit 70 controls the flow rate calculated from the packet loss rate. That is, when communication control is performed on the specified N malicious flows, the control order specifying unit 60 refers to the information on the packet loss rate of the congestion device that the congestion detection unit 20 periodically measures, and the flow rate calculation is performed therefrom. By calculating the flow rate X [bps] to be controlled using an algorithm, the malignant flow is subjected to communication control at an appropriate flow rate.

  In the method 3-A to the method 3-E, a plurality of communication controls may be performed in parallel, or may be performed according to the order determined by the control order specifying unit 60.

  The present invention described above can be widely modified without departing from the spirit thereof as follows.

  For example, the flow measurement (S20) is performed in response to the trigger issuance (S19), but the flow measurement may be performed in advance as background processing regardless of the presence or absence of the trigger. As a result, the response related to the flow measurement (S20) is accelerated, and the time required for network restoration by congestion control can be shortened.

  Further, the order determination process (S22, S23) for controlling the malignant flow may be omitted. As an example that needs to be omitted, in the case where only one malignant flow is found, there is a case where urgent dissemination is required so that a recovery time for controlling the malignant flows one by one cannot be taken. When the order determination is omitted, communication control is performed for a plurality of malignant flows all at once (S24). As a result, it is possible to shorten the time required for network recovery by congestion control.

  Furthermore, although the congestion control device 1 in FIG. 2 is configured to accommodate each component in one housing, this configuration is merely an example, and a plurality of housings constituting the congestion control device 1 are provided. The components may be distributed and arranged. Each component of the congestion control device 1 may be in the same network or in a different network. If the networks are different, they may be the same operator or different operators. If each network has different functions, there is an agent that has an address translation function between them. As a result, the CPUs of the plurality of congestion control devices 1 perform calculations, respectively, so that load distribution can be realized.

  Moreover, you may accommodate each component of the congestion control apparatus 1, and the apparatus which has another function in the same housing | casing. For example, the communication control unit 70 is built in the communication device 12 (see FIG. 17), and the message passing of the communication control process (S24) is realized not on the network line outside the case but on the internal bus inside the case, or the communication control. In addition to the unit 70, the control order specifying unit 60 may also be built in the communication device 12 (see FIG. 18). Similarly, the malignant flow specifying unit 40 is built in the edge router 16 and the message passing of flow measurement (S19, S20) is realized not on the network line outside the housing but on the internal bus inside the housing. Thereby, high-speed communication of the internal bus and load avoidance of the network line can be realized.

  In this specification, the congestion control device 1 is a core device that is neither the core router 14 nor the edge router 16, and the configuration shown in FIG. A configuration as shown in FIG. 17 or FIG. 18 in which at least one component is built in a communication device (core router 14 or edge router 16) is a distributed type.

  Furthermore, each component of the congestion control device 1 may be realized by the CPU executing a program stored in a dedicated device of each component, or stored in a functional block of the communication device 12. It may be realized by executing the programmed program.

  Further, a plurality of components of the congestion control device 1 may exist by starting a plurality of processes. The communication device 12 in charge is assigned to each of the plurality of components. As a result, even when there are many communication devices 12, data parallel processing between a plurality of components can be realized, the time required to suppress congestion can be shortened, and the number of communication devices that perform communication as processing partners can be reduced. Therefore, there is an advantage that scalability with respect to the number of devices is improved and management is easy.

  Here, the correspondence information between each component of the congestion control device 1 and the communication device 12 in charge may be created dynamically or statically. As an example of creating dynamically, there is a method of preferentially allocating the communication device 12 to a component having a current calculation load smaller than other components among a plurality of components having the same function. On the other hand, as an example of static creation, there is a method of referring to a database that stores correspondence information between components created by an administrator in advance and the communication device 12.

  Further, the format (line type, communication protocol, etc.) of the control target network 10 is not limited to a specific one. For example, the network 10 to be controlled transfers a circuit-switched network such as TDM (Time Division Multiplexing) and WDM (Wavelength Division Multiplexing) or IP (Internet Protocol), Ethernet (registered trademark), and IP packets with labels. It may be an MPLS network. Each communication device is connected by a logical path provided by setting a lower layer path positioned relatively lower than the network layer in which the node exists. The communication device 12 may be, for example, an MPLS router of an MPLS network or a router of a packet network.

It is a block diagram which shows the control object network regarding one Embodiment of this invention. It is a block diagram which shows the congestion control apparatus regarding one Embodiment of this invention. It is a block diagram which shows the congestion detection part regarding one Embodiment of this invention. It is a block diagram which shows the malignant flow specific | specification part regarding one Embodiment of this invention. It is a block diagram which shows the control order specific | specification part regarding one Embodiment of this invention. It is a flowchart which shows the congestion control process regarding one Embodiment of this invention. It is explanatory drawing which shows the communication control process performed in order with respect to congestion regarding one Embodiment of this invention. It is a block diagram which shows the packet with which the tag regarding one Embodiment of this invention was attached | subjected. It is explanatory drawing which shows the queuing by the communication apparatus regarding one Embodiment of this invention. It is explanatory drawing which shows the flow which LSP regarding one Embodiment of this invention accommodates. It is explanatory drawing which shows calculation of the difference of the communication total amount of the flow in LSP both ends regarding one Embodiment of this invention. It is explanatory drawing which shows evaluation of the flow in LSP regarding one Embodiment of this invention. It is explanatory drawing which shows a predetermined amount of shaping processing. It is explanatory drawing which shows the bandwidth control process which designated the port number. It is explanatory drawing which shows the problem in the shaping process of a predetermined amount. It is explanatory drawing which shows the problem in the band control processing which designated the port number. 1 is a configuration diagram illustrating a distributed congestion control apparatus according to an embodiment of the present invention. FIG. 1 is a configuration diagram illustrating a distributed congestion control apparatus according to an embodiment of the present invention. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Congestion control apparatus 10 Control object network 12 Communication apparatus 18 User terminal 20 Congestion detection part 30 Passing device specific | specification part 40 Malignant flow specific | specification part 60 Control order specific | specification part 70 Communication control part

Claims (23)

In a control target network having a communication device that relays a flow, a congestion control method for controlling a malignant flow that is a cause of congestion that has occurred,
The computer has a congestion detection unit, a passing device specifying unit, a malignant flow specifying unit, and a communication control unit,
The congestion detection unit detects a congestion device that is the communication device in which congestion occurs in the control target network, and a congestion detection procedure.
The passing device specifying unit is on a route connecting a user terminal and the congestion device with reference to a route table indicating a route for relaying a flow on the control target network from the congestion device detected by the congestion detection procedure. A passage device identification procedure for identifying the passage device of the malignant flow;
The malignant flow specifying unit specifies a malignant flow based on a flow measurement result related to the passing device specified by the passing device specifying procedure;
A communication control procedure in which the communication control unit executes communication control of the malignant flow specified by the malignant flow specifying procedure for the communication device;
The congestion control method characterized by performing.
  The computer further executes a control order specifying procedure for specifying the order of malignant flows controlled by the communication control procedure when the malignant flow specifying procedure specifies a plurality of malignant flows. Congestion control method.   A computer that executes any one of the congestion detection procedure, the passing device specifying procedure, the malignant flow specifying procedure, and the communication control procedure is a computer that is different from a computer that executes other procedures. The congestion control method according to claim 1 or 2, characterized in that:   The computer that executes at least one of the congestion detection procedure, the passing device specifying procedure, the malignant flow specifying procedure, and the communication control procedure is the communication device. The congestion control method according to claim 2.   2. The passing device identification procedure refers to a packet tagged with a device ID by the communication device, and identifies the communication device corresponding to a tag having a large number of packets as the passing device. The congestion control method according to claim 4.   2. The passing device specifying procedure refers to a packet whose device address is encapsulated by the communication device, and specifies the communication device corresponding to a device address having a large number of packets as the passing device. The congestion control method according to claim 4.   2. The passing device specifying procedure refers to the user terminal IP address of a packet and specifies the communication device positioned on the route of the user terminal having a large number of packets as the passing device. The congestion control method according to claim 4.   The congestion control according to any one of claims 1 to 4, wherein the passing device specifying procedure specifies the passing device based on a packet in an overflow queue that stores discarded packets. Method.   The congestion control method according to any one of claims 1 to 4, wherein the passing device specifying procedure specifies the passing device based on a packet in a copy queue that accumulates arrived packets. .   5. The passing device specifying procedure specifies the passing device based on a packet in an over-threshold queue that accumulates packets exceeding the threshold among the arrived packets. The congestion control method according to item.   The passing device specifying procedure specifies, as the passing device, the communication device that is a starting point of an LSP in which a flow communication total amount difference between the communication devices at both ends of an LSP (Label Switched Path) is larger than a predetermined value. The congestion control method according to any one of claims 1 to 4.   2. The passing device specifying procedure specifies the communication device that is a starting point of an LSP having a quotient of (total flow communication in LSP / number of flows in LSP) larger than a predetermined value as the passing device. The congestion control method according to claim 4.   5. The congestion control method according to claim 1, wherein the malignant flow identification procedure identifies a flow having a parameter equal to or greater than a threshold value as a malignant flow.   The congestion control method according to any one of claims 1 to 4, wherein the malignant flow identification procedure identifies a flow having a parameter as a threshold value and passing through the congestion device as a malignant flow.   5. The malignant flow specifying procedure specifies a flow having a matching parameter as a malignant flow by matching a packet of the congestion device and a packet of the passing device with a parameter being a threshold value. The congestion control method according to any one of the above. The computer, when performing the communication control procedures, in the order in which the control sequence specific procedure is determined, until the congestion is relieved, claims, characterized in and Turkey to the communication control malignant flow sequentially 2 congestion control method according to.
  The congestion control method according to claim 16, wherein communication control is performed for a plurality of malignant flows identified by the malignant flow identification procedure before the congestion mitigation detection procedure is executed.   The congestion control method according to claim 16 or 17, wherein the communication control is performed at a flow rate calculated based on congestion and malignant flow information.   19. The congestion control method according to claim 18, wherein the congestion and malicious flow information is collected based on a monitoring packet transmitted from the passing device.   19. The congestion control method according to claim 18, wherein the congestion and malicious flow information is a packet loss rate of the congestion device.   A congestion control program for causing a computer to execute the congestion control method according to any one of claims 1 to 20. In a control target network having a communication device that relays a flow, a congestion control device that controls a malignant flow that is a cause of congestion that has occurred,
A congestion detection unit that detects a congestion device that is the communication device in which congestion occurs in the control target network;
From the congestion device detected by the congestion detection unit, refer to a route table indicating a route through which the flow on the control target network is relayed, and identify a passage device for a malignant flow on the route connecting the user terminal and the congestion device. A passing device specifying unit to
Based on the flow measurement result related to the passing device specified by the passing device specifying unit, the malignant flow specifying unit for specifying the malignant flow,
A communication control unit that executes communication control of the malignant flow specified by the malignant flow specifying unit with respect to the communication device;
A congestion control apparatus comprising:
  The congestion control according to claim 22, further comprising a control order specifying unit that specifies an order of malignant flows controlled by the communication control unit when the malignant flow specifying unit specifies a plurality of malignant flows. apparatus.

Images