JP5720340B2 - Control server, communication system, control method and program - Google Patents

Description

  The present invention relates to a control server, a communication system, a control method, and a program for controlling nodes and terminals on a network.

  In recent years, a technique called OpenFlow disclosed in Non-Patent Document 1 and Non-Patent Document 2 has been proposed. OpenFlow is a technology that treats communication as an end-to-end flow and performs path control, failure recovery, load balancing, and optimization on a per-flow basis.

  An OpenFlow Switch that functions as a forwarding node operates according to a flow table instructed to be added or rewritten from an OpenFlow Controller. In the flow table, a set of a rule that matches a packet header for each flow, an action that defines processing contents, and flow statistical information is defined. This set is called a flow entry.

  A packet header (OpenFlow header) in the OpenFlow network includes a VLAN (Virtual Local Area Network) ID, an Ethernet (registered trademark) source address, an Ethernet destination address, an Ethernet type, an IP (Internet Protocol) source address, and an IP transmission. It has information such as a destination address, IP protocol, TCP (Transmission Control Protocol) source port, and TCP destination port.

  The OpenFlow switch searches the flow table for a flow entry that matches the OpenFlow header information of the received packet. If there is a matching entry, the OpenFlow switch performs the defined action. If there is no matching entry, the OpenFlow switch forwards this received packet to the OpenFlow controller through a secure channel that is a link to the OpenFlow controller.

  The OpenFlow controller that has received the packet from the OpenFlow switch determines the packet path based on the transmission source / destination of the received packet, and performs flow setup (Flow Setup).

  The flow setup is to set a flow entry that realizes the determined path for all open flow switches on the determined packet path. Thereafter, a packet belonging to the same flow as the received packet is transferred to each OpenFlow switch according to the set flow entry and sent to the transmission destination. In many cases, such a packet having no matching entry is a packet transferred at the beginning of a certain flow. Therefore, hereinafter, such packets are collectively referred to as first packets. Strictly speaking, there is a case where there is no matching entry other than the first packet transferred due to deletion of the flow entry, and the packet is transferred to the OpenFlow controller.

  On the other hand, Patent Literature 1 and Patent Literature 2 disclose a technique for detecting a connection request packet from a certain terminal to another terminal at a certain node on the network.

  Patent Document 1 discloses a technique for detecting a connection request packet by a packet filter circuit and passing a packet registered in a passage setting table. In Patent Document 1, an interrupt proxy response is made to a 3-way handshake between terminals by a packet filter circuit placed between terminals, and it is determined whether a terminal requesting a connection and its request packet are normal.

  Further, Patent Document 2 discloses a technique for detecting and relaying a connection request packet and a response packet in communication for establishing a connection across two IP networks. In the technique described in Patent Document 2, since response packets for all connection request packets pass through the gateway devices of the respective IP networks, it is assumed that the response packets can always be detected.

JP 2006-345268 A Japanese Patent No. 4392029

Nick McKeown et al., 7 people, OpenFlow: Enabling Innovation in Campus Networks, ACM SIGCOMM Computer Communication Review-Volume 38, 2008 pp. 69-74 OpenFlow Specification Version 1.0.0 (Wire Protocol 0x01), December 31, 2009, [March 8, 2011 search], Internet <URL: http: // www. openflowswitch. org / documents / openflow-spec-v1.0.0. pdf>

  In the OpenFlow network disclosed in Non-Patent Document 1 and Non-Patent Document 2, there is a problem that the performance of the communication system deteriorates due to unnecessary flow setup. Hereinafter, this problem will be described.

  After the flow setup, packets belonging to the flow are transferred to the terminal through the set route. Here, when there is a flow in which only one packet flows, there is no other packet passing through the set-up path, and the flow setup is wasted.

  At this time, processing time and resources of the OpenFlow controller and the OpenFlow switch are allocated to unnecessary flow setup. Furthermore, there is a concern that the flow table of the open flow switch overflows due to an increase in unnecessary flow entries, and that another flow needs to be set up again. As described above, there is a problem that the performance of the communication system deteriorates due to unnecessary flow setup.

  Here, as an example of a technique for detecting a connection request packet, Patent Document 1 and Patent Document 2 described above can be cited, but these techniques cannot solve the above-described problem.

  That is, in the detection technique of Patent Document 1, since it is determined whether or not the host requesting the connection and the request packet are normal, it cannot be determined whether or not the connection has been established between the terminals.

  Further, the detection technique of Patent Document 2 is performed by a gateway device, and it is assumed that response packets for all request packets can be detected without fail. On the other hand, a response packet is not necessarily transferred to the OpenFlow controller. When the flow to which the response packet belongs has already been set in the OpenFlow network, the response packet is transferred to the terminal via the OpenFlow switch only. That is, when the OpenFlow controller identifies a flow for which a connection could not be established, a case where a response packet cannot be detected must be considered.

  The objective of this invention is providing the control apparatus, the communication system, control method, and program which can solve the subject mentioned above.

  A control apparatus according to the present invention is a control apparatus that is connected to a node that performs packet transfer according to a set transfer rule and a terminal that performs communication via a network, and that controls the node and the terminal. Packet detecting means for detecting a response packet to a connection request packet transmitted to another terminal, and whether or not a connection between the terminal and the other terminal has been established according to the reception status of the response packet. A connection establishment determination means for determining, and a transfer rule setting means for setting a transfer rule for the node on the path of the connection request packet and the response packet when the determination result of the connection establishment is successful. It is characterized by providing.

  A communication system according to the present invention includes a node that performs packet transfer according to a set transfer rule, a terminal that performs communication, and a control device that is connected to the node and the terminal via a network and controls the node and the terminal. The control device includes: a packet detection unit that detects a response packet to a connection request packet that the terminal transmits to another terminal; and the terminal and the other according to a reception status of the response packet. A connection establishment judging means for judging whether or not a connection between the terminals is established, and when the connection establishment judgment result is successful, the connection request packet and the response packet are forwarded to the node on the route Transfer rule setting means for setting a rule.

  The control method according to the present invention includes a step of detecting a response packet to a connection request packet transmitted to another terminal by a communicating terminal, and between the terminal and the other terminal according to a reception status of the response packet. A packet transfer according to a set transfer rule that exists on the path of the connection request packet and the response packet when the determination result of the connection establishment is successful and the determination result of the connection establishment is successful And a step of setting a transfer rule for a node that performs the process.

  The program according to the present invention includes a process for detecting a response packet to a connection request packet transmitted to another terminal by a communicating terminal, and between the terminal and the other terminal according to a reception status of the response packet. Processing for determining whether or not a connection has been established, and when the connection establishment determination result is successful, packet transfer is performed according to a set transfer rule existing on the path of the connection request packet and the response packet. And a process for setting a transfer rule for a node to be executed.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to reduce unnecessary flow setup and to improve the performance of a communication system and a communication apparatus.

It is a block diagram which shows the structure of 1st Embodiment by this invention. It is a flowchart which shows operation | movement of 1st Embodiment by this invention. It is a block diagram which shows the structure of 2nd Embodiment by this invention. It is a block diagram which shows the structure of 2nd Embodiment by this invention. It is a block diagram which shows the structure of 2nd Embodiment by this invention. It is a block diagram which shows the structure of 2nd Embodiment by this invention. It is a flowchart which shows the operation | movement of 2nd Embodiment by this invention. It is a flowchart which shows the operation | movement of 2nd Embodiment by this invention. It is a sequence chart which shows the operation | movement of 2nd Embodiment by this invention. It is a sequence chart which shows the operation | movement of 2nd Embodiment by this invention. It is a sequence chart which shows operation | movement of background art. It is a block diagram which shows the structure of 3rd Embodiment by this invention. It is a block diagram which shows the structure of 4th Embodiment by this invention. It is a block diagram which shows the structure of 5th Embodiment by this invention. It is a block diagram which shows the structure of 5th Embodiment by this invention. It is a sequence chart which shows operation | movement of the 6th Embodiment by this invention. It is a sequence chart which shows operation | movement of the 6th Embodiment by this invention. It is a flowchart which shows operation | movement of the 6th Embodiment by this invention. It is a flowchart which shows the operation | movement of 9th Embodiment by this invention. It is a sequence chart which shows the operation | movement of 10th Embodiment by this invention. It is a flowchart which shows the operation | movement of 10th Embodiment by this invention. It is a sequence chart which shows the operation | movement of 11th Embodiment by this invention. It is a sequence chart which shows the operation | movement of 12th Embodiment by this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

<First Embodiment>
(Constitution)
First, a first embodiment of the present invention will be described. FIG. 1 is a block diagram illustrating a configuration of a control device 1000 according to the first embodiment.

  The control apparatus 1000 is connected to a network, and is connected to a node that performs packet transfer and a terminal that performs communication via the network. In addition, the control device 1000 controls the node and the terminal. Note that none of the network, node, and terminal is shown in FIG.

  According to FIG. 1, the control device 1000 includes a packet detection unit 1001, a connection establishment determination unit 1002, and a transfer rule setting unit 1003.

(Operation)
Hereinafter, the operation of the control apparatus 1000 will be described with reference to FIG. FIG. 2 is a flowchart showing the operation of the control apparatus 1000.

  First, the packet detection unit 1001 detects a response packet to a connection request packet that a terminal transmits to another terminal (step S1001).

  Next, the connection establishment determination unit 1002 determines whether or not a connection between the terminal and another terminal has been established according to the detected reception status of the response packet (step S1002).

  Further, the transfer rule setting unit 1003 performs the operation of step S1003 when the determination result by the connection establishment determination unit 1002 is successful (step S1002: Yes). The transfer rule setting means 1003 sets transfer rules for nodes existing on the connection request packet and response packet paths (step S1003).

(effect)
According to the first embodiment, when a connection between terminals controlled by the control apparatus is established, the control apparatus sets a transfer rule for a node on the path between the terminals.

  With the above operation, unnecessary transfer rule setting operation (flow setup) can be reduced, and the performance of the entire communication system including the control device and the control device can be improved.

<Second Embodiment>
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

(System configuration)
First, the overall configuration will be described with reference to FIG. As shown in FIG. 3, the second embodiment is a communication system including a control device 1, a node 2, and a terminal 3.

  In FIG. 3, the node 2 includes two nodes, a node 2A and a node 2B. Similarly, as the terminal 3, there are two terminals, a terminal 3A and a terminal 3B. Hereinafter, when it is not necessary to distinguish each node and each terminal, the node 2A and the node 2B are referred to as a node 2, and the terminal 3A and the terminal 3B are referred to as a terminal 3.

  The node 2 is connected to the control device 1 and forms a control network. This control network may be a dedicated network. For example, in the above-described OpenFlow network, a dedicated network called a secure channel can be considered. The node 2A and the node 2B and the node 2 and the terminal 3 are connected by a network to form a user packet transfer network. In FIG. 1, the terminal 3A is connected to the node 2A, the terminal 3B is connected to the node 2B, and the path between the terminal 3A and the terminal 3B is a path passing through the node 2A and the node 2B. User packets other than the first packet are transferred along this route.

(Configuration of control device)
Then, the structure of the control apparatus 1 is demonstrated in detail with reference to FIG. 4 and FIG.

  As illustrated in FIG. 4, the control device 1 includes a connection monitoring unit 11, a route management unit 12, a packet analysis unit 13, a flow control unit 14, and a node communication unit 15. Hereinafter, each component will be described.

  First, the detailed configuration of the connection monitoring unit 11 is as shown in FIG. According to FIG. 5, the connection monitoring unit 11 includes a packet detection unit 111, a packet registration unit 112, a packet storage unit 113, a connection establishment determination unit 114, and a registration deletion unit 115.

  First, the packet detection unit 111 detects a connection request packet for requesting a connection and a response packet for the connection request packet. The packet registration unit 112 registers the connection request packet in the packet storage unit 113 for detection of the response packet. The packet storage unit 113 stores a connection request packet and information related to the connection request packet. Here, the information registered in the packet storage unit 113 may be any information that can identify the flow to which the request packet belongs. The OpenFlow header of the request packet is sufficient, but it is assumed that the request packet itself is registered.

  When the connection establishment determination unit 114 detects a response packet to the connection request packet stored in the packet storage unit 113, the connection establishment determination unit 114 detects whether or not the connection request is permitted from the response packet. The registration deletion unit 115 deletes the registration of the connection request packet corresponding to the response packet from the packet storage unit 113 when the response establishment packet is detected by the connection establishment determination unit 114.

  Referring to FIG. 4 again, the remaining components of the control device 1 will be described. First, the path management unit 12 holds the topology of the network controlled by the control device 1. Further, when it is necessary to receive the first packet or change the route, the address of the source / destination of the received packet is received and the route of the packet is searched.

  The packet analysis unit 13 analyzes the open flow header of the received packet.

  The flow control unit 14 determines the flow path of the received packet. In addition, a message for causing the node 2 to set a flow entry is generated according to the type of the connection request packet. Furthermore, a transfer message of the first packet is generated.

  The node communication unit 15 communicates with the node 2, receives a fast packet transfer from the node 2, and transmits a flow entry setting message.

(Node configuration)
The node 2 is assumed to be a general OpenFlow switch or a forwarding node similar to the OpenFlow switch. FIG. 6 is a block diagram showing the configuration of the node 2. According to FIG. 6, the node 2 includes a communication processing unit 201 and a flow table 202.

  First, the flow table 202 stores a flow entry set by the control device 1. As described in the background art section, this flow entry includes a rule for checking a packet header and an action indicating the processing content for the packet.

  The communication processing unit 201 determines whether there is a flow entry corresponding to the flow table 202 for the received packet. If there is a flow entry for the received packet, the packet is processed according to the action described in the flow entry. As processing contents, not only packet transfer but also packet discarding or the like may be performed. If there is no flow entry corresponding to the received packet, the packet is transferred to the control device 1 as a first packet.

(Overall operation)
Next, the operation of the second embodiment will be described.

  First, the overall operation when a packet is transmitted from the terminal 3A to the terminal 3B will be described with reference to the flowchart of FIG.

  First, a packet is transmitted from the terminal 3A (step S1101). The node 2A connected to the terminal 3A receives this packet (step S1102).

  Next, the node 2A searches the flow table for a flow entry corresponding to the received packet (step S1103). If there is a corresponding flow entry, the node 2A transfers the packet to the node 2B close to the destination terminal 3B according to the instruction, and transfers this packet to the destination terminal 3B via the node 2B (step S1108). . Note that the same operation as in steps S1102 and S1103 is also performed in the node 2B.

  If there is no corresponding flow entry in step S1103, the node 2A transfers this packet to the control device 1 as a first packet (step S1104).

  The control device 1 determines the path of the flow to which this packet belongs from the VLAN ID and Ethernet, IP, or TCP source / destination address of the OpenFlow header of the received first packet (step S1105). Any route determination algorithm may be used as the route determination method.

  Furthermore, the control device 1 determines whether or not the received packet is a connection request packet or a response packet. If the received packet is a response packet, the control device 1 determines connection establishment (step S1106).

  When the connection establishment is successful, the control device 1 performs flow setup of the flow to which the connection request packet belongs and the flow to which the response packet belongs. The control device 1 generates and forwards a flow setting message to the nodes 2A and 2B on the route, and sets flow entries in the flow tables of the nodes 2A and 2B (step S1107).

  Finally, the control device 1 transfers the first packet to the node 2B close to the destination terminal, and transfers the packet from the node 2B to the destination terminal 3B (step S1108).

  The operation of the control device 1 from step S1106 to step S1108 will be described in detail below.

(Operation of control device)
Next, the operation of the control device 1 will be described in detail with reference to the flowchart of FIG.

  First, the control device 1 receives a packet using the first packet as data in the node communication unit 15 (step S501). The node communication unit 15 processes this packet, extracts the first packet, and passes it to the packet analysis unit 13.

  Subsequently, the first packet is analyzed by the packet analysis unit 13 and the connection monitoring unit 11 (step S502). The packet analysis unit 13 analyzes the header of the first packet and obtains information about the source and destination of the first packet. In the connection monitoring unit 11, the packet detection unit 111 analyzes whether the packet is a packet requesting a connection or a response packet from a protocol header that provides a connection such as TCP. In the case of TCP, whether it is a connection request packet or its response packet is detected based on bits representing header synchronization (SYN), reception confirmation (ACK), and connection reset (RST).

  Subsequently, the packet detection unit 111 collates with the connection request packet registered in the packet storage unit 113 in order to identify whether the response packet is being monitored (step S503). The packet detection unit 111 determines whether the received packet is a response packet stored in the packet storage unit 113 and being monitored, and the operation branches to step S506 or step S510 depending on the result (step S504).

  If the packet detector 111 determines in step S504 that the received packet is not a response packet, the packet detector 111 further determines whether the received packet is a connection request packet (step S505).

  When the packet detection unit 111 detects a connection request packet in step S505, the connection request packet or information related thereto is registered in the connection monitoring unit 11 (step S509). Thereafter, the packet detection unit 111 detects the response packet by checking whether the received response packet corresponds to each registered request packet.

  If the packet detection unit 111 determines in step S504 that the received packet is a response packet being monitored, step S510 is performed. When the response packet is detected, the registration of the connection request packet corresponding to the detected response packet is deleted (step S510). Request packets that have passed a certain time since registration are also deleted.

  Subsequently, the connection establishment determination unit 114 determines whether the received first packet indicates permission for connection establishment (step S511).

  The operation of the flow control unit 14 with respect to the received first packet is changed by the detection by the connection monitoring unit 11 (step S505 or step S511).

  The flow control unit 14 receives a packet from the connection monitoring unit 11 and determines a flow path using the path management unit 12. The route management unit 12 receives the source and destination addresses of the received packet as input, and searches for a route connecting the two points based on the held network topology (step S506).

  Thereafter, the flow setup is performed according to the result detected by the connection monitoring unit 11 (steps S507 and S512). Here, if the received first packet is a packet requesting a connection or a packet returning a rejection in response to a connection request, the flow setup is not performed. If the received first packet is a packet that returns a permission response to the connection request, flow setup is performed for the flow to which the connection request packet belongs and the flow to which the response packet belongs (step S512). For other packets, flow setup is performed for the flow to which the packet belongs (step S507).

  The flow setup is performed as follows. First, the flow control unit 14 creates a flow entry setting message. Next, the node communication unit 15 transfers the created flow entry setting message to the nodes 2A and 2B corresponding to the flow path. In step S512, the route information stored in step S509 is used as the route of the request packet.

  Finally, the received first packet is transferred (step S508). First, the flow control unit 14 generates a first packet transfer message. This transfer message is transferred by the node communication unit 15 to the node 2B connected to the terminal 3B as the transmission destination, and the first packet is transferred from the node 2B to the terminal 3B.

  The operation of the second embodiment has been described above with reference to the flowchart. Hereinafter, the operation of the control device 1, the node 2, and the terminal 3 when the connection is successfully established and failed will be described with reference to a sequence chart, taking an example of a connection request from the terminal 3A to the terminal 3B.

  First, with reference to FIG. 9, the operation when connection establishment fails will be described.

  First, a packet requesting a connection is transmitted from the terminal 3A (step S101). The transmission source of this connection request packet is the terminal 3A, and the transmission destination is the terminal 3B.

  Receiving this connection request packet, the node 2A searches for the corresponding flow entry from the flow table, but does not find it, and transfers it to the control device 1 as a first packet (step S102).

  The control device 1 analyzes the received packet, determines that it is a connection request packet, and registers the connection request packet in the packet storage unit 113 in order to monitor a response packet to the connection request packet (step S103). . Next, a route search is performed based on the transmission source / destination information (step S104), and the route is determined. At this time, since the received packet is a request packet, flow setup is not performed. Then, the received packet is transferred from the node 2B connected to the terminal 3B to the terminal 3B (step S105).

  The terminal 3B receives the connection request packet and returns a response packet that rejects the connection request packet (step S106). The transmission source of this response packet is the terminal 3B, and the transmission destination is the terminal 3A.

  Receiving this response packet, the node 2B searches for the corresponding flow entry from the flow table, but does not find it, and transfers it to the control device 1 as a first packet (step S107).

  The control device 1 analyzes the received packet, determines that it is a response packet to the registered request packet, and deletes the registration of the request packet (step S108).

  Further, the control device 1 determines that the response packet rejects the connection. Next, a route search is performed based on the transmission source / destination information (step S109), and the route is determined. At this time, since the response packet rejects the connection, the flow setup is not performed. Finally, this packet is transferred from the node 2A connected to the terminal 3A to the terminal 3A (step S110).

  Next, the operation when the connection between the terminal 3A and the terminal 3B is successfully established will be described with reference to the sequence chart of FIG.

  First, the operation (step S201 to step S205) until the connection request packet is transferred from the terminal 3A to the terminal 3B is the same as the operation of step S101 to step S105 in FIG. 9 described above.

  After receiving the connection request packet, the terminal 3B returns a response packet that permits the connection request (step S206). The transmission source of this response packet is the terminal 3B, and the transmission destination is the terminal 3A.

  Receiving this response packet, the node 2B searches for the corresponding flow entry from the flow table. However, since it is not found, the node 2B transfers it to the control device 1 as a first packet (step S207).

  The control device 1 analyzes the received packet, determines that it is a response packet to the registered request packet, and deletes the registration of the request packet (step S208).

  Further, the control device 1 determines that the response packet is one that permits the connection. Next, a route search is performed based on the transmission source / destination information (step S209), and the route is determined. At this time, it is also possible to set the route so that the flow to which the request packet belongs and the flow to which the response packet belongs pass through different routes. Since the response packet permits the connection, the control device 1 performs flow setup for the flow from the terminal 3A to the terminal 3B and the flow from the terminal 3B to the terminal 3A (step S210). Finally, this response packet is transferred from the node 2A connected to the terminal 3A to the terminal 3A (step S211).

  Next, a case where only one of the connection request packet or the response packet is transferred to the control device 1 in the second embodiment will be described.

  In an OpenFlow network, even a packet that flows at the start of a connection may hit a flow entry and not be transferred to the control device 1. This phenomenon may occur when a flow entry that has been set at the time of previous communication remains on the node or when a flow entry by a wild card exists. Note that the above-described wild card flow entry indicates that a corresponding action is performed when the header of the received packet matches a part of the flow entry.

  Therefore, when only one of the connection request packet and the response packet is transferred to the control device 1, it is necessary to ensure consistency. In such a case, consistency is ensured as follows.

  First, when only the connection request packet is transferred to the control device 1, the control device 1 detects that the response packet is not transferred to the control device 1 within a predetermined time, and registers the connection request packet in the packet storage unit 113. Is deleted. The flow setup to which the connection request packet belongs is performed by transferring the packet received immediately after to the control device 1 as a first packet. The case where only the response packet is transferred to the control device 1 is the same as the connection request packet.

  With the above operation, even if only one of the connection request packet or the response packet is transferred to the control device 1, the second registration can be performed without any problem by deleting the registration of the packet storage unit 113 after a certain period of time. It is possible to perform the operation of the embodiment.

(effect)
According to the second embodiment, unnecessary flow setup for two flows (connection request packet and response packet) when connection establishment fails is reduced. In addition, since the unnecessary flow entry is not set in the flow table, the performance of the control device and the communication system including the control device is improved.

  The above-described effect will be described by comparing the operation in the general OpenFlow network shown in FIG. 11 with the operation of the second embodiment shown in FIGS. 9 and 10.

  When connection establishment fails, the operations of the two flow setups in steps S004 and S009 can be reduced among the operations in the OpenFlow network shown in FIG. More specific processing reduced by this includes generation of a flow entry setting message in the flow control unit 14, message transfer between the control device 1 and the node 2, and addition of a flow entry to the flow table in the node 2. It is.

  In addition, when connection establishment fails, an unnecessary flow entry is not created in the node 2 flow table, and as a result, the number of flow entries in the node 2 is reduced. Therefore, there is an effect that the search speed of the flow table in the node 2 is improved.

  Furthermore, a decrease in the number of reflow setups that occur when the flow table overflows due to an increase in flow entries can be expected.

  In addition, when a configuration in which the control device 1 and the node 2 are connected by a dedicated network different from the user packet transfer network, a message is transmitted between the control device 1 and the node 2 in the flow setup process. It is necessary to perform encryption / decompression processing when transferring. Therefore, when such a configuration is adopted, the flow setup processing time is longer than when a dedicated network is not used between the control device 1 and the node 2. Therefore, when the second embodiment is applied to a network having such a configuration, the above-described effect is further increased.

<Third Embodiment>
Next, a third embodiment of the present invention will be described. As shown in FIG. 12, the third embodiment includes a network device 4 that provides functions of the control device 1 and the node 2, and a terminal 3. The control device 1 controls the node 2 without going through the network, and sets a flow table or a transfer rule that the node 2 has.

  According to the third embodiment, it is possible to obtain the same effect as that of the second embodiment.

<Fourth Embodiment>
Next, a fourth embodiment of the present invention will be described. As shown in FIG. 13, the fourth embodiment includes a plurality of control devices 1. The node 2 is controlled by one control device 1, and each control device 1 operates independently without cooperating with other control devices 1. In the example of FIG. 13, the control device 1A controls the nodes 2A and 2B, and the control device 1B controls the nodes 2C and 2D. The terminal 3A is connected to the node 2A, the terminal 3B is connected to the node 2B, the terminal 3C is connected to the node 2C, and the terminal 3D is connected to the node 2D.

  At this time, one control device 1 and a node 2 controlled by the control device 1 constitute one communication system. In the example of FIG. 13, the control device 1A and the nodes 2A and 2B controlled by the control device 1A constitute one communication system. By applying the configuration and operation of each communication system in the second embodiment, it is possible to obtain the same effect as in the second embodiment.

<Fifth Embodiment>
Next, a fifth embodiment of the present invention will be described. As shown in FIG. 14, the fifth embodiment includes a plurality of control devices 1 and a plurality of nodes 2. The node 2 is controlled by one control device 1, and the control device 1 operates in cooperation with the other control device 1. In FIG. 14, the control device 1A and the control device 1B operate in cooperation. Hereinafter, when it is not necessary to distinguish between them, the control device 1A and the control device 1B are collectively referred to as the control device 1. The configuration other than the control device 1 is the same as that of the fourth embodiment (FIG. 13), and thus the description thereof is omitted.

  As shown in FIG. 15, a registration information synchronization unit 16 that maintains the consistency of information registered in the connection monitoring unit 11 among a plurality of control devices is added to the control device 1. The registration information synchronization unit 16 operates when the connection monitoring unit 11 registers or deletes information related to the connection request packet. The registration information synchronization unit 16 forwards a message in which a flag of registration or deletion is added to information related to the connection request packet to all or some of the control devices 1 operating in cooperation.

  For example, when the control device 1A detects a request packet, the registration information synchronization unit 16 transfers an entry in which the ID of the control device 1A is added to the registration information of the connection monitoring unit 11 to the control device 1B. In the control apparatus 1 </ b> B that has received this, the registration information synchronization unit 16 registers this entry in the connection monitoring unit 11.

  When the control device 1A detects the registered response packet, the registration information synchronization unit 16 transfers the entry information to the control device 1B, and the registration information synchronization unit 16 of the control device 1B that has received the registration information This entry is deleted from the monitoring unit 11. Depending on the cooperation method of the control device 1, it is also assumed that the connection request packet and the response packet are transferred only to a part of the control devices 1 that manage the nodes 2 that are the flow paths to which the connection request packet and the response packet belong.

  According to the fifth embodiment, the same effect as that of the second embodiment can be obtained even in a network including a plurality of control devices 1.

<Sixth Embodiment>
Next, a sixth embodiment of the present invention will be described. The sixth embodiment is different from the second embodiment in that the response packet path is set in the reverse direction of the connection request packet path based on the connection request packet path.

  In the second embodiment, the flow to which the request packet belongs and the flow to which the response packet belongs are set to different paths when a bidirectional flow is set to another path in consideration of network congestion and security level differences. Is done. In addition, it may be assumed that the network status has changed during the route search of two types of packets, that is, a connection request packet and a response packet.

  On the other hand, when the route is determined by a simple method, the route is determined based on the topology information, and the route is searched and determined so that the topological distance between the two points is the shortest. At this time, two flows whose transmission source and transmission destination are opposite are determined to be the same route.

  In addition, when establishing a connection between terminals, a route is determined twice for a two-way flow in a short period until one terminal issues a connection request packet and receives a response packet. It is likely that they will be the same. In this case, the process for producing the same result is performed twice.

  In the sixth embodiment, in order to monitor bidirectional communication in which a connection is established, when a connection request packet is detected, route information is stored in the packet storage unit 113 in addition to information such as the transmission source and destination of the connection request packet. Keep it. When a response packet is detected, this route information is referred to, and in the case of the same route, the route search of the bidirectional flow can be reduced from twice to one by omitting the route search.

  The operation according to the sixth embodiment is shown in FIGS. FIG. 16 shows the operation when connection establishment fails. 16 is different from the operation of the second embodiment shown in FIG. 9 in that there is no response packet route search (FIG. 9: step S109).

  Similarly, the operation of FIG. 17 showing the case where the connection is successfully established is different in that there is no route search for the response packet (FIG. 10: step S209) in the operation of the second embodiment shown in FIG.

  The operation of the control device 1 according to the sixth embodiment is shown in FIG. The operation of FIG. 18 is different from the operation of the control device 1 in the second embodiment shown in FIG. 8 in that the route search (step S506 after step S511) is not performed for the response packet being monitored.

  As described above, in the sixth embodiment, since the route search of the response packet is not performed, an effect of improving the response packet processing speed can be obtained. Moreover, the effect by 2nd Embodiment can be acquired similarly.

<Seventh Embodiment>
Next, a seventh embodiment of the present invention will be described. The seventh embodiment is different from the second embodiment and the sixth embodiment in that the route search is not performed until the connection establishment success is determined.

  Since the transfer of the first packet is transferred to the node 2 closest to the transfer destination terminal, there is no need to search for the route of the flow. In the seventh embodiment, the node 2 closest to the transfer destination is specified from the transmission destination information of the connection request packet. When storing the information of the connection request packet, the information of the node 2 to which the connection request packet has been transferred and the information of the port that has entered the node 2 are also stored in the packet storage unit 113. When a response packet is detected, the response packet is transferred to the stored node 2 and input port. After analyzing the response packet and specifying the connection establishment, the route search and the forwarding rule are set.

  As described above, in the seventh embodiment, an effect of improving the processing speed of the request packet and the response packet can be obtained by performing the route search after specifying the connection establishment. Moreover, the effect by other embodiment can be acquired similarly.

<Eighth Embodiment>
Next, an eighth embodiment of the present invention will be described. In the eighth embodiment, a flow entry setting message for setting up a flow to which a connection request packet belongs and a flow to which a response packet belongs is transferred to the node 2 in the same packet.

  In a network to which OpenFlow is applied, a configuration may be adopted in which a flow entry setting message is passed from an OpenFlow controller (control device 1) to an OpenFlow switch (Node 2) serving as a route through a secure channel that is a dedicated line. is there.

  In such a case, packet processing including encryption / decryption processing is required for each packet. For this reason, by transferring two messages together in one packet, it is possible to transfer two messages in a time shorter than the processing time in which each is transferred in two packets.

  In the second embodiment, two flow entry setting messages are divided into two packets and transferred to the node 2 existing on the flow path to which the connection request packet belongs and the flow to which the response packet belongs.

  On the other hand, in the eighth embodiment, the flow entry setting messages for the same node 2 are transferred together in one packet. According to the eighth embodiment, the total packet processing can be reduced in the control device 1 and the node 2, and the effect that the flow setup is speeded up can be obtained. In particular, when the flow to which the connection request packet belongs and the flow to which the response packet belongs are set to the same route, this effect can be obtained for all the nodes 2 that transfer the message. Furthermore, the effect by 2nd Embodiment can be acquired similarly.

<Ninth Embodiment>
Next, a ninth embodiment of the present invention will be described. In the ninth embodiment, only the packet to be connected is compared with the monitoring packet.

  In the second embodiment, the connection monitoring unit 11 checks whether all the first packets are response packets being monitored. That is, verification is also performed for a packet of a protocol that does not establish a connection.

  Therefore, in the ninth embodiment, it is determined whether the previously received packet is a packet of a protocol for establishing a connection. When the received packet is a packet of a protocol for establishing a connection, it is verified whether it is a response packet being monitored.

  FIG. 19 shows an operation according to the ninth embodiment. After receiving the first packet (step S701), at the time of packet analysis (step S702), it is determined whether or not the received packet is a packet of a protocol for establishing a connection (step S713).

  If the received packet is not a protocol packet for establishing a connection, steps S706 to S708 are performed without checking whether the received packet is a response packet being monitored in step S703.

  If the received packet is a packet of a protocol for establishing a connection, it is checked whether it is a response packet being monitored (step S703), and thereafter the same operation as in the second embodiment shown in FIG. 8 is performed.

  Compared to the second embodiment, in the ninth embodiment, when a protocol packet that establishes a connection is received as a first packet, it is not verified whether the packet is a response packet being monitored. Therefore, the processing speed of the first packet is improved. effective. Furthermore, the effect by 2nd Embodiment can be acquired similarly.

<Tenth Embodiment>
Next, a tenth embodiment of the present invention will be described. The tenth embodiment targets a protocol that performs a 3-way handshake such as TCP.

  In the three-way handshake, a case where a connection is established from the terminal 3A to the terminal 3B will be described with reference to FIG. First, the terminal 3A transmits a connection request packet (1) to the terminal 3B. Next, the terminal 3B transmits a packet (2) that is a response packet and also a connection request packet to the terminal 3A. Finally, the terminal 3A transmits a response packet (3) to the terminal 3B.

  When the protocol for performing the 3-way handshake is targeted, first, the response packet (2) is monitored by the connection request packet (1) from the terminal 3A to the terminal 3B. At the same time, the response packet (2) transmitted from the terminal 3B to the terminal 3A is also detected as a connection request packet.

  Thus, in the tenth embodiment, as shown in FIG. 21, it is determined whether or not the packet is a connection request packet (step S805), and whether or not the response packet is being monitored is checked (step S803). Since other operations are the same as those in the second embodiment, description thereof will be omitted.

  According to the tenth embodiment, first, it is possible to reduce the number of packets to be verified as to whether the received packet is a response request packet by determining whether the received packet is a connection request packet. Therefore, the effect that the processing time of the first packet is shortened compared with the second embodiment can be obtained. Furthermore, the effect by 2nd Embodiment can be acquired similarly.

<Eleventh embodiment>
Next, an eleventh embodiment of the present invention will be described. In the eleventh embodiment, a flow entry setting message for a flow to which a connection request packet belongs is generated before the connection request packet is transferred.

  In the second embodiment, as shown in FIG. 10, after detecting connection establishment from the response packet (step S206), a flow entry setting message for the flow to which the connection request packet belongs is generated, and the flow setup in step S210 is performed. I was going.

  In the eleventh embodiment, this flow entry setting message is generated between step S203 and step S205 performed before step S206. FIG. 22 shows operations according to the eleventh embodiment. In the example of FIG. 22, a flow entry setting message is generated immediately after step S204 (step S212). The flow entry setting message may be generated at any time as long as it is between step S203 and step S205. Further, the other operations of the eleventh embodiment are the same as those of the second embodiment, and thus the description thereof is omitted here.

  According to the eleventh embodiment, by performing the flow entry setting message before receiving the response packet, the flow entry setting message can be reliably generated before the response packet is received, and the response packet processing can be speeded up. It becomes. Furthermore, the effect by 2nd Embodiment can be acquired similarly.

<Twelfth Embodiment>
Next, a twelfth embodiment of the present invention will be described. In the twelfth embodiment, a flow entry setting message for a flow to which a connection request packet belongs is generated after the connection request packet is transferred.

  FIG. 23 shows operations according to the twelfth embodiment. According to FIG. 23, in the eleventh embodiment, the flow entry setting message generation that was performed between step S203 and step S205 is performed after step S205 (step S213). Since other operations are the same as those in the second embodiment, the description thereof is omitted here.

  According to the twelfth embodiment, transfer of connection request packets can be prioritized by generating a flow entry setting message after transfer of connection request packets. Therefore, an effect of shortening the processing time of the connection request packet can be obtained as compared with the second embodiment. In addition, as described in the eleventh embodiment, if the flow entry setting message is generated before the response packet is received, the response packet can be processed at high speed. Furthermore, the effect by 2nd Embodiment can be acquired similarly.

  While the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  Although the third embodiment to the twelfth embodiment have been described while comparing with the second embodiment, the above-described embodiments can be combined as appropriate.

  In the above-described embodiment, the network to which OpenFlow is applied has been described. However, the present invention is not limited to this. Even if it is other than OpenFlow, it can be applied as long as the control server or the like performs network centralized management.

  In addition, the control device according to the above-described embodiment can realize the functions of the control device by hardware, and can also be realized by a computer and a program executed on the computer. The program is provided by being recorded on a recording medium such as a magnetic disk or a semiconductor memory, and is read by the computer when the computer is started up. In this way, the operation of the computer is controlled, the computer is caused to function as the control device in each of the above-described embodiments, and the above-described processing is performed.

  Further, a part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

(Appendix 1)
A control device that is connected to a node that performs packet transfer according to a set transfer rule and a terminal that performs communication via a network, and that controls the node and the terminal,
A packet detection means for detecting a response packet to a connection request packet transmitted from the terminal to another terminal;
Connection establishment determination means for determining whether or not a connection between the terminal and the other terminal is established according to the reception status of the response packet;
A transfer rule setting means for setting a transfer rule for the node on the path of the connection request packet and the response packet when the connection establishment determination result is successful;
A control device comprising:

(Appendix 2)
The control device further includes:
A connection request packet determining means for determining whether or not the received packet is the connection request packet when it is detected that the received packet is not the response packet;
The transfer rule setting means further sets a transfer rule for the node on the path of the connection request packet when the received packet is determined to be the connection request packet. The control device described.

(Appendix 3)
The control device further includes:
Packet storing means for storing information for specifying the connection request packet;
The packet detection means uses the packet storage means to determine whether the received packet is a response packet to the stored connection request packet, and whether the transmission source and the transmission destination of the stored connection request packet are opposite. 3. The control device according to appendix 1 or 2, wherein detection is performed by collating them.

(Appendix 4)
The supplementary note 3 is characterized in that the packet detection unit deletes the stored connection request packet registration when a response packet to the connection request packet stored in the packet storage unit is not received for a certain period of time. Control device.

(Appendix 5)
The control device further includes:
The control apparatus according to appendix 3 or 4, further comprising registration information synchronization means for synchronizing information related to the connection request packet stored in the packet storage means between the control apparatus and another control apparatus. .

(Appendix 6)
The control device further includes a route management unit that determines a route of the received packet,
The packet storage means further stores route information of the connection request packet;
The control device according to any one of appendices 3 to 5, wherein the route management unit determines a route of the response packet with reference to a route of the connection request packet stored in the packet storage unit .

(Appendix 7)
The packet storage unit further stores, as information of the connection request packet, an input node of the connection request packet and input port information of the input node. The control device described.

(Appendix 8)
The transfer rule setting means simultaneously sets a transfer rule corresponding to the connection request packet and a transfer rule corresponding to the response packet for nodes on the path of the connection request packet and the response packet. 8. The control device according to any one of appendices 1 to 7, which is characterized.

(Appendix 9)
The control device further includes:
A connection packet judging means for judging whether or not the received packet is a packet of a protocol requiring a connection;
The connection establishment determining means determines that the received packet is a packet of a protocol that requires the connection, and the received packet is a response packet to a connection request packet stored in the packet storage means. According to the reception status of the response packet, determine whether a connection between the terminal and the other terminal has been established,
The transfer rule setting means further determines that the received packet is not a packet of a protocol that requires the connection, or that the received packet is not a response packet to a connection request packet stored in the packet storage means. The control device according to any one of appendices 3 to 8, wherein when it is the connection request packet, a transfer rule is set for the node on the path of the received packet.

(Appendix 10)
The control device further includes:
Connection request packet determining means for determining whether a received packet is the connection request packet;
The transfer rule setting means further sets a transfer rule for the node on the path of the connection request packet when the received packet is determined to be the connection request packet,
The connection establishment determination means determines whether or not a connection between the terminal and the other terminal is established according to the reception status of the response packet when it is determined that the received packet is not the connection request packet. The control device according to any one of supplementary notes 1 and 3 to 8, wherein

(Appendix 11)
The transfer rule setting means stores the information on the connection request packet in the packet storage means and then receives a response packet for the connection request packet until the connection request packet and the response packet are routed. 11. The control device according to any one of appendices 3 to 10, wherein a transfer rule for the node is created.

(Appendix 12)
A node that performs packet transfer according to a set transfer rule, a terminal that performs communication, and a control device that is connected to the node and the terminal via a network and controls the node and the terminal,
The controller is
A packet detection means for detecting a response packet to a connection request packet transmitted from the terminal to another terminal;
Connection establishment determination means for determining whether or not a connection between the terminal and the other terminal is established according to the reception status of the response packet;
A transfer rule setting means for setting a transfer rule for the node on the path of the connection request packet and the response packet when the connection establishment determination result is successful;
A communication system comprising:

(Appendix 13)
The control device further includes:
A connection request packet determining means for determining whether or not the received packet is the connection request packet when it is detected that the received packet is not the response packet;
The transfer rule setting means further sets a transfer rule for the node on the path of the connection request packet when the received packet is determined to be the connection request packet. The communication system described.

(Appendix 14)
The control device further includes:
Packet storing means for storing information for specifying the connection request packet;
The packet detection means uses the packet storage means to determine whether the received packet is a response packet to the stored connection request packet, and whether the transmission source and the transmission destination of the stored connection request packet are opposite. 14. The communication system according to appendix 12 or 13, wherein the communication is detected by collating.

(Appendix 15)
Item 14. The supplementary note 14, wherein the packet detection unit deletes the stored connection request packet registration when a response packet to the connection request packet stored in the packet storage unit is not received for a certain period of time. Communication system.

(Appendix 16)
The control device further includes:
The communication system according to appendix 14 or 15, further comprising registration information synchronization means for synchronizing information related to the connection request packet stored in the packet storage means between the control device and another control device. .

(Appendix 17)
The control device further includes a route management unit that determines a route of the received packet,
The packet storage means further stores route information of the connection request packet;
The communication system according to any one of appendices 14 to 16, wherein the path management unit determines a path of the response packet with reference to a path of the connection request packet stored in the packet storage unit. .

(Appendix 18)
The packet storage means further stores, as information of the connection request packet, an input node of the connection request packet and input port information of the input node. The communication system described.

(Appendix 19)
The transfer rule setting means simultaneously sets a transfer rule corresponding to the connection request packet and a transfer rule corresponding to the response packet for nodes on the path of the connection request packet and the response packet. The communication system according to any one of appendices 12 to 18, which is characterized by the following.

(Appendix 20)
The control device further includes:
A connection packet judging means for judging whether or not the received packet is a packet of a protocol requiring a connection;
The connection establishment determining means determines that the received packet is a packet of a protocol that requires the connection, and the received packet is a response packet to a connection request packet stored in the packet storage means. According to the reception status of the response packet, determine whether a connection between the terminal and the other terminal has been established,
The transfer rule setting means further determines that the received packet is not a packet of a protocol that requires the connection, or that the received packet is not a response packet to a connection request packet stored in the packet storage means. 20. The communication system according to any one of appendices 14 to 19, wherein when it is the connection request packet, a transfer rule is set for the node on the path of the received packet.

(Appendix 21)
The control device further includes:
Connection request packet determining means for determining whether a received packet is the connection request packet;
The transfer rule setting means further sets a transfer rule for the node on the path of the connection request packet when the received packet is determined to be the connection request packet,
The connection establishment determination means determines whether or not a connection between the terminal and the other terminal is established according to the reception status of the response packet when it is determined that the received packet is not the connection request packet. The communication system according to any one of appendices 12 and 14 to 19, characterized by:

(Appendix 22)
The transfer rule setting means stores the information on the connection request packet in the packet storage means and then receives a response packet for the connection request packet until the connection request packet and the response packet are routed. The communication system according to any one of appendices 14 to 21, wherein a transfer rule for the node is created.

(Appendix 23)
A step of detecting a response packet to a connection request packet transmitted from a communicating terminal to another terminal;
Determining whether a connection between the terminal and the other terminal is established according to the reception status of the response packet;
A step of setting a transfer rule for a node that performs packet transfer in accordance with a set transfer rule that exists on a path of the connection request packet and the response packet when the determination result of the establishment of the connection is successful;
The control method characterized by including.

(Appendix 24)
The control method further includes:
Determining whether the received packet is the connection request packet when it is detected that the received packet is not the response packet;
When the received packet is determined to be the connection request packet, setting a transfer rule for the node on the path of the connection request packet;
The control method according to appendix 23, comprising:

(Appendix 25)
The control method further includes:
Storing information identifying the connection request packet;
Whether the received packet is a response packet to the stored connection request packet, information that identifies the stored connection request packet whether the source and destination of the stored connection request packet are opposite is used Detecting by collating
The control method according to appendix 23 or 24, characterized by comprising:

(Appendix 26)
The control method further includes:
The control method according to claim 25, further comprising the step of deleting registration of the stored connection request packet when a response packet to the stored connection request packet has not been received for a predetermined time.

(Appendix 27)
The control method further includes:
27. The control method according to appendix 25 or 26, further comprising a step of synchronizing the stored information related to the connection request packet between a plurality of control devices that control the node and the terminal.

(Appendix 28)
The step of storing information identifying the connection request packet further stores route information of the connection request packet,
The control method further includes:
28. The control method according to any one of appendices 25 to 27, further comprising a step of determining a path of the response packet with reference to a path of the connection request packet stored in the packet storage unit.

(Appendix 29)
The step of storing information for specifying the connection request packet further includes storing an input node of the connection request packet and input port information of the input node as information of the connection request packet. 28. The control method according to any one of 1 to 28.

(Appendix 30)
The step of setting the transfer rule simultaneously sets a transfer rule corresponding to the connection request packet and a transfer rule corresponding to the response packet for the nodes on the path of the connection request packet and the response packet. The control device according to any one of appendices 23 to 29, characterized in that:

(Appendix 31)
The control method further includes:
Determining whether the received packet is a packet of a protocol that requires a connection;
In the step of determining whether or not the connection has been established, it is determined that the received packet is a packet of a protocol that requires the connection, and a response to the connection request packet stored in the packet storage unit. If it is a packet, according to the reception status of the response packet, determine whether a connection between the terminal and the other terminal has been established,
The step of setting the transfer rule further includes a response to a connection request packet stored in the packet storage means when the received packet is determined not to be a packet of a protocol that requires the connection. 31. The control method according to any one of appendices 25 to 30, wherein a transfer rule is set for the node on the path of the received packet when the connection request packet is not a packet.

(Appendix 32)
The control method further includes:
Determining whether a received packet is the connection request packet;
The step of setting the transfer rule further sets the transfer rule for the node on the path of the connection request packet when the received packet is determined to be the connection request packet.
In the step of determining whether or not the connection has been established, when it is determined that the received packet is not the connection request packet, depending on the reception status of the response packet, between the terminal and the other terminal 31. The control method according to any one of appendices 23 and 25 to 30, wherein it is determined whether or not a connection has been established.

(Appendix 33)
The control method further includes:
Including a step of creating a transfer rule for a node on a path of the connection request packet and the response packet after storing the information of the connection request packet and before receiving a response packet to the connection request packet. 33. The control method according to any one of appendices 25 to 32, which is characterized.

(Appendix 34)
A process for detecting a response packet to a connection request packet transmitted from a communicating terminal to another terminal;
A process of determining whether or not a connection between the terminal and the other terminal is established according to the reception status of the response packet;
A process for setting a transfer rule for a node that performs packet transfer in accordance with a set transfer rule that exists on the path of the connection request packet and the response packet when the determination result of the establishment of the connection is successful;
A program that causes a computer to execute.

(Appendix 35)
The program further includes:
When it is detected that the received packet is not the response packet, a process for determining whether the received packet is the connection request packet;
When the received packet is determined to be the connection request packet, processing for setting a transfer rule for the node on the path of the connection request packet;
35. The program according to appendix 34, including:

(Appendix 36)
The program further includes:
Storing information for identifying the connection request packet;
Whether the received packet is a response packet to the stored connection request packet, information that identifies the stored connection request packet whether the source and destination of the stored connection request packet are opposite is used Processing that is detected by collating
36. The program according to appendix 34 or 35, characterized by including:

(Appendix 37)
The program further includes:
37. The program according to appendix 36, further comprising a process of deleting registration of the stored connection request packet when a response packet to the stored connection request packet has not been received for a predetermined time.

(Appendix 38)
The program further includes:
38. The program according to appendix 36 or 37, further comprising a process of synchronizing information about the stored connection request packet between a plurality of control devices that control the node and the terminal.

(Appendix 39)
The process of storing information for specifying the connection request packet further stores route information of the connection request packet,
The program further includes:
39. The program according to any one of appendices 36 to 38, further comprising a process of determining a path of the response packet with reference to a path of the connection request packet stored in the packet storage unit.

(Appendix 40)
The processing for storing the information for specifying the connection request packet further includes storing an input node of the connection request packet and input port information of the input node as information of the connection request packet. 40. The program according to any one of 1 to 39.

(Appendix 41)
The process for setting the transfer rule is to simultaneously set a transfer rule corresponding to the connection request packet and a transfer rule corresponding to the response packet for the nodes on the path of the connection request packet and the response packet. 41. The control device according to any one of supplementary notes 34 to 40, wherein:

(Appendix 42)
The program further includes:
Including determining whether the received packet is a packet of a protocol that requires a connection;
The process of determining whether or not the connection has been established is a response to a connection request packet in which the received packet is determined to be a protocol packet that requires the connection, and the received packet is stored in the packet storage means If it is a packet, according to the reception status of the response packet, determine whether a connection between the terminal and the other terminal has been established,
The processing for setting the transfer rule is further performed when the received packet is determined not to be a packet of a protocol that requires the connection, or a response to the connection request packet stored in the packet storage unit by the received packet. 42. The program according to any one of appendices 36 to 41, wherein a transfer rule is set for the node on the path of the received packet when the connection request packet is not a packet.

(Appendix 43)
The program further includes:
Including determining whether a received packet is the connection request packet;
The process of setting the transfer rule further sets the transfer rule for the node on the path of the connection request packet when the received packet is determined to be the connection request packet.
The process of determining whether or not the connection has been established is performed when the received packet is not the connection request packet, depending on the reception status of the response packet, between the terminal and the other terminal. 42. The program according to any one of appendices 34 and 36 to 41, which determines whether or not a connection has been established.

(Appendix 44)
The program further includes:
Including a process of creating a transfer rule for a node on the path of the connection request packet and the response packet after storing the information of the connection request packet and before receiving a response packet to the connection request packet. 44. The program according to any one of supplementary notes 36 to 43, which is characterized.

DESCRIPTION OF SYMBOLS 1, 1A, 1B, 1000 Control apparatus 2, 2A, 2B, 2C, 2D node 3, 3A, 3B, 3C, 3D terminal 4 Network apparatus 11 Connection monitoring part 12 Path management part 13 Packet analysis part 14 Flow control part 15 Node Communication unit 16 Registration information synchronization unit 111 Packet detection unit 112 Packet registration unit 113 Packet storage unit 114 Connection establishment determination unit 115 Registration deletion unit 201 Communication processing unit 202 Flow table 1001 Packet detection unit 1002 Connection establishment determination unit 1003 Transfer rule setting unit

Claims (10)

A control device that is connected to a node that performs packet transfer according to a set transfer rule and a terminal that performs communication via a network, and that controls the node and the terminal,
The terminal detects the response packet to the connection request packet and the connection request packet and transmits it to the other terminals, again the connection request when only either one of the connection request packet or the response packet is not detected Packet detection means for detecting the packet and the response packet ;
When the packet detection unit detects the connection packet and the response packet , a connection establishment determination unit that determines whether a connection between the terminal and the other terminal is established according to a reception status of the response packet When,
Transfer rule setting means for setting a transfer rule for the node on the path of the flow to which the connection request packet belongs and the flow to which the response packet belongs , when the determination result of the connection establishment is successful;
A control device comprising: The control device further includes:
Packet storing means for storing information for specifying the connection request packet;
The packet detection means uses the packet storage means to determine whether the received packet is a response packet to the stored connection request packet, and whether the transmission source and the transmission destination of the stored connection request packet are opposite. The control device according to claim 1 , wherein the detection is performed by collating them. The packet detection means further determines whether or not the received packet is a connection request packet when the received packet is not a response packet to the stored connection request packet;
3. The control apparatus according to claim 2, wherein the storage unit further stores information for specifying the connection request packet when it is determined that the received packet is a connection request packet. The packet detecting unit, when the packet storage unit is not a certain time receiving a response packet to the connection request packet that stores, claim 2, characterized in that deletes the registration of the connection request packet the storage or 3. The control device according to 3 . The control device further includes:
5. The control according to claim 3, further comprising registration information synchronization means for synchronizing information on the connection request packet stored in the packet storage means between the control device and another control device. apparatus. The control device further includes a route management unit that determines a route of the received packet,
The packet storage means further stores route information of the connection request packet;
6. The control according to claim 3, wherein the route management unit determines the route of the response packet with reference to the route of the connection request packet stored in the packet storage unit. apparatus.   The said packet storage means further memorize | stores the input node of the said connection request packet, and the input port information of the said input node as information of the said connection request packet. The control device described in 1. A node that performs packet transfer according to a set transfer rule, a terminal that performs communication, and a control device that is connected to the node and the terminal via a network and controls the node and the terminal,
The controller is
The terminal detects the response packet to the connection request packet and the connection request packet and transmits it to the other terminals, again the connection request when only either one of the connection request packet or the response packet is not detected Packet detection means for detecting the packet and the response packet ;
When the packet detection unit detects the connection packet and the response packet , a connection establishment determination unit that determines whether a connection between the terminal and the other terminal is established according to a reception status of the response packet When,
Transfer rule setting means for setting a transfer rule for the node on the path of the flow to which the connection request packet belongs and the flow to which the response packet belongs , when the determination result of the connection establishment is successful;
A communication system comprising: Again said when the terminal that performs communication detects a response packet to the connection request packet and the connection request packet and transmits it to the other terminals, only either one of the connection request packet or the response packet is not detected Detecting a connection request packet and the response packet ;
When the connection packet and the response packet are detected in the step, determining whether a connection between the terminal and the other terminal is established according to the reception status of the response packet;
When the determination result of the establishment of the connection is successful, the transfer rule of the node that performs packet transfer according to the set transfer rule that exists on the path of the flow to which the connection request packet belongs and the flow to which the response packet belongs is set. Steps to configure,
The control method characterized by including. Again said when the terminal that performs communication detects a response packet to the connection request packet and the connection request packet and transmits it to the other terminals, only either one of the connection request packet or the response packet is not detected Processing for detecting a connection request packet and the response packet ;
When the connection packet and the response packet are detected in the process, a process of determining whether a connection between the terminal and the other terminal is established according to a reception status of the response packet;
When the determination result of the establishment of the connection is successful, the transfer rule of the node that performs packet transfer according to the set transfer rule that exists on the path of the flow to which the connection request packet belongs and the flow to which the response packet belongs is set. Process to configure,
A program that causes a computer to execute.

Images