KR20150135041A - Apparatus and method for openflow routing - Google Patents

Abstract

The present invention relates to an openflow routing apparatus and an openflow routing method. When the openflow routing is performed in a security system as a service (SECaaS) based on cloud computing, a controller: detects effective routes between a plurality of virtual machines for providing a security service independently and a VPN gateway and effective routes between the virtual machines; calculates a metric weighted value based on link costs and processing costs for each effective route detected by the controller; setting minimum cost routes for the effective routes based on the metric weighted value; stores the minimum cost routes, set by an openflow protocol, as a flow table on an openflow switch and an open vswitch (OVS). At least one from the openflow switch and the OVS transmits a tenant packet along the minimum cost route based on the flow table.

Description

[0001] APPARATUS AND METHOD FOR OPENFLOW ROUTING [0002]

The present invention relates to an open flow routing apparatus and method in a security as a service (SECaaS) system based on cloud computing.

Cloud computing makes it easy to access computing resources (such as network, server, storage, applications, and services) by accessing the network anytime and anywhere, and to set computing resources quickly with minimal effort from the service provider It is a computing model that can be provided.

As such, cloud computing is greatly expanded, and many companies are introducing cloud computing, which is making a big difference in the security paradigm. As a result, "Security as a Service" (SecaaS) has emerged, in which security services, previously provided in the form of security appliances, are provided as cloud-based security services by combining with cloud computing.

Meanwhile, SecaaS is a kind of 'Software as a Service (SaaS)', a cloud service for security software. The main difference is that SecaaS requires more control over traffic compared to the more active SaaS to date. In the case of SaaS, data is received from the user and processed through the application logic. However, in the case of the security application of SecaaS, the user receives the traffic of the user and checks whether there is a threat to the user's data in the middle. Therefore, SecaaS should control (ie, route) user traffic to the security service that the user wants. Therefore, SecaaS needs more control of traffic control in existing SaaS.

In addition, the cost and latency of security services in SecaaS can be affected by the number of tenants subscribed, service overload by service resources such as disk, CPU, RAM, live migration services, For various reasons. Therefore, SecaaS network topology and network operation can be changed. In order to solve problems caused by fluctuations in network topology and operation, the best route should always be selected with the best response time for tenants.

On the other hand, Software Defined Network (SDN) is a next generation networking technology that can handle network routing and control and complex operation management through software programming. For this purpose, the SDN separates the data plane and control plane of the network and provides a standardized interface between them. The network operator can program the control plane according to various situations, Can be controlled in various ways.

Among them, OpenFlow uses the open flow protocol as a standard interface connecting the control plane and the data plane. With the open flow protocol, the control and data planes can be implemented in software rather than hardware, and these software can be installed on a general-purpose server to quickly implement new functions.

There is a need for a way to apply such open flow technology to SecaaS based on cloud computing.

In this regard, Korean Patent Laid-Open Publication No. 10-2014-0050461 (entitled " method and apparatus for implementing a virtual network using an open-flow switch and a controller ") discloses a method for transmitting data information A virtual network determination unit that determines a virtual network to which the data is to be delivered according to the detected characteristics based on the received data information, And a virtual network controller for receiving a delivery request, determining a delivery path of the data, and transmitting the delivery path to a switch in the network.

An embodiment of the present invention provides an open flow routing apparatus and method for routing tenant packets to a minimum cost path in a SECAaS system based on cloud computing.

It should be understood, however, that the technical scope of the present invention is not limited to the above-described technical problems, and other technical problems may exist.

According to an aspect of the present invention, there is provided an open flow routing method in a security as a service (SECaaS) system based on cloud computing, Detecting a valid path between a virtual machine of the virtual machine and a VPN gateway and a valid path between the virtual machine and the VPN gateway; The controller calculating a metric weight based on the link cost and the processing cost for each detected valid path; The controller setting a least cost path for the valid paths based on the metric weight; And storing, as a flow table, the minimum cost path set by the controller through an open flow protocol in an open flow switch and an open v switch in a flow table, Packets of the tenant are switched to the destination virtual machine based on the flow table through at least one of the open flow switch and the open V switch in the least cost path.

In addition, according to another aspect of the present invention, there is provided a routing apparatus for Openflow in a security as a service (SECaaS) system based on cloud computing, comprising: a VPN gateway for receiving a packet of a tenant; Detecting effective paths between the virtual machines and the valid paths between the plurality of virtual machines providing security services and the VPN gateway, calculating metric weights based on link costs and processing costs for each effective path, A controller for setting a minimum cost path for the valid paths based on the weights and storing the minimum cost paths through an open flow protocol; And an open flow switch and an open vSwitch for storing the minimum cost path of the effective paths set from the controller as a flow table and delivering the packets of the tenant according to the minimum cost path based on the flow table, OVS).

According to any one of the above-mentioned objects of the present invention, it is possible to reduce the cost and delay of the routing path in the entire SecaaS network, and to provide a route with the best response time to the tenant.

Further, according to any one of the tasks of the present invention, centralized routing calculation can be performed by providing a routing algorithm using an open flow protocol, so that updating of a routing algorithm in an actual network can be easily handled.

Further, according to any one of the tasks of the present invention, it is possible to reduce resource consumption by calculating the metric weights of the minimum cost path in consideration of not only the distance cost but also the processing cost of the virtual machine in the SecaaS network It has the effect of finding the best routing path while at the same time.

1 is a diagram illustrating a configuration of a security (SECaaS) system as a service based on cloud computing according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining a metric weight calculation process according to an effective path according to an embodiment of the present invention. Referring to FIG.
3 is a diagram illustrating a process of providing a security service for a packet of a tenant through the open flow routing apparatus according to an embodiment of the present invention.
4 is a flowchart illustrating an open flow routing method in a security (SECaaS) system as a service based on cloud computing according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

1 is a diagram illustrating a configuration of a security as a service (SECaaS) system (hereinafter referred to as a security system) based on cloud computing according to an embodiment of the present invention.

1, the security system 100 according to an exemplary embodiment of the present invention includes a controller 110 for controlling routing to a virtual machine, which is a security service provider (SSP) A virtual private network (VPN) gateway 120 for receiving traffic (i.e., packets) generated from the tenant and delivering the traffic to the destination virtual machine, (OpenVSwitch, OVS) 130 and an OpenFlow Switch 150 for switching packets, and a plurality of virtual machines 140 in which applications of SSPs can be executed, respectively.

The open flow routing apparatus according to an embodiment of the present invention is implemented in a platform domain of the security system 100 and detects a minimum cost path as a destination virtual machine according to a packet of a tenant among a plurality of virtual machines 140 A VPN gateway 120 that receives a tenant's packet through a VPN connection and a minimum cost path that is implemented on the hypervisor of the security system 100 and set by the controller 110 over an open flow protocol, V switch 130 and an open flow switch 150, which are virtual switches for storing information on the information on the flow table.

Specifically, since the packet transmitted from the tenant through the VPN connection is received through the VPN gateway 120, the controller 110 transmits the packet between the plurality of virtual machines 140 providing the respective security services and the VPN gateway 120 Effective paths between the virtual machines 140 are detected.

Then, the controller 110 calculates a metric weight based on the link cost and the processing cost for each detected effective path. At this time, the metric weight W for the valid path can be calculated through the following equation (1).

&Quot; (1) "

W = {w1, w2, w3 ... wn * (n-1) / 2}

W _ij = P _ij + T _ij

Here, P _ij is the processing cost from the source node (i. E., Source virtual machine) i on any valid path to the destination node (i. E. Destination virtual machine) j, A processing delay value according to a data input time and an output time. T _ij is the traveling cost from the source node (i. E., Source virtual machine) i on any valid path to the destination node (i. E. Destination virtual machine) j, And a link cost based on a distance value (e.g., hop) to the destination virtual machine. At this time, the distance value is converted into a time unit and can be calculated with the processing cost. For example, it can be converted to the actual time spent per hop included per effective path.

Meanwhile, in the security system 100 according to the embodiment of the present invention, when the total number of SSPs is n-1, since tenant packets start from the VPN gateway 120, , And a network is constituted by n * (n-1) / 2 effective paths.

For example, FIG. 2 is a diagram for explaining a metric weight calculation process according to an effective path according to an embodiment of the present invention.

As shown in FIG. 2, when six SSPs (i.e., virtual machines providing security services) 140-1 to 140-6 are included, the nodes on the network include virtual machines of VPN gateway 120 7 (i.e., n = 7).

At this time, as shown in FIG. 2, a total of 21 effective paths are detected from the valid paths W1 to W21, and metric weights of the effective paths can be expressed as shown in the following equation (2).

&Quot; (2) "

W = {w ₁ , w ₂ , w ₃ ... w ₂₁ }

W ₁ = P ₁ + T ₁ , W ₂ = P ₂ + T ₂ , ... W ₂₁ = P ₂₁ + T ₂₁

The controller 110 sets a minimum cost path for all valid paths based on the metric weight for each effective path as described above, and stores the minimum cost path through the open flow protocol.

For example, the controller 110 may set the least cost path for the valid paths using the following algorithm.

<Algorithm 1>

At this time, the controller 110 sets the minimum cost path by selecting the smallest value among the metric weights for each effective path.

Then, the controller 110 stores the information of the minimum cost path of the set valid paths in the open V switch 130 and the open flow switch 150 through the open flow protocol.

For reference, the OpenFlow protocol belongs to Software-Defined Networking (SDN) technology, and is a protocol for managing a flow table between a controller and an open flow switch. The controller 110 manages the flow table to the open V switch 130 and the open flow switch 150 via the open flow protocol and the open V switch 130 and the open flow switch 150 ) Control packets through the table information generated by the controller 110, respectively.

In addition, the controller 110 may be configured to detect the security system 100 at various times, such as every predetermined period, whenever a specific event occurs on the network of the security system 100, or whenever a tenant packet is delivered to the VPN gateway 120, A metric weight calculation for the effective paths on the network 100 and a priority calculation of the minimum cost path can be performed. That is, even if the network topology and network operation of the security system 100 change, the minimum cost path according to the situation can be calculated and updated.

The open vSwitch (OVS) 130 and the open flow switch 150 store the least cost path of the effective paths set from the controller 110 as a flow table through the open flow protocol, and based on the flow table Transmits tenant packets according to the least cost path. That is, the open V switch 130 and the open flow switch 150 control the traffic from the tenant according to the minimum cost path set by the controller 110 and deliver it to the destination virtual machine 140. For example, referring to FIGS. 1 and 2, if the destination virtual machine 140 is an SSP domain implemented on the same platform as the VPN gateway 120, or the least cost path is implemented on one hypervisor In the case of a path between a plurality of SSP domains, a packet is transmitted through the open V switch 130. In addition, when the minimum cost path is set via the plurality of hypervisors to the destination virtual machine 140, packet transfer between the hypervisors is performed by the open flow switch 150, and packets between the SSP domains implemented on the same hypervisor 140 The transmission is carried out by the open V switch 130.

Hereinafter, an open flow routing scheme through an open flow routing apparatus according to an embodiment of the present invention will be described in detail with reference to FIG.

3 is a diagram illustrating a process of providing a security service for a packet of a tenant through the open flow routing apparatus according to an embodiment of the present invention.

First, the flow of packets through the security system 100 according to an embodiment of the present invention will be briefly described. When a packet of a tenant is received through the VPN gateway 120, a security service corresponding to the packet To the machine 140, examines the threats, and then exports them to an external network (not shown) when there is no abnormality.

For example, suppose a tenant uses a web security service, and a tenant connects to a specific web server to send and receive data. When the tenant using the security service requests the web security service of the SSP1 domain, the platform (i.e., the controller 110) of the security system 100 transmits the OVS 130 (130) based on the tenant's user information ) &Lt; / RTI &gt; That is, the controller 110 detects the minimum cost path for the SSP network including a plurality of virtual machines and transmits the information (indicated by 'path' in FIG. 3) to the flow table .

3, when a packet of the tenant is inputted to the security system 100 through the VPN connection (①), the packet is transmitted to the VPN gateway 120 of the platform domain (②) And transmitted to the OVS 130 (3).

Then, the tenant's packet is delivered to the destination web security service SSP1 domain by the flow table of the OVS 130 ((4)) and delivered to the destination virtual machine 140 providing the corresponding web security service. At this time, the OVS 130 processes switching according to the minimum cost path to the destination virtual machine 140 that provides the security service requested by the packet based on the minimum cost path for each effective path stored in the flow table.

For reference, the security system 100 checks the corresponding packet through the above process, and if it is determined that there is no abnormality, the security system 100 delivers the packet to the web server that the tenant intends to send.

Hereinafter, an open flow routing method using an open flow routing apparatus in a security as a service (SECaaS) system 100 based on cloud computing according to an embodiment of the present invention will be described in detail with reference to FIG. .

4 is a flowchart illustrating an open flow routing method in a security (SECaaS) system as a service based on cloud computing according to an embodiment of the present invention.

First, the controller detects valid paths between a plurality of virtual machines providing a security service and a VPN gateway (S410).

Then, the metric weight is calculated based on the link cost and the processing cost for each effective path detected by the controller (S420).

In this case, the processing cost may be a processing delay value according to the data input time and the output time of the destination virtual machine by the valid path, and the link cost may be a distance value from the source virtual machine to the destination virtual machine by the valid path.

Then, the controller sets a minimum cost path for the valid paths based on the metric weight (S430).

In this case, the minimum cost path for the valid paths can be determined by selecting the smallest value among the metric weight for each effective path.

Next, the controller stores the information of the minimum cost path for each valid route set in the flow table in the open flow switch and the open VVS (OVS) in step S440.

Meanwhile, when the tenant's packet is delivered to the security system through the VPN connection, the open flow switch and the open V switch transmit the tenant packet according to the minimum cost path based on the flow table (S450).

Specifically, when the open V switch 130 receives the packet of the tenant through the VPN gateway 120, it checks the destination virtual machine from the packet, and based on the flow table, And switches the tenant's packet to the destination virtual machine according to the detected least cost path. At this time, when the least cost path to the destination virtual machine passes through two or more hypervisors, the packet is switched between the hypervisors through the open flow switch, and the virtual machine implemented on one hypervisor is the open V switch The corresponding packet is switched.

One embodiment of the present invention may also be embodied in the form of a recording medium including instructions executable by a computer, such as program modules, being executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

While the methods and systems of the present invention have been described in connection with specific embodiments, some or all of those elements or operations may be implemented using a computer system having a general purpose hardware architecture.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

It is intended that the present invention covers the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents. .

100: Security system as a service
110: controller
120: VPN gateway
130: Open V switch
140: Virtual machines providing security services

Claims (7)

In an open flow routing method in a security as a service (SECaaS) system based on cloud computing,
Comprising: detecting, by a controller, valid paths between a plurality of virtual machines providing security services and VPN gateways and valid paths between virtual machines;
The controller calculating a metric weight based on the link cost and the processing cost for each detected valid path;
The controller setting a least cost path for the valid paths based on the metric weight; And
Storing the set minimum cost path as a flow table through an open flow protocol to an OpenFlow Switch and an OpenVSwitch (OVS) by the controller,
The packet of the tenant inputted through the VPN gateway is transmitted to the VPN gateway,
Wherein at least one of the open flow switch and the open V switch is switched to the destination virtual machine based on the flow table on the least cost path. The method according to claim 1,
Wherein the processing cost is a processing delay value according to data input time and output time of the destination virtual machine for each valid path,
Wherein the link cost is a distance value from the source virtual machine to the destination virtual machine by the valid path. The method according to claim 1,
After the storing in the flow table,
Receiving the packet of the tenant through the VPN gateway;
Confirming a destination virtual machine from the packet by the open V switch;
The open V switch detecting a minimum cost path from the VPN gateway to the destination virtual machine based on the flow table; And
And switching the open V-switch to the destination virtual machine according to the detected least cost path of the tenant packet,
Wherein the packets of the tenant are switched through at least one of the other open V switches and the open flow switches according to the least cost path. In an OpenFlow routing device in a security as a service (SECaaS) system based on cloud computing,
A VPN gateway for receiving packets of tenants;
Detecting effective paths between the virtual machines and the valid paths between the plurality of virtual machines providing security services and the VPN gateway, calculating metric weights based on link cost and processing cost for each effective path, A controller for setting a minimum cost path for the valid paths based on the weights and storing the minimum cost paths through an open flow protocol; And
An open flow switch and an open vSwitch for storing information of a minimum cost path of effective paths established from the controller in a flow table and delivering the packets of the tenant according to the minimum cost path based on the flow table, 0.0 &gt; (OVS). &Lt; / RTI &gt; 5. The method of claim 4,
Wherein the processing cost is a processing delay value according to data input time and output time of the destination virtual machine for each valid path,
Wherein the link cost is a distance value from the source virtual machine to the destination virtual machine by the valid path. 5. The method of claim 4,
The open V-
And a control unit for detecting a minimum cost path from the VPN gateway to the destination virtual machine on the basis of the flow table, Switching to the destination virtual machine according to the detected minimum cost path,
The packet of the tenant is,
And switches to the destination virtual machine via at least one of the other open V switches and the open flow switches according to the least cost path. 5. The method of claim 4,
The controller comprising:
And selects the smallest one of the metric weights for each effective path to set the minimum cost path.

Images