WO2015174560A1 - Device and method for network control and inspection - Google Patents

Abstract

Disclosed is a system that controls and inspects a network in a network environment in which heterogeneous network devices are linked. The network control and inspection system comprises: a device interface for controlling the operations of lower level network devices and the network devices; an application interface for implementing communication between the lower level network devices and an upper level network; a network controller for controlling networking operations between the upper level network and the lower level network devices; and a network inspection unit for inspecting for the occurrence of errors and whether normal networking operations are possible, when a network setting state set by a user through an open interface is applied to an actual network.

Description

Apparatus and method for network control and verification

The present invention relates to network control and verification, and more particularly, to a structure and a method for conveniently controlling the operation of a network device while guaranteeing reliability through user-defined software.

Network equipment such as switches provided by one vendor generally includes a data plane implementing various network protocols and a control plane for setting up and controlling such network equipment as one system. Is provided. In recent years, Software Defined Networks (hereinafter referred to as "SDN") separate the control plane and data plane of network equipment and define open interfaces between the control plane and data plane to enable interoperability between heterogeneous devices. At the same time, the behavior of the data plane also opens up a path that can be arbitrarily defined.

Open interfaces facilitate interoperability between heterogeneous devices and enable faster networking technology innovation. As a result, open interfaces are being actively applied to various environments including data centers and the cloud.

Contrary to the advantages of open networking technology, there is the potential for unintentional errors in the definition of new functions consisting of large or complex operations using open interfaces. This unintentional error poses a risk of failure of the network itself.

The technical problem to be solved by the present invention is to provide a structure and method for conveniently controlling the operation of the network device through a user-defined software while ensuring reliability.

An open interface provides a structure and method of a control device and a verification device for reliably defining network operation in an environment in which heterogeneous devices interoperate with each other and for detecting an unintended error.

The present invention is intended in the process of defining a network setting or function in a user or software defined network environment based on an open interface such as a software defined network (SDN) and the Internet of Thing (hereinafter referred to as "IoT"). By verifying that the network does not cause a problem due to an error that has not been made, while maintaining the advantages of the user- or software-defined network with heterogeneous devices interworking through the open interface, and supplementing the disadvantage that the current software-defined network technology does not provide, It has the effect of greatly increasing the utilization and dependency of software defined networks.

1 is a diagram illustrating the overall structure and application of the network control and verification system according to an embodiment.

2 illustrates a detailed structure of a network control and verification system according to an embodiment.

3 illustrates a network control and verification system applied to a network virtualization application such as a cloud, according to one embodiment.

4 illustrates a network control and verification system applied to a network for a small device, such as the Internet of Things (IoT), according to one embodiment.

FIG. 5 is a diagram illustrating a structure for controlling the small device of FIG. 4.

According to an embodiment, a system for controlling and verifying a network in a network environment in which heterogeneous network devices are interlocked may include a lower interface network device and a device interface for controlling operations of the network devices; An application interface for performing communication between the lower layer network devices and the upper layer network; A network control unit controlling a networking operation between the upper layer network and the lower layer network devices; And a network verification unit verifying whether an error occurs and whether normal networking operation is possible when the network setting state set by the user through the open interface is applied to the actual network.

According to an embodiment, the upper layer network may include network virtualization, the Internet of Things applied to a small device, and a network application.

According to an embodiment, the verification unit may include an intra domain verification unit that verifies attributes of a partial network controlled by a specific network operating system (NOS) or a specific network device; And an inter domain validator configured to verify a network property related to at least one domain in the upper layer network.

According to one embodiment, a network control and verification system includes a network state base for storing information related to a network state and a network device state currently managed by a network operating system (NOS); A distributed processing module required for network control and verification operations, configured to configure a higher domain for processing network control and verification operations by connecting a domain for a network device distributed on a network and a domain for an application; And a policy management module that defines a network policy and applies the defined network policy to the network setting.

According to an embodiment, the open interface may be implemented through a software defined network.

Terms used herein will be briefly described and the present invention will be described in detail.

The terms used in the present invention have been selected as widely used general terms as possible in consideration of the functions in the present invention, but this may vary according to the intention or precedent of the person skilled in the art, the emergence of new technologies and the like. In addition, in certain cases, there is also a term arbitrarily selected by the applicant, in which case the meaning will be described in detail in the description of the invention. Therefore, the terms used in the present invention should be defined based on the meanings of the terms and the contents throughout the present invention, rather than the names of the simple terms.

When any part of the specification is to "include" any component, this means that it may further include other components, except to exclude other components unless otherwise stated. In addition, the terms "... unit", "module", etc. described in the specification mean a unit for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software. .

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

1 is a diagram illustrating the overall structure and application of the network control and verification system according to an embodiment.

Referring to FIG. 1, the network control and verification system 100 includes a network control device 110, a network verification device 120, an application interface 130, and a device interface 140. The network control and verification system 100 actually monitors the network setting state set by the user through an open interface such as SDN in a network and network application 180 such as the Internet of Things applied to the network virtualization 160 and the small device 170. Errors that can occur when applied to the network can be verified.

The network virtualization 160 represents an application applied in an environment such as a cloud or a data center. The network control and verification system 100 may verify whether an error occurs and normal networking operation is possible when performing the connection and control between the virtual network and the real network.

The small device 170 represents an application in which network functions are enhanced in devices such as home appliances, smart phones, automobiles, and home networks used in real life such as the Internet of Things (IoT). The network control and verification system 100 may be applied to connect a plurality of devices to be managed by a user, such as IoT, to a network, and to prevent an error occurring in an interworking process between the plurality of devices.

The network application 180 represents an application mainly applied in an existing network environment such as a router, a firewall, and a virtual private network (VPN). Unlike the network environment applied to the network virtualization 160 and the small device 170, the network application 180 represents a network environment widely used in the related art.

2 to 5, which will be described later, the network virtualization 160, the small device 170, and the network application 180 commonly use components provided by the network control and verification system 100, but have specific processing methods. And the detail module used may be different.

The network device 150 may be any programmable network device and may be a programmable switch. The network device 150 may be an IP or non-IP based wired network device, a wireless network such as Wifi or LTE, a small wireless network device such as Bluetooth or Zigbee, or a conventional L2 switch function. In addition, more than L3 functions can be added / deleted by programming. The network device 150 communicates with other modules through a network, and may use an existing Internet / Intranet or apply a communication technology defined by itself.

The device interface 140 controls the network devices 150 and connects the upper layer application with the lower layer network devices 150. Control methods and protocols dependent on the network device 150 are processed with reference to the information and functions provided by the network control device 110.

The control protocol 111 and the interface conversion device 112 of the network control device 110 perform a conversion operation of an interface and a protocol when an interface or a protocol of the network device 150 that is an upper layer application and a lower layer device is different. This enables the networking operation between the upper layer application and the lower layer network devices 150.

The network verification apparatus 120 may be configured by a user through an open interface such as SDN in a network and network application 180 such as the Internet of Things applied to the network virtualization 160 and the small device 170 according to a predetermined verification algorithm 125. You can verify the errors that can occur when you apply the network configuration to the network.

Although the network control device 110 and the network verification device 120 are logically represented as one system, the network control device 110 and the network verification device 120 may be configured as a plurality of distributed nodes through the distributed processing module 192.

The application interface 130 may also be referred to as an "open API" as an open application interface unit. The application interface 130 communicates between the lower layers and the network and network applications 180 such as the Internet of Things applied to the network virtualization 160 and the small device 170, and a standard network stack required for such communication. Mutual synchronization processing can be performed.

The network state database 191 may store information related to a network state and a network device state currently managed by a network operating system (NOS). For example, values such as topology information, link state information, flow rules, other statistical information, current attributes, and the like are stored in the network state database 191. The network status database organizes data structures and operations based on graph forms optimized for network status and network equipment status. The network state database uses distributed processing modules to ensure consistency even when distributed by multiple nodes. Information that is frequently used and must ensure fast response times can be stored and managed in the form of in-memory databases of key-value pairs.

The distributed processing module 192 is responsible for combining information about network devices and applications distributed on the network, which are required for control and verification tasks, into one consistent information. Devices and applications connected to the network are organized into separate domains for efficiency and scalability, and the sum of all these domains can represent the state of the entire network. The distributed processing module 192 connects these domains to form one upper domain for processing control and verification tasks. Analyzes operations to perform control and verification operations, distributes them to multiple subdomains, and combines the results of operations performed independently in each subdomain, resulting in the upper domain configured for control and verification operations. Create a ..

The policy management module 193 defines a new policy and reflects the policy in the network configuration. When a specific policy is generated during network configuration, the policy is managed in an intermediate language provided by the network verification apparatus 120 to allow the property of the policy to be verified, and the verified property is used when defining a new policy. When processing a virtual network or application unit and NOS related operations interlinked with different domains, the policy management module 193 may define, verify, and inquire related policies. Even when the virtual network and the external domain are linked, the related policy may be defined, verified, and inquired through the policy management module 193.

2 illustrates a detailed structure of a network control and verification system according to an embodiment.

Network devices may be referred to as programmable switch 240. The programmable switch 240 refers to all networking devices, whether IP based or wired or wireless. In addition to the existing L2 switch, functions beyond L3 can be added / deleted by programming. In general, the programmable switch 240 and other modules on the network may perform communication using an existing Internet / Intranet, or in some cases, may apply a communication technology defined by itself.

Functions to control through the programmable switch 240 and various service applications have been described as apps. An app may have various forms, ranging from a simple learning switch to a firewall and load balancing. An app may be divided into a remote app 250 and a native app 260. The remote app 250 does not directly operate on a control device called NOS (Network OS) 210 that functions as a control plane, and uses an application that uses network functions in a standards-based remote procedure call method such as a REST API. Indicates. On the other hand, the native app 260 operates directly in conjunction with the NOS 210, and the implementation language is also dependent on the NOS 210. The remote app 250 and the native app 260 are in charge of the same function except for the interworking method.

The NOS 210 is a module for controlling a network device and an operation thereof, and includes a core module 211 and a network database for connecting an upper app and a programmable switch 240 of a lower layer. 212).

The core module 211 is a module that processes standard protocols required to control a network device. The core module 211 provides a network control protocol such as IP, an Internet protocol, and the like.

The network database 212 is a database that stores states for all network devices controlled by the NOS 210. The network database 212 is referenced not only in the NOS 210 but also in the upper app and the verification units 220 and 230. The network and equipment state managed by the current NOS is stored in a module in the form of a database, and values such as topology information, link state information, flow rules, other statistical information, and current attributes are stored. Frequently used and fast response information can be implemented in the form of an in-memory database of key-value pairs, a graph-based database can be used to process network topology information, or a faster data can be processed. You can also use non-SQL based databases.

The network verification unit is largely divided into an inter domain verification unit 230 and an intra domain verification unit 220. The inter domain verification unit 230 performs verification from the viewpoint of the entire network, and the intra domain verification unit 220 verifies attributes of a partial network controlled by a specific NOS or a specific network device. Here, a domain represents a management entity or a unit for managing a policy and a physical network and network equipment. For example, a company's entire network may be one domain. You can also divide a company's entire network into different domains by building or floor. You can also classify domains in various policy dimensions, including service providers or billing. Therefore, the inter domain verification unit 230 operates over several domains that can be managed by the current user, and the intra domain verification unit 220 operates exclusively for the current domain. When operating across domains, the verification process must be performed by the policy manager and verification unit of each domain.

The intra domain validator 220 and the inter domain validator 230 are configured by three modules, such as the policy manager 221, the search graph 222, and the converter 223.

The policy manager 221 reflects a specific policy when setting up a network. The reflected policy is managed in an intermediate language provided by the verification unit 220, 230 and the conversion unit 223 to verify attributes or define a new policy. In particular, when processing operations related to virtual networks, apps, and NOSs related to different domains, policy definition, verification, and inquiry functions are processed through the policy manager 221. Also, the policy manager 221 may provide a related function for interworking with a virtual network and an external domain.

The conversion unit 223 is in charge of mutual conversion between a format representing a setting or a command transmitted from a higher layer and a format for internally managing information for verification and control.

The search graph 222 provides various verification algorithms together as a data structure for performing a specific verification process. This data structure is optimized for verification by reflecting the characteristics of network and virtualization applications, small devices and applications, and the communication protocols used, but is configured in a form independent of specific devices, applications, and protocols.

The inter domain validator 230 performs verification on a function or property defined in an app or a higher layer, unlike the intra domain validator 220 operating at the NOS 210 or the network device level. For example, when a match-action rule is input to a specific OpenFlow switch through an app, the inter domain validator 230 may have mutual inconsistency between these rules, or an infinite loop or black hole may occur on the structure specified by the app. Verifies whether If the attribute to be verified is related to the internal state of the NOS, the function provided by the intra domain verification unit 220 may be used. Unlike the inter domain validator 230, the inter domain validator 230 is also connected to a remote procedure call interface such as REST, and interworked with a specific NOS. Therefore, the inter domain validator 230 may process the verification operation in a manner independent of a specific programming implementing the app or the NOS. For this purpose, the inter domain validator 230 may be configured to remotely input a specific input language and JSON-RPC. It also provides the ability to convert to and from procedure calls.

3 illustrates a network control and verification system applied to a network virtualization application, such as a cloud system, according to one embodiment.

The first network control and verification system 315 may occur when the virtual network management module 310 of the upper layer performs the setting operation on the virtual network through SDN, etc., when applying the setting to the lower physical network state. Verify any errors.

The first network control and verification system 315 receives the configuration and requirements of the upper layer from the plug-in provided in the network virtualization environment, a platform independent REST type API, an interface dependent on the network device, and the like. The key attributes are verified by taking detailed information from the actual network management module.

The second network control and verification system 320 collects information directly from the actual network device or verifies attributes within a partial network range based on the information collected from the network controller.

The first network control and verification system 315 performs verification of the entire network at the upper layer, and the second network control and verification system 320 is applied to the network devices managed by a specific network device or a specific network controller at the lower layer. Only the verification is performed, and the first network control and verification system 315 and the second network control and verification system 320 may operate in conjunction with each other as necessary.

The first network control and verification system 315 focuses on the overall structural attribute check rather than the speed, and the second network control and verification system 320 performs the real-time check at lower layers for basic errors.

4 illustrates a network control and verification system applied to a network for a small device, such as the Internet of Things (IoT), according to one embodiment.

Unlike other network applications, small devices to which the Internet of Things (IoT) is applied are not fixed in the network control and verification system 420 according to an embodiment of the present invention, and their positions may vary, and types and numbers of devices to be controlled may vary. Do. Therefore, in order to control and verify a network for a small device such as the Internet of Things, a network control and verification scheme different from the network control and verification scheme of FIG. 3 described above is required.

The IoT device 410 may integrate and control devices having various interfaces such as automobiles, home networks, home appliances, and smart devices through wireless communication technologies such as Wifi, Bluetooth, and Zigbee. At this time, the control interface, operation, and properties of various devices connected to the IoT device 410 are stored in a separate database, and when the network control and verification system 420 discovers the corresponding device, You can get the module through. The specific communication protocol used by the device connected to the IoT device 410 may be processed through the communication interface module, the protocol may be neutralized, and then verification may be performed through the same method as described above with reference to FIGS. 1 and 2. have.

FIG. 5 is a diagram illustrating a structure for controlling the small device of FIG. 4.

Referring to FIG. 5, three modules such as a device module 510, a browser module 520, and a server module 530 work together to control a small device (IoT device).

The device module 510 is a module for managing attributes of a small device, and may be divided into a local device and a remote device according to whether the device is directly connected to the network control and verification system 420. In addition, the device module 510 may be classified into a sensor and an actuator according to device properties. In addition, the device module 510 may be classified into a public device and a private device according to an access right.

The local device may be directly connected to the network control and verification system 420 to directly control a small device (IoT device), and the remote device controls the small device (IoT device) indirectly through a separate control module. The same device can be switched between local and remote depending on location and status.

The sensor is a device that reads data, and the actuator is a device that can write data, and may perform a specific recording operation. Depending on the device 510 may have both attributes.

Public devices are shared with other users or control modules, and private devices are accessible only to users. The network control and verification system 420 performs verification by referring to an access control rule when verifying an access process of a public device and a private device. The network control and verification system 420 blocks access to the device 510 in case of crossing an inappropriate user or sharing range.

The browser module 520 serves as an interface between the user and the control module, and provides the user with attribute information about the device 510 and a module for controlling the device 510.

The browser module 520 provides a list of devices that can be controlled at the current location and state, and provides a state and a control interface of each device.

When the network control and verification system 420 of the present invention finds a specific IoT device, the network control and verification system 420 requests the server module 530 to transmit the information to the browser. This information includes device information and device control interfaces. The server module 530 and the information contained therein may be configured as a primary server module directly configured in the network control and verification system 420, and additionally, a secondary server module provided by the device 510 manufacturer.

Device information includes the device name and location, whether the user is shared or not, and the status. The device control interface provides specific instructions for operating the device. For example, a direction control and on / off of a camera, an on / off and strategic usage measurement command for an electric outlet, and a command for operating the corresponding device for a home appliance may be controlled through the device control interface.

When a user accesses a specific device through the browser module 520, the specific device may be controlled within a range without departing from access and operation rights for the device stored in the server module 530. The user cannot perform actions beyond the permissions and rules defined on the server.

Rules defined for each device (access rights, etc.) are processed through the intra-domain verification unit 220 of the lower layer described in FIGS. 2 and 3, and the overall structural verification that all the devices that can be controlled are connected is performed. Processing is performed by the inter domain verification unit 230 of the upper layer described with reference to FIGS. 2 and 3.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (5)

In a system for controlling and verifying a network in a network environment where heterogeneous network devices are interworked, A device interface for controlling operations of lower layer network devices and the network devices; An application interface for performing communication between the lower layer network devices and the upper layer network; A network control unit controlling a networking operation between the upper layer network and the lower layer network devices; And And a network verifying unit verifying whether an error occurs and whether normal networking operation is possible when the network setting state set by the user through the open interface is applied to the actual network. The method of claim 1, The upper layer network Network control and verification system, including network virtualization, IoT and network applications applied to small devices. The method of claim 1, The verification unit An intra domain verification unit that verifies attributes of a partial network controlled by a specific network operating system (NOS) or a specific network device; And And an inter domain verification unit configured to verify network attributes related to at least one domain in the upper layer network. The method of claim 1, A network state base configured to store information related to a network state and a network device state currently managed by a network operating system (NOS); A distributed processing module required for network control and verification operations, configured to configure a higher domain for processing network control and verification operations by connecting a domain for a network device distributed on a network and a domain for an application; And And a policy management module for defining network policies and applying the defined network policies to network settings. The method of claim 1, The open interface is a network control and verification system, characterized in that implemented through a Software Defined Network.

Images