WO2012105677A1 - Packet processing device, packet processing method and program - Google Patents

Packet processing device, packet processing method and program Download PDF

Info

Publication number
WO2012105677A1
WO2012105677A1 PCT/JP2012/052465 JP2012052465W WO2012105677A1 WO 2012105677 A1 WO2012105677 A1 WO 2012105677A1 JP 2012052465 W JP2012052465 W JP 2012052465W WO 2012105677 A1 WO2012105677 A1 WO 2012105677A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
rule
target
processing
processor
Prior art date
Application number
PCT/JP2012/052465
Other languages
French (fr)
Japanese (ja)
Inventor
池田　聡
地引　昌弘
智義 菅原
Original Assignee
日本電気株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 日本電気株式会社 filed Critical 日本電気株式会社
Priority to JP2012555968A priority Critical patent/JP5900352B2/en
Publication of WO2012105677A1 publication Critical patent/WO2012105677A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/64—Hybrid switching systems
    • H04L12/6418—Hybrid transport
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/088—Access security using filters or firewalls

Definitions

  • the present invention relates to a packet processing device, a packet processing method, and a program, and more particularly, to a packet processing device, a packet processing method, and a program that transmit and receive packets using a plurality of processors.
  • a packet processing apparatus When a packet processing apparatus is realized using a general-purpose OS such as Linux (registered trademark), if a high-speed network card is installed, processor processing in transmission / reception becomes a bottleneck, and communication at a wire rate becomes impossible. It becomes difficult. Even if a multi-core processor is used, bottlenecks will occur due to the concentration of packet processing on a single processor (core) that is the interrupt destination from the network interface card, and sufficient load distribution will be performed. There is a problem that can not be.
  • a general-purpose OS such as Linux (registered trademark)
  • a processor that processes a packet is uniquely determined from a plurality of processors based on header information of the packet to be processed. Specifically, a hash value is calculated from a partial field of the packet header, and a modulo operation is performed on the obtained hash value by the number of processors (number of cores) to obtain a processor number. Then, the processor having the obtained processor number is made to process the packet.
  • the modulo operation is performed by the number of processors (the number of cores)
  • the processor number is uniquely obtained by the operation.
  • the processor to be processed is also different, and packet processing can be distributed among a plurality of processors (cores). Therefore, load distribution can be realized without the processing by a single processor (core) becoming a bottleneck.
  • processor a processor and a processor core are collectively referred to as a “processor”.
  • a processor that processes a packet is uniquely determined based on a partial field of the packet header. Therefore, if the hash values calculated from some fields of the header are the same, the processor number obtained from the modulo operation is always the same, and the processor that processes the packet is fixed. Therefore, there is a problem that a processor that executes packet processing cannot be flexibly selected.
  • the objective of this invention is providing the packet processing apparatus, the packet processing method, and program which solve this subject.
  • the packet processing device provides: A rule table that holds information stored in a packet, a processing rule that indicates a first process for the packet, and a rule that associates a processor identifier that identifies a processor that performs the second process for the packet; A rule extraction unit that extracts a rule corresponding to information stored in a target packet, which is a packet to be processed, from the rule table; A rule applying unit configured to execute the first process in accordance with the processing rule for the target packet based on the extracted rule and to request the second process to the processor corresponding to the processor identifier; It has.
  • the packet processing method is: One of the plurality of processors associates the information stored in the packet, the processing rule indicating the first process for the packet, and the processor identifier that identifies the processor performing the second process for the packet Extracting a rule corresponding to information stored in a target packet, which is a packet to be processed, from a rule table holding rules; Based on the extracted rule, the one processor executes the first process according to the processing rule for the target packet, and requests the processor corresponding to the processor identifier for the second process. And a process.
  • the program according to the third aspect of the present invention is: Processing should be performed from a rule table that holds information stored in a packet, a processing rule indicating a first process for the packet, and a rule that associates a processor identifier that identifies a processor that performs the second process for the packet.
  • a process for extracting a rule corresponding to information stored in a target packet that is a packet A plurality of processes for executing the first process according to the processing rule for the target packet and performing a request for the second process to the processor corresponding to the processor identifier based on the extracted rule
  • One of the processors is executed.
  • program may be provided as a program product recorded on a non-transient computer-readable storage medium.
  • the information stored in the packet, the processing rule indicating the first processing for the packet, and the processor performing the second processing for the packet are identified. Since a rule table for associating processor identifiers with each other is provided, by setting a processor identifier in the rule table, a processor that executes packet processing can be flexibly selected from a plurality of processors.
  • the packet processing device and the packet processing method according to the present invention based on the rule corresponding to the packet to be processed, extracted from the rule table, the first process is performed on the packet and the packet is processed. Since the processor selection is executed as one process, packet processing can be performed at high speed.
  • the packet processing apparatus includes information stored in a packet, a processing rule indicating a first process for the packet, and a processor identifier for identifying a processor that performs the second process for the packet.
  • a rule table (110) that holds rules for associating each other with each other, a rule extraction unit (130) that extracts rules that match information stored in a target packet that is a packet to be processed, from the rule table (110), and an extraction A rule applying unit (140) for requesting execution of a first process according to the processing rule for the target packet and a second process for a processor corresponding to the processor identifier based on the determined rule. ing.
  • the packet processing apparatus includes a rule table (110) that holds a rule that associates a matching condition for a packet with a processor that processes the packet. Therefore, by directly setting the matching condition and the processor identifier for the rule in the rule table (110), the processor that processes the packet can be flexibly selected.
  • a processor that processes a packet group having information is not uniquely fixed according to a predetermined calculation rule. Also, according to the packet processing apparatus of the present invention, the user can easily change the rules for selecting a processor for processing a packet by rewriting the rules stored in the rule table (110).
  • the rules of the rule table (110) in the packet processing device of the present invention include information stored in a packet, a processing rule indicating a first process for the packet, and a processor that performs a second process for the packet. Associate the identifying processor identifiers with each other. Therefore, when the rule corresponding to the target packet is extracted by the rule extraction unit (130), not only the content of the first process to be executed on the packet is specified, but also the second process for the packet is performed. A processor to execute is also specified. Therefore, according to the packet processing device of the present invention, the processing rule indicating the processing for the packet is specified by referring to the table, and the processing of the packet is performed at a higher speed than when the processor for executing the processing for the packet is specified separately. be able to.
  • a processor that executes packet processing can be selected flexibly and at high speed from the plurality of processors.
  • the first process is a process for determining whether or not to discard the target packet;
  • the second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. In some cases, it may be a lower layer process for the target packet.
  • the rule application unit may request the processor to perform the second process on the target packet when the target packet is not a packet to be discarded in the first process.
  • the rule table defines information stored in a packet, a processing rule indicating a first process for the packet, a processor identifier for identifying a processor that performs a second process for the packet, and a flow including the packet Holds rules that associate flow definition fields that represent fields with each other,
  • the rule application unit refers to the flow definition field, and selects one of a plurality of processors corresponding to the plurality of processor identifiers.
  • the second process may be requested for all target packets included in the same flow.
  • the rule extraction unit sets a rule that matches the information in a rule setting device capable of setting the rule. You may make it request.
  • the first process is a process of determining a destination of the target packet;
  • the second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. In some cases, it may be a lower layer process for the target packet.
  • the rule application unit performs the second processing on the target packet. You may make it ask the said processor.
  • the rule extraction unit has a cache that temporarily holds the extracted rules, and extracts rules that match the information stored in the target packet from the cache,
  • the rule application unit when the target packet is a packet to be received by the packet processing device, and when a rule that matches the target packet is extracted from the cache by the rule extraction unit, the rule application unit
  • the second process may be requested from the processor.
  • the first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
  • the second process is a layer 4 reception process for the target packet using the specified control information.
  • the packet When the packet is to be transmitted by the packet processing device, it may be a layer 4 or lower transmission process for the target packet using the specified control information.
  • the rule table holds a plurality of rules sorted according to priority, When a plurality of rules that match the information stored in the target packet are stored in the rule table, the rule extraction unit extracts a rule having a high priority from the plurality of rules. May be.
  • the rules in the rule table may include at least one of a source address, a destination address, a source port number, and a destination port number as information stored in the packet.
  • processing is performed from a rule table that holds information stored in a packet, a processing rule indicating a first process for the packet, and a rule that associates a processor identifier for identifying a processor that performs the second process for the packet.
  • a program to be executed by one of the processors is provided.
  • FIG. 2 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment.
  • the packet processing apparatus according to the present embodiment includes a rule table 10, a rule setting unit 20, a rule extraction unit 30, a rule application unit 40, a processing thread 50, a transmission reception unit 60, and a reception reception unit 70. It has.
  • the packet processing apparatus includes an OS corresponding to a plurality of processors (or processor cores), is connected to a network via a network interface device, and processes packets represented by IP packets.
  • the upper layer protocol processing is performed by software (including the OS). That is, each of the components shown in FIG. 2 can be realized by software. However, some or all of the components in FIG. 2 may be realized by hardware.
  • the rule table 10 holds a filtering rule describing filtering rules for transmission and reception packets and a dispatch rule describing processor allocation rules. Filtering rules and dispatch rules are managed in a single table.
  • FIG. 3 is a diagram illustrating the rule table 10 as an example.
  • the rule table 10 is managed for each reception / transmission.
  • One rule corresponding to each row of the rule table 10 includes at least a matching condition, an action, and a processor identifier.
  • Each rule in the rule table 10 may include a flow definition field.
  • the collation condition represents a conditional expression regarding the header field of the L3 layer or higher of the packet.
  • the rule on the first line in FIG. 3 is a TCP protocol and represents a rule relating to a packet whose destination port number is 80.
  • matching conditions not only the protocol number and port number shown in FIG. 3, but also various field conditions such as SPI (Security Parameter Index) values in IP address, AH header (Authentication Header), ESP (Encapsulating Security Payload) header, etc. Can be described.
  • the action indicates a first process (first process, basic process) for a transmission / reception packet.
  • first process basic process
  • For the action for example, ACCEPT for continuing the processing of the packet or DROP for discarding the packet is used.
  • a process for rewriting part of the data of the packet may be described as an action.
  • the processing processor identifier represents a processor that processes a packet that matches the matching condition.
  • the processing processor identifier can describe zero or more processor identifiers.
  • the flow definition field represents a header field of a packet used for identifying whether or not the flow is the same.
  • the flow definition field when a plurality of processor identifiers are described in the processing processor identifier, one processor among the descriptions in the processing processor identifier is selected so that packets belonging to the same flow are processed by the same processor. Used to select.
  • the rules in the rule table 10 are managed in order of priority.
  • the rule setting unit 20 sets rules such as adding, changing, and deleting rules with respect to the rule table 10.
  • the rule setting unit 20 operates as a user application and sets a rule by performing message communication between the user and the kernel.
  • the rule extraction unit 30 collates the information stored in the transmission / reception packet with the collation conditions of the rule table 10 and searches for a matching rule. When a plurality of rules are matched, the rule extraction unit 30 returns, for example, the highest priority among matching rules as a search result.
  • the rule application unit 40 includes a basic application unit 401 and a dispatch unit 402.
  • the basic application unit 401 applies the filtering rule as the first process
  • the dispatch unit 402 applies the dispatch rule.
  • the processing is canceled due to the application of the filtering rule, the dispatch rule is not applied in the dispatch unit 402, and the processing of the packet is terminated.
  • the basic application unit 401 performs a process related to the action in the rule as the first process.
  • the rule action is DROP
  • the basic application unit 401 discards the transmission / reception packet.
  • the dispatch unit 402 determines a processing processor that processes the transmission / reception packet according to the processing processor identifier in the rule, and processes the packet to the processing thread 50 corresponding to the processor. Ask.
  • the processing thread 50 is a kernel thread prepared for each processor, and performs reception processing of layer 3 and layer 4 for received packets and transmission processing of layer 3 and layer 2 for transmission packets as second processing for packets.
  • the processing thread 50 includes a reception processing unit 501 and a transmission processing unit 502, and holds a processing queue (not shown).
  • the processing queue stores a packet and a processing classification (transmission / reception).
  • the processing thread 50 sequentially takes out the packets stored in the processing queue, and when the processing classification is transmission, performs transmission processing by the transmission processing unit 502 on the packet.
  • the processing thread 50 performs reception processing by the reception processing unit 501 on the packet.
  • the transmission processing unit 502 performs layer 3 and layer 2 transmission processing on the transmission packet, and sends the packet to the network.
  • the reception processing unit 501 performs layer 3 and layer 4 reception processing on the received packet, and performs processing of passing the received packet to the user application as necessary.
  • the transmission reception unit 60 receives a transmission packet from the user application or the kernel, collates the transmission packet by the rule extraction unit 30, and passes the rule and the transmission packet obtained as a collation result to the rule application unit 40.
  • the reception accepting unit 70 receives a received packet from the network, collates the received packet with the rule extracting unit 30, and passes the rule and the received packet obtained as a collation result to the rule applying unit 40.
  • FIG. 4 is a flowchart showing an example of the operation of the packet processing apparatus according to the present embodiment.
  • the received packet is delivered to the reception accepting unit 70.
  • the reception accepting unit 70 that has received the received packet searches the rule table 10 for a rule that matches the received packet by the rule extracting unit 30 (step S1), and passes the result to the rule applying unit 40 together with the received packet.
  • the basic applying unit 401 applies an action as the first process (step S2). If the action in the rule is DROP (No in step S3), the basic application unit 401 discards the received packet (step S4) and completes the processing of the received packet.
  • the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S5, S6).
  • the processing processor identifier is not specified in the rule (No in step S5), the dispatch unit 402 is currently executing the processor (that is, the processor executing the processing of the dispatch unit 402 itself). Is selected as a processing processor (step S7).
  • the dispatch unit 402 requests processing by queuing the reception processing of the upper protocol of the received packet in the processing queue of the processing thread 50 corresponding to the determined processing processor (step S8).
  • the reception processing unit 501 of the processing thread 50 that has received the request executes a packet reception process (that is, a higher layer reception process for the received packet) as a second process for the packet.
  • step S6 when the flow definition field is used, the processing processor is determined from the processors specified by the processing processor identifier based on the hash value of the specified field. In particular, it is preferable to select a field that can identify the same flow as the flow definition field. Thereby, packets belonging to the same flow can be prevented from being distributed to a plurality of processors, and overhead caused by exclusive control and packet alignment can be reduced.
  • rule matching is performed on the transmission packet at the time of packet transmission, and the same process is performed except that the requested processing thread performs the packet transmission process. Therefore, description of the processing sequence at the time of packet transmission is omitted.
  • a dispatch rule (a matching condition and a processing processor identifier in FIG. 3) is determined in the rule table 10 in which filtering rules (a set of matching conditions and actions in FIG. 3) are described. And the flow definition field).
  • the rule to the rule table 10 can be set from the user side. Therefore, rules for selecting processing processors can be managed in a centralized manner, and flexible processor selection can be performed based on a user policy. Furthermore, since the filtering process for the packet and the selection of the processing processor that performs the second process for the packet are executed as one process, the processing time for the packet can be reduced.
  • FIG. 5 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment.
  • the packet processing apparatus according to the present embodiment includes a rule table 11, a rule setting unit 21, a rule extraction unit 31, a rule application unit 41, a processing thread 50, a transmission reception unit 61, and a reception reception unit 71. I have.
  • the rule table 11 includes a route rule for determining a transfer destination from a destination address of a transmission / reception packet and a dispatch rule for determining a processing processor from a destination address of a transmission packet or a transmission source address of a reception packet as one table. Hold.
  • FIG. 6 is a diagram illustrating the rule table 11 as an example.
  • the rule table 11 holds a network address (address and netmask), a transfer destination gateway, an output interface, and a processing processor identifier in association with each other.
  • the correspondence relationship between the network address, the transfer destination gateway, and the output interface is used in the application of the route rule.
  • the correspondence between the network address and the processor identifier is used in the application of dispatch rules.
  • the dispatch rule is interpreted as a rule for the destination address in the transmission packet and as a rule for the transmission source address in the reception packet.
  • the rule setting unit 21 sets rules such as addition, change, and deletion of route rules and dispatch rules in the rule table 11.
  • the rule setting unit 21 operates as a user application, for example, and sets a route rule by performing message communication between the user and the kernel.
  • the rule extraction unit 31 compares the address stored in the packet with the network address of the rule table 11 and searches for a matching rule.
  • the rule extraction unit 31 may include a route cache (not shown) that holds a part of recently searched search results and can be searched at high speed.
  • the rule application unit 41 includes a basic application unit 411 and a dispatch unit 402.
  • the basic application unit 411 performs processing according to the route rule as the first processing. Specifically, the transmission packet is set to be transmitted from the output destination interface in the route rule to the gateway.
  • the basic application unit 411 performs a transfer process of the received packet. Since the operation of the dispatch unit 402 is the same as that of the first embodiment, detailed description thereof is omitted.
  • processing thread 50 is the same as that of the first embodiment, and thus detailed description thereof is omitted.
  • the transmission reception unit 61 receives a transmission packet from the user application or the kernel, searches the rule extraction unit 31 for a rule corresponding to the destination address of the transmission packet, and determines the rule and the transmission packet obtained as a search result as a rule application unit Pass to 41.
  • the reception accepting unit 71 receives a received packet from the network, and the rule extracting unit 31 searches the routing rule from the destination address of the received packet and the dispatch rule from the transmission source address.
  • the received packet is passed to the rule application unit 41.
  • the rule extraction unit 31 includes a route cache, the search for the dispatch rule may be performed using the route cache.
  • FIG. 7 is a flowchart showing an example of transmission processing by the packet processing apparatus according to the present embodiment.
  • the transmission packet is delivered to the transmission reception unit 61.
  • the transmission accepting unit 61 uses the rule extraction unit 31 to search the rule table 11 for a rule that matches the destination address of the transmission packet (step S11).
  • the rule extraction unit 31 includes a route cache, subsequent searches can be speeded up by holding the search results in the route cache.
  • the transmission reception unit 61 passes the rule search result to the rule application unit 41 together with the transmission packet.
  • the basic application unit 411 sets an output interface for the transmission packet as a first process based on the rule (step S12). ). If there is no corresponding route rule, the basic application unit 411 discards the transmission packet and completes the transmission process.
  • the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S13, S14).
  • the dispatch unit 402 is the processor that is currently executing the processing (that is, the processor that is executing the processing of the dispatch unit 402 itself) ) Is selected as a processing processor (step S15).
  • the dispatch unit 402 requests processing by queuing the transmission processing of the upper protocol of the transmission packet in the processing queue of the processing thread 50 corresponding to the determined processing processor (step S16).
  • the transmission processing unit 502 of the processing thread 50 that has received the request executes a packet transmission process (a lower layer transmission process for the packet) as a second process for the packet.
  • FIG. 8 is a flowchart illustrating an example of reception processing by the packet processing device according to the present embodiment when the rule extraction unit 31 does not include a route cache.
  • the reception accepting unit 71 searches the rule table 11 for a rule that matches the destination address of the received packet by the rule extracting unit 31 (step S21).
  • the basic application unit 411 of the rule application unit 41 transfers the received packet and ends the process (step S23). ).
  • the reception receiving unit 71 uses the rule extraction unit 31 to set a dispatch rule corresponding to the transmission source address of the received packet as a rule. Search from the table 11 (step S24).
  • the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S25, S26). On the other hand, when the processing processor identifier is not specified in the rule (No in step S25), the processor that is currently executing the processing (that is, the processor that is executing the processing of the dispatch unit 402) is selected as the processing processor. (Step S27).
  • the dispatch unit 402 requests processing by queuing the reception processing of the upper protocol of the received packet in the processing queue of the processing thread 50 corresponding to the selected processing processor (step S28).
  • the reception processing unit 501 of the processing thread 50 that has received the request executes a packet reception process as a second process for the packet.
  • FIG. 9 is a flowchart illustrating an example of reception processing by the packet processing device according to the present embodiment when the rule extraction unit 31 includes a path cache.
  • steps S21 to S23 and steps S25 to S28 are the same as when the rule extraction unit 31 does not include a path cache (FIG. 8), and thus detailed description thereof is omitted.
  • FIG. 9 differs from FIG. 8 in that step S29 and step S30 are included instead of step S24 in FIG.
  • the reception receiving unit 71 searches for a dispatch rule using the route cache (step S29).
  • step S30 If no rule matching the path cache is held (No in step S30), it is assumed that no processor identifier is specified, and processing is performed. As described above, when a rule is held in a route cache that can be searched at high speed (Yes in step S30), the time required for the search can be reduced by using the dispatch rule (steps S25 to S27). Can do.
  • the route cache is updated by route search in the transmission process (step S11 in FIG. 7). Therefore, if it is a received packet from an address that is periodically transmitted, a rule that matches the route cache is retained (Yes in step S30 in FIG. 9), and therefore the processor is selected based on the dispatch rule (FIG. 9). 9 steps S25 to S27) are possible.
  • a dispatch rule for determining a processing processor is set in the rule table 11.
  • the filtering process in the first embodiment is not always required in packet processing.
  • route search processing is indispensable for packet processing. Therefore, the packet processing apparatus according to the present embodiment can also be applied to packet forwarding when filtering processing is not performed, and performs flexible processor selection by setting rules in the rule table 11 from the user side. It is possible.
  • the processing for setting the output interface for the transmission packet and the processing for selecting the processor that performs the second processing for the transmission packet are performed as one processing. As a result, the processing time for the transmission packet can be reduced.
  • FIG. 10 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment.
  • the packet processing device according to the present embodiment includes a rule table 12, a user application 22, a rule extraction unit 32, a rule application unit 42, a processing thread 52, a transmission reception unit 62, and a reception reception unit 72. I have.
  • the rule table 12 holds the correspondence between addresses, port numbers, and sockets.
  • the socket holds control data related to transport layer connection information represented by TCP, UDP, and the like, and a processor identifier associated with the control data.
  • FIG. 11 is a diagram illustrating an example of the rule table 12 in the packet processing apparatus according to the present embodiment.
  • the rule table 12 includes a processing processor identifier as a socket, in addition to control data necessary for protocol processing.
  • the user application 22 has a file descriptor for specifying the socket, and can set a processing processor identifier of the socket by using a system call (for example, setsockopt) using the file descriptor. Further, the user application 22 can send and receive data using a specific socket (connection) by specifying a file descriptor and using read and write system calls.
  • a system call for example, setsockopt
  • the rule extraction unit 32 specifies a socket representing the control information of the transport layer from the quadruple of the transmission source address and port number and the transmission destination address and port number stored in the packet.
  • the rule application unit 42 includes a basic application unit 421 and a dispatch unit 422.
  • the basic application unit 421 holds the transmission packet or the reception packet in the socket as the first processing.
  • the dispatch unit 422 selects a processor according to the processor identifier held in the socket, and performs the transmission process or the reception process of the transmission packet or the reception packet as the second process in the corresponding processing thread 52. Ask.
  • the processing thread 52 is a kernel thread prepared for each processor, like the processing thread 50 in the first embodiment. However, this embodiment is different from the first embodiment in that the reception processing unit 521 performs layer 4 reception processing on the received packet, and the transmission processing unit 522 performs layer 4 or lower transmission processing on the transmission packet. . The reception processing unit 521 finally delivers the received packet to the user application 22.
  • the transmission reception unit 62 receives a file descriptor and a transmission packet from the user application 22.
  • the transmission reception unit 62 specifies the socket indicated by the file descriptor and passes it to the rule application unit 42.
  • the reception receiving unit 72 receives a received packet from the network, and searches the rule table 12 by its address and port number. Also, the reception accepting unit 72 passes the search result socket and the received packet to the rule applying unit 42.
  • the operation of the transmission process is as follows. First, the user application 22 calls a send system call using a file descriptor for identifying a socket and a transmission packet as arguments. When the file descriptor and the transmission packet are received by the send system call, the transmission reception unit 62 specifies the socket from the file descriptor. Next, as a first process, the basic application unit 421 of the rule application unit 42 sets transmission for the transmission packet using the control information of the transport layer held in the specified socket. Further, the dispatch unit 422 selects the corresponding processing thread 52 from the processor identifier held in the socket, and requests transmission processing of the transmission packet as the second processing.
  • the operation of the reception process is as follows.
  • the reception accepting unit 72 specifies a corresponding socket from the rule table 12 based on the address and port number of the received packet.
  • the basic application unit 421 of the rule application unit 42 sets the reception process of the received packet using the control information of the transport layer held in the specified socket as the first process.
  • the dispatch unit 422 selects the corresponding processing thread 52 from the processor identifier held in the socket, and requests the reception processing of the reception packet as the second processing.
  • the socket holds the control data related to the transport layer connection information and the processing processor in association with each other, thereby setting the transmission or reception for the transmission or reception packet, and the transmission or reception. Since the selection of the processor that performs the second process on the received packet is executed as one process, the processing time for the transmitted or received packet can be reduced. Further, by using an existing system call such as setsockopt, the user application 22 can easily set a processor for performing the second process, and flexible processor selection can be performed.
  • FIG. 12 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment.
  • the packet processing apparatus according to this embodiment includes a rule table 13, a rule extraction unit 33, a rule application unit 40, a processing thread 50, a transmission reception unit 60, and a reception reception unit 70.
  • the operations of those denoted by the same reference numerals as those in FIG. 2 are the same as the operations of the components in the first embodiment, and thus the description thereof is omitted.
  • Rules are set in the rule table 13 by a rule setting device 23 provided outside the packet processing device.
  • a rule setting device 23 provided outside the packet processing device.
  • the open flow (OpenFlow) technique described in Non-Patent Document 1 can be adopted for the rule table 13 and the rule setting device 23.
  • Open flow is an end-to-end flow of communication, and performs path control, failure recovery, load balancing, and optimization on a flow basis.
  • the OpenFlow Switch (OFS: OpenFlow Switch) that functions as a forwarding node has a secure channel for communication with the OpenFlow Controller (OFC: OpenFlow Controller) that is positioned in the control server, and is instructed to add or rewrite as appropriate from the OpenFlow Controller. It operates according to the flow table.
  • the packet processing device, the rule setting device 23, the rule table 13, and the rule stored in the rule table 13 in the present embodiment are the OpenFlow switch, OpenFlow controller, Flow table, and Flow table in OpenFlow, respectively. Corresponds to an entry.
  • FIG. 13 is a diagram illustrating an example of an OpenFlow flow table entry. Referring to FIG. 13, for each flow, a set of a collation condition to collate with a packet header, an action (actions) that defines processing contents, and flow statistical information (stats) is defined for each flow.
  • FIG. 14 is a table showing an example of action names and action contents defined in Non-Patent Document 2.
  • OUTPUT is an action to be output to a designated port (interface).
  • SET_VLAN_VID to SET_TP_DST are actions for modifying the field of the packet header.
  • the OpenFlow switch When the OpenFlow switch receives the packet, it searches the flow table (FIG. 13) for an entry having a matching condition (FlowKey) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch performs the processing content described in the action field of the entry on the received packet. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch forwards the received packet to the OpenFlow controller via the secure channel, and sends it to the source / destination of the received packet. Requests the determination of the route of the packet based on it, receives a flow entry that realizes this, and updates the flow table. In this way, the OpenFlow switch transfers a packet using the entry stored in the flow table as a processing rule.
  • FlowKey a matching condition
  • the rule table 13 (FIG. 12) of the present embodiment has a matching condition field and an action field as shown in FIG.
  • collation condition field collation conditions are stored as in the rule table 10 (FIG. 3) in the first embodiment.
  • action field stores an action and a processor identifier as in the rule table 10 (FIG. 3) in the first embodiment.
  • the rule extraction unit 33 refers to the rule table 13 and inquires the rule setting device 23 corresponding to the OpenFlow controller when there is no rule in the rule table 13 that matches the processing target packet.
  • the rule setting device 23 sets a rule associated with an action and a processor identifier as a rule in the rule table 10.
  • each OpenFlow switch can flexibly and flexibly select a processor that executes packet processing from among a plurality of processors. Can be selected at high speed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The packet processing device is equipped with a rule table that holds rules for correlating information contained in each packet, a processing rule indicating first processing to be applied to the packet, and a processor identifier for identifying a processor that applies second processing to the packet; a rule extraction unit that extracts, from the rule table, a rule that corresponds to information contained in a subject packet, which is a packet to be processed; and a rule application unit that executes the first processing with respect to the subject packet according to the processing rule and sends a request to the processor corresponding to the processor identifier to execute the second processing on the basis of the extracted rule. In a packet transfer device equipped with multiple processors, a processor that executes the packet processing can be selected from among the multiple processors flexibly and quickly.

Description

パケット処理装置、パケット処理方法およびプログラムPacket processing apparatus, packet processing method and program
　（関連出願についての記載）
　本発明は、日本国特許出願：特願２０１１－０２２３０３号（２０１１年２月４日出願）の優先権主張に基づくものであり、同出願の全記載内容は引用をもって本書に組み込み記載されているものとする。 (Description of related applications)
The present invention is based on the priority claim of Japanese Patent Application No. 2011-022303 (filed on Feb. 4, 2011), the entire contents of which are incorporated herein by reference. Shall.
　本発明は、パケット処理装置、パケット処理方法およびプログラムに関し、特に、複数のプロセッサを用いてパケットの送受信を行うパケット処理装置、パケット処理方法およびプログラムに関する。 The present invention relates to a packet processing device, a packet processing method, and a program, and more particularly, to a packet processing device, a packet processing method, and a program that transmit and receive packets using a plurality of processors.
　インターネットトラフィックの増加に伴い、それを支えるパケット処理装置の高速化・高性能化が進んでいる。近年、高速なネットワークインタフェースカードの普及が進んでおり、汎用サーバでも当該ネットワークインタフェースカードを使用することで、パケット処理の高速化が可能となっている。一方、プロセッサの高クロック化による高速化は消費電力増大による限界が見えてきたため、マルチコア・マルチプロセッサ化による性能向上が進んでおり、パケット処理装置での対称型マルチプロセッサの利用も一般的になっている。 As the Internet traffic increases, the speed and performance of the packet processing equipment that supports it is increasing. In recent years, high-speed network interface cards have become widespread, and it is possible to speed up packet processing by using the network interface card even in general-purpose servers. On the other hand, the speed-up of the processor due to the higher clock speed has become the limit due to the increase in power consumption. Therefore, the performance improvement by the multi-core and multi-processor is progressing. ing.
　Ｌｉｎｕｘ（登録商標）等の汎用ＯＳを利用してパケット処理装置を実現した場合、高速なネットワークカードを搭載していると、送受信におけるプロセッサ処理がボトルネックとなってしまい、ワイヤレートでの通信が困難になる。仮にマルチコアプロセッサを採用していても、ネットワークインタフェースカードからの割り込み先となった単一のプロセッサ（コア）にパケットの処理が集中することにより、ボトルネックが発生し、十分な負荷分散を行うことができないという問題がある。 When a packet processing apparatus is realized using a general-purpose OS such as Linux (registered trademark), if a high-speed network card is installed, processor processing in transmission / reception becomes a bottleneck, and communication at a wire rate becomes impossible. It becomes difficult. Even if a multi-core processor is used, bottlenecks will occur due to the concentration of packet processing on a single processor (core) that is the interrupt destination from the network interface card, and sufficient load distribution will be performed. There is a problem that can not be.
　この問題を解決するために、特許文献１では、処理すべきパケットのヘッダ情報に基づいて、複数のプロセッサから、そのパケットを処理するプロセッサを一意的に決定している。具体的には、パケットのヘッダの一部のフィールドからハッシュ値を算出し、得られたハッシュ値についてプロセッサ数（コア数）によるモジュロ演算を行い、プロセッサ番号を求めている。そして、求めたプロセッサ番号のプロセッサに、該パケットの処理を行わせる。ここで、プロセッサ数（コア数）によるモジュロ演算を行っているため、当該演算により、プロセッサ番号が一意に求まる。すなわち、ハッシュ値から求めた剰余（すなわち、プロセッサ番号）が異なれば、処理するプロセッサも異なることとなり、パケットの処理を複数のプロセッサ（コア）間で分散することが可能となる。したがって、単一のプロセッサ（コア）による処理がボトルネックとなることなく、負荷分散を実現することができる。 In order to solve this problem, in Patent Document 1, a processor that processes a packet is uniquely determined from a plurality of processors based on header information of the packet to be processed. Specifically, a hash value is calculated from a partial field of the packet header, and a modulo operation is performed on the obtained hash value by the number of processors (number of cores) to obtain a processor number. Then, the processor having the obtained processor number is made to process the packet. Here, since the modulo operation is performed by the number of processors (the number of cores), the processor number is uniquely obtained by the operation. That is, if the remainder (that is, the processor number) obtained from the hash value is different, the processor to be processed is also different, and packet processing can be distributed among a plurality of processors (cores). Therefore, load distribution can be realized without the processing by a single processor (core) becoming a bottleneck.
　以下、プロセッサおよびプロセッサコアを、「プロセッサ」と総称する。 Hereinafter, a processor and a processor core are collectively referred to as a “processor”.
特表２００２―５３８７２４号公報Special table 2002-538724 gazette
　上記の特許文献および非特許文献の各開示を、本書に引用をもって繰り込むものとする。以下の分析は、本発明者によってなされたものである。 The disclosures of the above patent documents and non-patent documents are incorporated herein by reference. The following analysis was made by the present inventors.
　特許文献１に記載のパケット処理装置においては、上記のとおり、パケットのヘッダの一部のフィールドに基づいて、パケットを処理するプロセッサを一意に決定している。そのため、当該ヘッダの一部のフィールドから算出されるハッシュ値が同じであれば、モジュロ演算から求まるプロセッサ番号は常に同一となり、当該パケットを処理するプロセッサが固定されてしまう。したがって、パケットの処理を実行するプロセッサを柔軟に選択することはできないという問題がある。 In the packet processing device described in Patent Document 1, as described above, a processor that processes a packet is uniquely determined based on a partial field of the packet header. Therefore, if the hash values calculated from some fields of the header are the same, the processor number obtained from the modulo operation is always the same, and the processor that processes the packet is fixed. Therefore, there is a problem that a processor that executes packet processing cannot be flexibly selected.
　そこで、複数のプロセッサを備えたパケット転送装置において、パケットの処理を実行するプロセッサを複数のプロセッサの中から柔軟かつ高速に選択できるようにすることが課題となる。本発明の目的は、かかる課題を解決するパケット処理装置、パケット処理方法およびプログラムを提供することにある。 Therefore, in a packet transfer apparatus having a plurality of processors, it becomes an issue to be able to select a processor that executes packet processing flexibly and at high speed from among the plurality of processors. The objective of this invention is providing the packet processing apparatus, the packet processing method, and program which solve this subject.
　本発明の第１の視点に係るパケット処理装置は、
　パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルと、
　処理すべきパケットである対象パケットに格納された情報に対応するルールを、前記ルールテーブルから抽出するルール抽出部と、
　抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行うルール適用部と、を備えている。 The packet processing device according to the first aspect of the present invention provides:
A rule table that holds information stored in a packet, a processing rule that indicates a first process for the packet, and a rule that associates a processor identifier that identifies a processor that performs the second process for the packet;
A rule extraction unit that extracts a rule corresponding to information stored in a target packet, which is a packet to be processed, from the rule table;
A rule applying unit configured to execute the first process in accordance with the processing rule for the target packet based on the extracted rule and to request the second process to the processor corresponding to the processor identifier; It has.
　本発明の第２の視点に係るパケット処理方法は、
　複数のプロセッサのうちの一のプロセッサが、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルから、処理すべきパケットである対象パケットに格納された情報に対応するルールを抽出する工程と、
　前記一のプロセッサが、抽出されたルール基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行う工程と、を含む。 The packet processing method according to the second aspect of the present invention is:
One of the plurality of processors associates the information stored in the packet, the processing rule indicating the first process for the packet, and the processor identifier that identifies the processor performing the second process for the packet Extracting a rule corresponding to information stored in a target packet, which is a packet to be processed, from a rule table holding rules;
Based on the extracted rule, the one processor executes the first process according to the processing rule for the target packet, and requests the processor corresponding to the processor identifier for the second process. And a process.
　本発明の第３の視点に係るプログラムは、
　パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルから、処理すべきパケットである対象パケットに格納された情報に対応するルールを抽出する処理と、
　抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行う処理と、を複数のプロセッサのうちの一のプロセッサに実行させる。 The program according to the third aspect of the present invention is:
Processing should be performed from a rule table that holds information stored in a packet, a processing rule indicating a first process for the packet, and a rule that associates a processor identifier that identifies a processor that performs the second process for the packet. A process for extracting a rule corresponding to information stored in a target packet that is a packet;
A plurality of processes for executing the first process according to the processing rule for the target packet and performing a request for the second process to the processor corresponding to the processor identifier based on the extracted rule One of the processors is executed.
　なお、プログラムは、非トランジエントなコンピュータ読み取り可能記録媒体（non-transient computer-readable storage medium）に記録されたプログラム製品として提供してもよい。 Note that the program may be provided as a program product recorded on a non-transient computer-readable storage medium.
　本発明に係るパケット処理装置、パケット処理方法およびプログラムによると、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールテーブルを備えるため、該ルールテーブルのプロセッサ識別子を設定することにより、パケットの処理を実行するプロセッサを複数のプロセッサの中から柔軟に選択することができる。 According to the packet processing device, the packet processing method, and the program according to the present invention, the information stored in the packet, the processing rule indicating the first processing for the packet, and the processor performing the second processing for the packet are identified. Since a rule table for associating processor identifiers with each other is provided, by setting a processor identifier in the rule table, a processor that executes packet processing can be flexibly selected from a plurality of processors.
　また、本発明に係るパケット処理装置およびパケット処理方法によると、該ルールテーブルから抽出した、処理すべきパケットに対応するルールに基づき、該パケットに対する第１の処理の実行と、該パケットを処理するプロセッサの選択とを1つの処理として実行するため、パケットの処理を高速に行うことができる。 Further, according to the packet processing device and the packet processing method according to the present invention, based on the rule corresponding to the packet to be processed, extracted from the rule table, the first process is performed on the packet and the packet is processed. Since the processor selection is executed as one process, packet processing can be performed at high speed.
本発明に係るパケット処理装置の構成を概略的に示すブロック図である。It is a block diagram which shows roughly the structure of the packet processing apparatus concerning this invention. 第１の実施形態に係るパケット処理装置の構成を示すブロック図である。It is a block diagram which shows the structure of the packet processing apparatus which concerns on 1st Embodiment. 第１の実施形態に係るパケット処理装置におけるルールテーブルを示す図である。It is a figure which shows the rule table in the packet processing apparatus which concerns on 1st Embodiment. 第１の実施形態に係るパケット処理装置の動作を示すフローチャートである。It is a flowchart which shows operation | movement of the packet processing apparatus which concerns on 1st Embodiment. 第２の実施形態に係るパケット処理装置の構成を示すブロック図である。It is a block diagram which shows the structure of the packet processing apparatus which concerns on 2nd Embodiment. 第２の実施形態に係るパケット処理装置におけるルールテーブルを示す図である。It is a figure which shows the rule table in the packet processing apparatus which concerns on 2nd Embodiment. 第２の実施形態に係るパケット処理装置による送信処理を示すフローチャートである。It is a flowchart which shows the transmission process by the packet processing apparatus which concerns on 2nd Embodiment. 第２の実施形態に係るパケット処理装置による受信処理を示すフローチャートである。It is a flowchart which shows the reception process by the packet processing apparatus which concerns on 2nd Embodiment. 第２の実施形態に係るパケット処理装置による受信処理を示すフローチャートである。It is a flowchart which shows the reception process by the packet processing apparatus which concerns on 2nd Embodiment. 第３の実施形態に係るパケット処理装置の構成を示すブロック図である。It is a block diagram which shows the structure of the packet processing apparatus which concerns on 3rd Embodiment. 第３の実施形態に係るパケット処理装置におけるルールテーブルを示す図である。It is a figure which shows the rule table in the packet processing apparatus which concerns on 3rd Embodiment. 第４の実施形態に係るパケット処理装置の構成を示すブロック図である。It is a block diagram which shows the structure of the packet processing apparatus which concerns on 4th Embodiment. オープンフローのフローテーブルのエントリを示す図である。It is a figure which shows the entry of the flow table of OpenFlow. オープンフローのアクションを示す図である。It is a figure which shows the action of OpenFlow.
　はじめに、本発明の概要について説明する。なお、この概要に付記する図面参照符号は、専ら理解を助けるための例示であり、本発明を図示の態様に限定することを意図するものではない。 First, the outline of the present invention will be described. Note that the reference numerals of the drawings attached to this summary are merely examples for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.
　図１を参照すると、本発明のパケット処理装置は、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブル（１１０）と、処理すべきパケットである対象パケットに格納された情報に適合するルールを、ルールテーブル（１１０）から抽出するルール抽出部（１３０）と、抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する第２の処理を依頼するルール適用部（１４０）と、を備えている。 Referring to FIG. 1, the packet processing apparatus according to the present invention includes information stored in a packet, a processing rule indicating a first process for the packet, and a processor identifier for identifying a processor that performs the second process for the packet. A rule table (110) that holds rules for associating each other with each other, a rule extraction unit (130) that extracts rules that match information stored in a target packet that is a packet to be processed, from the rule table (110), and an extraction A rule applying unit (140) for requesting execution of a first process according to the processing rule for the target packet and a second process for a processor corresponding to the processor identifier based on the determined rule. ing.
　本発明のパケット処理装置は、パケットに対する照合条件とパケットを処理するプロセッサとを関連付けるルールを保持するルールテーブル（１１０）を備えている。したがって、ルールテーブル（１１０）のルールに対して、照合条件およびプロセッサの識別子を直接設定することで、パケットを処理するプロセッサを柔軟に選択することができ、特許文献１のように、同一のヘッダ情報を有するパケット群を処理するプロセッサが、所定の演算規則にしたがって一意に固定されることがなくなる。また、本発明のパケット処理装置によると、ユーザはルールテーブル（１１０）に格納されたルールを書き換えることで、パケットを処理するプロセッサ選択の規則を容易に変更することができる。 The packet processing apparatus according to the present invention includes a rule table (110) that holds a rule that associates a matching condition for a packet with a processor that processes the packet. Therefore, by directly setting the matching condition and the processor identifier for the rule in the rule table (110), the processor that processes the packet can be flexibly selected. A processor that processes a packet group having information is not uniquely fixed according to a predetermined calculation rule. Also, according to the packet processing apparatus of the present invention, the user can easily change the rules for selecting a processor for processing a packet by rewriting the rules stored in the rule table (110).
　さらに、本発明のパケット処理装置におけるルールテーブル（１１０）のルールは、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付ける。したがって、ルール抽出部（１３０）によって、対象パケットに対応するルールが抽出されると、パケットに対して実行すべき第１の処理の内容が特定されるのみならず、該パケットに対する第２の処理を実行すべきプロセッサも特定される。したがって、本発明のパケット処理装置によると、パケットに対する処理を示す処理規則をテーブルの参照によって特定し、パケットに対する処理を実行するプロセッサを別途特定する場合と比較して、パケットの処理を高速に行うことができる。 Further, the rules of the rule table (110) in the packet processing device of the present invention include information stored in a packet, a processing rule indicating a first process for the packet, and a processor that performs a second process for the packet. Associate the identifying processor identifiers with each other. Therefore, when the rule corresponding to the target packet is extracted by the rule extraction unit (130), not only the content of the first process to be executed on the packet is specified, but also the second process for the packet is performed. A processor to execute is also specified. Therefore, according to the packet processing device of the present invention, the processing rule indicating the processing for the packet is specified by referring to the table, and the processing of the packet is performed at a higher speed than when the processor for executing the processing for the packet is specified separately. be able to.
　以上より、本発明のパケット処理装置によると、複数のプロセッサを備えたパケット転送装置において、パケットの処理を実行するプロセッサを複数のプロセッサの中から柔軟かつ高速に選択することができる。 As described above, according to the packet processing apparatus of the present invention, in a packet transfer apparatus including a plurality of processors, a processor that executes packet processing can be selected flexibly and at high speed from the plurality of processors.
　なお、本発明において、下記の形態が可能である。 In the present invention, the following modes are possible.
［形態１］
　上記第１の視点に係るパケット処理装置のとおりである。 [Form 1]
The packet processing apparatus according to the first aspect is as described above.
［形態２］
　前記第１の処理は、前記対象パケットを破棄すべきか否かを判定する処理であり、
　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であってもよい。 [Form 2]
The first process is a process for determining whether or not to discard the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. In some cases, it may be a lower layer process for the target packet.
［形態３］
　前記ルール適用部は、前記第１の処理において前記対象パケットが破棄すべきパケットでない場合には、前記対象パケットに対する前記第２の処理を前記プロセッサに依頼するようにしてもよい。 [Form 3]
The rule application unit may request the processor to perform the second process on the target packet when the target packet is not a packet to be discarded in the first process.
［形態４］
　前記ルールテーブルは、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子、および、該パケットを含むフローを定義するフィールドを示すフロー定義フィールドを互いに関連付けるルールを保持し、
　前記ルール適用部は、抽出されたルールに複数のプロセッサ識別子が含まれる場合には、前記フロー定義フィールドを参照し、該複数のプロセッサ識別子に相当する複数のプロセッサのうちのいずれかのプロセッサに対して、同一のフローに含まれるすべての対象パケットに対する前記第２の処理を依頼するようにしてもよい。 [Form 4]
The rule table defines information stored in a packet, a processing rule indicating a first process for the packet, a processor identifier for identifying a processor that performs a second process for the packet, and a flow including the packet Holds rules that associate flow definition fields that represent fields with each other,
When a plurality of processor identifiers are included in the extracted rule, the rule application unit refers to the flow definition field, and selects one of a plurality of processors corresponding to the plurality of processor identifiers. Thus, the second process may be requested for all target packets included in the same flow.
［形態５］
　前記ルール抽出部は、前記ルールテーブルが前記対象パケットに格納された情報に対応するルールを保持していない場合には、前記ルールを設定可能なルール設定装置に該情報に適合するルールを設定するように依頼するようにしてもよい。 [Form 5]
When the rule table does not hold a rule corresponding to the information stored in the target packet, the rule extraction unit sets a rule that matches the information in a rule setting device capable of setting the rule. You may make it request.
［形態６］
　前記第１の処理は、前記対象パケットの宛先を判定する処理であり、
　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であってもよい。 [Form 6]
The first process is a process of determining a destination of the target packet;
The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. In some cases, it may be a lower layer process for the target packet.
［形態７］
　前記ルール適用部は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合において、前記対象パケットの宛先が前記パケット処理装置である場合には、前記対象パケットに対する前記第２の処理を前記プロセッサに依頼するようにしてもよい。 [Form 7]
When the target packet is a packet to be received by the packet processing device and the destination of the target packet is the packet processing device, the rule application unit performs the second processing on the target packet. You may make it ask the said processor.
［形態８］
　前記ルール抽出部は、抽出したルールを一時的に保持するキャッシュを有し、前記対象パケットに格納された情報に適合するルールを該キャッシュから抽出し、
　前記ルール適用部は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合において、前記対象パケットに適合するルールが前記ルール抽出部により前記キャッシュから抽出されたときには、前記対象パケットに対する前記第２の処理を前記プロセッサに依頼するようにしてもよい。 [Form 8]
The rule extraction unit has a cache that temporarily holds the extracted rules, and extracts rules that match the information stored in the target packet from the cache,
The rule application unit, when the target packet is a packet to be received by the packet processing device, and when a rule that matches the target packet is extracted from the cache by the rule extraction unit, the rule application unit The second process may be requested from the processor.
［形態９］
　前記第１の処理は、前記対象パケットを送受信する際のトランスポートレイヤにおける制御情報を特定する処理であり、
　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４の受信処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４以下の送信処理であってもよい。 [Form 9]
The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. When the packet is to be transmitted by the packet processing device, it may be a layer 4 or lower transmission process for the target packet using the specified control information.
［形態１０］
　前記ルールテーブルは、優先度に応じてソートされた複数のルールを保持し、
　前記ルール抽出部は、前記対象パケットに格納された情報に適合する複数のルールが前記ルールテーブルに格納されている場合には、該複数のルールのうちの優先度が高いものを抽出するようにしてもよい。 [Mode 10]
The rule table holds a plurality of rules sorted according to priority,
When a plurality of rules that match the information stored in the target packet are stored in the rule table, the rule extraction unit extracts a rule having a high priority from the plurality of rules. May be.
［形態１１］
　前記ルールテーブルのルールは、パケットに格納された情報として、送信元アドレス、宛先アドレス、送信元ポート番号、および、宛先ポート番号のうちの少なくともいずれかを含んでいてもよい。 [Form 11]
The rules in the rule table may include at least one of a source address, a destination address, a source port number, and a destination port number as information stored in the packet.
［形態１２］
　前記ルールテーブルに対して、ルールの追加、変更、または、削除を行うルール設定部をさらに備えていてもよい。 [Form 12]
You may further provide the rule setting part which adds, changes, or deletes a rule with respect to the said rule table.
［形態１３］
　上記第２の視点に係るパケット処理方法のとおりである。 [Form 13]
The packet processing method according to the second aspect is as described above.
［形態１４］
　また、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルから、処理すべきパケットである対象パケットに格納された情報に対応するルールを抽出する処理と、
　抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行う処理と、を複数のプロセッサのうちの一のプロセッサに実行させるプログラムが提供される。 [Form 14]
Further, processing is performed from a rule table that holds information stored in a packet, a processing rule indicating a first process for the packet, and a rule that associates a processor identifier for identifying a processor that performs the second process for the packet. A process for extracting a rule corresponding to information stored in a target packet that is a packet to be processed;
A plurality of processes for executing the first process according to the processing rule for the target packet and performing a request for the second process to the processor corresponding to the processor identifier based on the extracted rule A program to be executed by one of the processors is provided.
　（実施形態１）
　第１の実施形態に係るパケット処理装置について、図面を参照して説明する。図２は、本実施形態に係るパケット処理装置の構成を一例として示すブロック図である。図２を参照すると、本実施形態に係るパケット処理装置は、ルールテーブル１０、ルール設定部２０、ルール抽出部３０、ルール適用部４０、処理スレッド５０、送信受付部６０、および、受信受付部７０を備えている。 (Embodiment 1)
The packet processing apparatus according to the first embodiment will be described with reference to the drawings. FIG. 2 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 2, the packet processing apparatus according to the present embodiment includes a rule table 10, a rule setting unit 20, a rule extraction unit 30, a rule application unit 40, a processing thread 50, a transmission reception unit 60, and a reception reception unit 70. It has.
　また、本実施形態のパケット処理装置は、複数のプロセッサ（またはプロセッサコア）に対応するＯＳを搭載しており、ネットワークインタフェースデバイスを介してネットワークと接続し、ＩＰパケットに代表されるパケットの処理および上位レイヤのプロトコル処理をソフトウェア（ＯＳを含む）で行うものである。すなわち、図２に示した構成要素は、それぞれ、ソフトウェアにより実現しうる。ただし、図２の構成要素の一部または全部をハードウェアにより実現してもよい。 The packet processing apparatus according to the present embodiment includes an OS corresponding to a plurality of processors (or processor cores), is connected to a network via a network interface device, and processes packets represented by IP packets. The upper layer protocol processing is performed by software (including the OS). That is, each of the components shown in FIG. 2 can be realized by software. However, some or all of the components in FIG. 2 may be realized by hardware.
　ルールテーブル１０は、送受信パケットのフィルタリングの規則を記述したフィルタリングルールとプロセッサの割り当て規則を記述したディスパッチルールを保持する。フィルタリングルールおよびディスパッチルールは、単一のテーブルで管理する。 The rule table 10 holds a filtering rule describing filtering rules for transmission and reception packets and a dispatch rule describing processor allocation rules. Filtering rules and dispatch rules are managed in a single table.
　図３は、ルールテーブル１０を一例として示す図である。図３を参照すると、ルールテーブル１０は、受信・送信ごとに管理される。ルールテーブル１０の各行に相当する一つのルールは、少なくとも、照合条件、アクション、および、処理プロセッサ識別子を含む。また、ルールテーブル１０の各ルールは、フロー定義フィールドを含んでいてもよい。 FIG. 3 is a diagram illustrating the rule table 10 as an example. Referring to FIG. 3, the rule table 10 is managed for each reception / transmission. One rule corresponding to each row of the rule table 10 includes at least a matching condition, an action, and a processor identifier. Each rule in the rule table 10 may include a flow definition field.
　照合条件は、パケットのＬ３レイヤ以上のヘッダのフィールドに関する条件式を表す。例えば、図３の第１行目のルールは、ＴＣＰプロトコルであり、宛先ポート番号が８０番であるパケットに関するルールであることを表す。照合条件として、図３に示したプロトコル番号およびポート番号のみならず、ＩＰアドレス、ＡＨヘッダ（Ａｕｔｈｅｎｔｉｃａｔｉｏｎ　Ｈｅａｄｅｒ）、ＥＳＰ（Ｅｎｃａｐｓｕｌａｔｉｎｇ　Ｓｅｃｕｒｉｔｙ　Ｐａｙｌｏａｄ）ヘッダにおけるＳＰＩ（Ｓｅｃｕｒｉｔｙ　Ｐａｒａｍｅｔｅｒ　Ｉｎｄｅｘ）値等のさまざまなフィールドに関する条件を記述しうる。 The collation condition represents a conditional expression regarding the header field of the L3 layer or higher of the packet. For example, the rule on the first line in FIG. 3 is a TCP protocol and represents a rule relating to a packet whose destination port number is 80. As matching conditions, not only the protocol number and port number shown in FIG. 3, but also various field conditions such as SPI (Security Parameter Index) values in IP address, AH header (Authentication Header), ESP (Encapsulating Security Payload) header, etc. Can be described.
　アクションは、送受信パケットに対する第１の処理（第１の処理、基本処理）を示す。アクションには、例えば、パケットの処理を続行するＡＣＣＥＰＴ、パケットを破棄するＤＲＯＰが用いられる。また、アクションとして、これら２つの処理以外に、パケットの一部のデータを書き換える処理などを記述してもよい。 The action indicates a first process (first process, basic process) for a transmission / reception packet. For the action, for example, ACCEPT for continuing the processing of the packet or DROP for discarding the packet is used. In addition to these two processes, a process for rewriting part of the data of the packet may be described as an action.
　処理プロセッサ識別子は、照合条件にマッチ（適合）したパケットの処理を行うプロセッサを表す。処理プロセッサ識別子には、０個以上のプロセッサ識別子を記述することができる。 The processing processor identifier represents a processor that processes a packet that matches the matching condition. The processing processor identifier can describe zero or more processor identifiers.
　フロー定義フィールドは、同一のフローか否かを識別するために使用するパケットのヘッダのフィールドを表す。フロー定義フィールドは、処理プロセッサ識別子に複数のプロセッサ識別子が記載されている場合において、同一のフローに属するパケットが同一のプロセッサで処理されるように、処理プロセッサ識別子に記載の中から１つのプロセッサを選択するために用いられる。 The flow definition field represents a header field of a packet used for identifying whether or not the flow is the same. In the flow definition field, when a plurality of processor identifiers are described in the processing processor identifier, one processor among the descriptions in the processing processor identifier is selected so that packets belonging to the same flow are processed by the same processor. Used to select.
　ルールテーブル１０中のルールは、優先度順に整列して管理することが好ましい。 It is preferable that the rules in the rule table 10 are managed in order of priority.
　ルール設定部２０は、ルールテーブル１０に対してルールの追加、変更、削除等のルールの設定を行う。ルール設定部２０は、例えば、ユーザアプリケーションとして動作し、ユーザ／カーネル間のメッセージ通信を行うことで、ルールを設定する。 The rule setting unit 20 sets rules such as adding, changing, and deleting rules with respect to the rule table 10. For example, the rule setting unit 20 operates as a user application and sets a rule by performing message communication between the user and the kernel.
　ルール抽出部３０は、送受信パケットに格納された情報とルールテーブル１０の照合条件とを照合し、マッチするルールを検索する。ルール抽出部３０は、複数のルールがマッチした場合には、例えば、マッチするルールのうちの優先度の最も高いものを検索結果として返す。 The rule extraction unit 30 collates the information stored in the transmission / reception packet with the collation conditions of the rule table 10 and searches for a matching rule. When a plurality of rules are matched, the rule extraction unit 30 returns, for example, the highest priority among matching rules as a search result.
　ルール適用部４０は、基本適用部４０１およびディスパッチ部４０２を有する。ルール適用部４０は、ルールと送受信パケットを受け取ると、基本適用部４０１において第１の処理としてフィルタリングルールが適用され、ディスパッチ部４０２においてディスパッチルールが適用される。一方、フィルタリングルールの適用により処理が中止された場合には、ディスパッチ部４０２におけるディスパッチルールの適用を行わず、そのパケットの処理を終了する。 The rule application unit 40 includes a basic application unit 401 and a dispatch unit 402. When the rule application unit 40 receives the rule and the transmission / reception packet, the basic application unit 401 applies the filtering rule as the first process, and the dispatch unit 402 applies the dispatch rule. On the other hand, when the processing is canceled due to the application of the filtering rule, the dispatch rule is not applied in the dispatch unit 402, and the processing of the packet is terminated.
　基本適用部４０１は、第１の処理として、ルールにおけるアクションに関する処理を行う。ルールのアクションがＤＲＯＰである場合には、基本適用部４０１は、送受信パケットを破棄する。一方、アクションがＡＣＣＥＰＴである場合に、ディスパッチ部４０２は、ルール中の処理プロセッサ識別子に応じて送受信パケットを処理する処理プロセッサを決定し、そのプロセッサに対応する処理スレッド５０に対してパケットの処理を依頼する。 The basic application unit 401 performs a process related to the action in the rule as the first process. When the rule action is DROP, the basic application unit 401 discards the transmission / reception packet. On the other hand, when the action is ACCEPT, the dispatch unit 402 determines a processing processor that processes the transmission / reception packet according to the processing processor identifier in the rule, and processes the packet to the processing thread 50 corresponding to the processor. Ask.
　処理スレッド５０は、プロセッサ毎に用意されるカーネルスレッドであり、パケットに対する第２の処理として、受信パケットのレイヤ３およびレイヤ４の受信処理、送信パケットのレイヤ３およびレイヤ２の送信処理を行う。処理スレッド５０は、受信処理部５０１および送信処理部５０２を備え、処理キュー（非図示）を保持する。処理キューには、パケットと処理区分（送信／受信）が格納される。処理スレッド５０は、処理キューに格納されたパケットを順次取り出し、処理区分が送信の場合には、送信処理部５０２による送信処理をパケットに対して行う。一方、処理区分が受信の場合には、処理スレッド５０は、受信処理部５０１による受信処理をパケットに対して行う。送信処理部５０２は、送信パケットに対してレイヤ３およびレイヤ２の送信処理を行い、パケットをネットワークに送出する。一方、受信処理部５０１は、受信パケットに対して、レイヤ３およびレイヤ４の受信処理を行い、必要に応じてユーザアプリケーションに受信パケットを渡す処理を行う。 The processing thread 50 is a kernel thread prepared for each processor, and performs reception processing of layer 3 and layer 4 for received packets and transmission processing of layer 3 and layer 2 for transmission packets as second processing for packets. The processing thread 50 includes a reception processing unit 501 and a transmission processing unit 502, and holds a processing queue (not shown). The processing queue stores a packet and a processing classification (transmission / reception). The processing thread 50 sequentially takes out the packets stored in the processing queue, and when the processing classification is transmission, performs transmission processing by the transmission processing unit 502 on the packet. On the other hand, when the processing classification is reception, the processing thread 50 performs reception processing by the reception processing unit 501 on the packet. The transmission processing unit 502 performs layer 3 and layer 2 transmission processing on the transmission packet, and sends the packet to the network. On the other hand, the reception processing unit 501 performs layer 3 and layer 4 reception processing on the received packet, and performs processing of passing the received packet to the user application as necessary.
　送信受付部６０は、ユーザアプリケーションまたはカーネル内部からの送信パケットを受け取り、送信パケットをルール抽出部３０で照合し、照合結果として得られたルールと送信パケットをルール適用部４０に渡す。 The transmission reception unit 60 receives a transmission packet from the user application or the kernel, collates the transmission packet by the rule extraction unit 30, and passes the rule and the transmission packet obtained as a collation result to the rule application unit 40.
　受信受付部７０は、ネットワークからの受信パケットを受け取り、受信パケットをルール抽出部３０で照合し、照合結果として得られたルールと受信パケットをルール適用部４０に渡す。 The reception accepting unit 70 receives a received packet from the network, collates the received packet with the rule extracting unit 30, and passes the rule and the received packet obtained as a collation result to the rule applying unit 40.
　次に、本実施形態に係るパケット処理装置の動作について、図面を参照して説明する。図４は、本実施形態に係るパケット処理装置の動作を一例として示すフローチャートである。 Next, the operation of the packet processing apparatus according to the present embodiment will be described with reference to the drawings. FIG. 4 is a flowchart showing an example of the operation of the packet processing apparatus according to the present embodiment.
　図４を参照すると、ネットワークからパケットが到着すると、受信受付部７０に受信パケットが渡される。受信パケットを受け取った受信受付部７０は、ルール抽出部３０によって受信パケットにマッチするルールをルールテーブル１０から検索し（ステップＳ１）、その結果を受信パケットと共にルール適用部４０に渡す。 Referring to FIG. 4, when a packet arrives from the network, the received packet is delivered to the reception accepting unit 70. The reception accepting unit 70 that has received the received packet searches the rule table 10 for a rule that matches the received packet by the rule extracting unit 30 (step S1), and passes the result to the rule applying unit 40 together with the received packet.
　次に、ルール適用部４０は、ルールと受信パケットを受け取ると、基本適用部４０１が、第１の処理としてアクションを適用する（ステップＳ２）。ルール中のアクションがＤＲＯＰである場合には（ステップＳ３のＮｏ）、基本適用部４０１は、受信パケットを破棄し（ステップＳ４）、その受信パケットの処理を完了する。 Next, when the rule applying unit 40 receives the rule and the received packet, the basic applying unit 401 applies an action as the first process (step S2). If the action in the rule is DROP (No in step S3), the basic application unit 401 discards the received packet (step S4) and completes the processing of the received packet.
　一方、アクションがＡＣＣＥＰＴである場合には（ステップＳ３のＹｅｓ）、ディスパッチ部４０２は、ルールの処理プロセッサ識別子に応じて処理プロセッサを選択する（ステップＳ５のＹｅｓ、Ｓ６）。一方、ルールに処理プロセッサ識別子が指定されていない場合には（ステップＳ５のＮｏ）、ディスパッチ部４０２は、現在処理を実行中のプロセッサ（すなわち、ディスパッチ部４０２の処理を実行しているプロセッサ自身）を処理プロセッサとして選択する（ステップＳ７）。 On the other hand, when the action is ACCEPT (Yes in step S3), the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S5, S6). On the other hand, when the processing processor identifier is not specified in the rule (No in step S5), the dispatch unit 402 is currently executing the processor (that is, the processor executing the processing of the dispatch unit 402 itself). Is selected as a processing processor (step S7).
　次に、ディスパッチ部４０２は、決定した処理プロセッサに対応する処理スレッド５０の処理キューに受信パケットの上位プロトコルの受信処理をキューイングすることで処理を依頼する（ステップＳ８）。依頼を受けた処理スレッド５０の受信処理部５０１は、パケットに対する第２の処理として、パケット受信処理（すなわち、受信パケットに対する上位レイヤの受信処理）を実行する。 Next, the dispatch unit 402 requests processing by queuing the reception processing of the upper protocol of the received packet in the processing queue of the processing thread 50 corresponding to the determined processing processor (step S8). The reception processing unit 501 of the processing thread 50 that has received the request executes a packet reception process (that is, a higher layer reception process for the received packet) as a second process for the packet.
　ステップＳ６において、フロー定義フィールドを利用する場合、指定されたフィールドのハッシュ値をもとに、処理プロセッサ識別子で指定されたプロセッサの中から処理プロセッサを決定する。特に、フロー定義フィールドとして、同一のフローを識別することができるフィールドを選択することが好ましい。これにより、同一のフローに属するパケットが複数のプロセッサに分散することを防ぐことができ、排他制御およびパケットの整列によって生じるオーバーヘッドを軽減することができる。 In step S6, when the flow definition field is used, the processing processor is determined from the processors specified by the processing processor identifier based on the hash value of the specified field. In particular, it is preferable to select a field that can identify the same flow as the flow definition field. Thereby, packets belonging to the same flow can be prevented from being distributed to a plurality of processors, and overhead caused by exclusive control and packet alignment can be reduced.
　パケットの送信処理では、パケット送信時に送信パケットに対してルール照合が行われ、依頼を受けた処理スレッドがパケットの送信処理を行う点を除いて同様の処理が行われる。したがって、パケット送信時の処理シーケンスについては、説明を省略する。 In the packet transmission process, rule matching is performed on the transmission packet at the time of packet transmission, and the same process is performed except that the requested processing thread performs the packet transmission process. Therefore, description of the processing sequence at the time of packet transmission is omitted.
　本実施形態では、フィルタリングルール（図３の照合条件とアクションとの組）を記載したルールテーブル１０に、送受信パケットの処理を行う処理プロセッサを決定するディスパッチルール（図３の照合条件と処理プロセッサ識別子およびフロー定義フィールドとの組）を併せて記載する。また、本実施形態によると、ルールテーブル１０へのルールをユーザ側から設定することができる。したがって、処理プロセッサを選択するためのルールを一元的に管理でき、ユーザのポリシーに基づいて柔軟なプロセッサ選択を行うことができる。さらに、パケットに対するフィルタリング処理とパケットに対する第２の処理を行う処理プロセッサの選択とを１つの処理として実行するため、該パケットに対する処理時間を削減することが可能である。 In this embodiment, a dispatch rule (a matching condition and a processing processor identifier in FIG. 3) is determined in the rule table 10 in which filtering rules (a set of matching conditions and actions in FIG. 3) are described. And the flow definition field). Moreover, according to this embodiment, the rule to the rule table 10 can be set from the user side. Therefore, rules for selecting processing processors can be managed in a centralized manner, and flexible processor selection can be performed based on a user policy. Furthermore, since the filtering process for the packet and the selection of the processing processor that performs the second process for the packet are executed as one process, the processing time for the packet can be reduced.
　（実施形態２）
　第２の実施形態に係るパケット処理装置について、図面を参照して説明する。図５は、本実施形態に係るパケット処理装置の構成を一例として示すブロック図である。図５を参照すると、本実施形態におけるパケット処理装置は、ルールテーブル１１、ルール設定部２１、ルール抽出部３１、ルール適用部４１、処理スレッド５０、送信受付部６１、および、受信受付部７１を備えている。 (Embodiment 2)
A packet processing apparatus according to the second embodiment will be described with reference to the drawings. FIG. 5 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 5, the packet processing apparatus according to the present embodiment includes a rule table 11, a rule setting unit 21, a rule extraction unit 31, a rule application unit 41, a processing thread 50, a transmission reception unit 61, and a reception reception unit 71. I have.
　ルールテーブル１１は、送受信パケットの宛先アドレスから転送先を決定するための経路ルール、および、送信パケットの宛先アドレス又は受信パケットの送信元アドレスから処理プロセッサを決定するためのディスパッチルールを１つのテーブルとして保持する。 The rule table 11 includes a route rule for determining a transfer destination from a destination address of a transmission / reception packet and a dispatch rule for determining a processing processor from a destination address of a transmission packet or a transmission source address of a reception packet as one table. Hold.
　図６は、ルールテーブル１１を一例として示す図である。図６を参照すると、ルールテーブル１１は、ネットワークアドレス（アドレスとネットマスク）、転送先のゲートウェイ、出力インタフェース、および、処理プロセッサ識別子とを関連付けて保持する。ここで、ネットワークアドレス、転送先のゲートウェイ、および、出力インタフェースの対応関係は、経路ルールの適用で用いられる。また、ネットワークアドレスと処理プロセッサ識別子との対応関係は、ディスパッチルールの適用で用いられる。ディスパッチルールは、送信パケットでは宛先アドレスに対するルール、受信パケットでは送信元アドレスに対するルールとして解釈される。 FIG. 6 is a diagram illustrating the rule table 11 as an example. Referring to FIG. 6, the rule table 11 holds a network address (address and netmask), a transfer destination gateway, an output interface, and a processing processor identifier in association with each other. Here, the correspondence relationship between the network address, the transfer destination gateway, and the output interface is used in the application of the route rule. Also, the correspondence between the network address and the processor identifier is used in the application of dispatch rules. The dispatch rule is interpreted as a rule for the destination address in the transmission packet and as a rule for the transmission source address in the reception packet.
　ルール設定部２１は、ルールテーブル１１に対して経路ルールおよびディスパッチルールの追加、変更、削除等のルールの設定を行う。ルール設定部２１は、例えば、ユーザアプリケーションとして動作し、ユーザとカーネル間でメッセージ通信を行うことで、経路ルールを設定する。 The rule setting unit 21 sets rules such as addition, change, and deletion of route rules and dispatch rules in the rule table 11. The rule setting unit 21 operates as a user application, for example, and sets a route rule by performing message communication between the user and the kernel.
　ルール抽出部３１は、パケットに格納されたアドレスとルールテーブル１１のネットワークアドレスとを照合し、マッチするルールを検索する。ルール抽出部３１は、最近検索した検索結果の一部を保持し、高速に検索可能な経路キャッシュ（非図示）を備えていてもよい。 The rule extraction unit 31 compares the address stored in the packet with the network address of the rule table 11 and searches for a matching rule. The rule extraction unit 31 may include a route cache (not shown) that holds a part of recently searched search results and can be searched at high speed.
　ルール適用部４１は、基本適用部４１１およびディスパッチ部４０２を有する。ルール適用部４１は、経路ルールと送受信パケットを受け取ると、基本適用部４１１は、第１の処理として経路ルールに従った処理を行う。具体的には、送信パケットに対しては、送信パケットが経路ルール中の出力先インタフェースからゲートウェイに対して送信されるように設定する。経路ルールから受信パケットが他ホスト宛のパケットであると判断された場合には、基本適用部４１１は、受信パケットの転送処理を行う。ディスパッチ部４０２の動作については、第１の実施形態と同様であるため、詳細な説明を省略する。 The rule application unit 41 includes a basic application unit 411 and a dispatch unit 402. When the rule application unit 41 receives the route rule and the transmission / reception packet, the basic application unit 411 performs processing according to the route rule as the first processing. Specifically, the transmission packet is set to be transmitted from the output destination interface in the route rule to the gateway. When it is determined from the routing rule that the received packet is a packet addressed to another host, the basic application unit 411 performs a transfer process of the received packet. Since the operation of the dispatch unit 402 is the same as that of the first embodiment, detailed description thereof is omitted.
　また、処理スレッド５０の動作についても、第１の実施形態と同様であるため、詳細な説明を省略する。 Also, the operation of the processing thread 50 is the same as that of the first embodiment, and thus detailed description thereof is omitted.
　送信受付部６１は、ユーザアプリケーションまたはカーネル内部からの送信パケットを受け取り、送信パケットの宛先アドレスに対応するルールをルール抽出部３１で検索し、検索結果として得られたルールと送信パケットをルール適用部４１に渡す。 The transmission reception unit 61 receives a transmission packet from the user application or the kernel, searches the rule extraction unit 31 for a rule corresponding to the destination address of the transmission packet, and determines the rule and the transmission packet obtained as a search result as a rule application unit Pass to 41.
　受信受付部７１は、ネットワークからの受信パケットを受け取り、ルール抽出部３１において、受信パケットの宛先アドレスから経路ルールを、送信元アドレスからディスパッチルールをそれぞれ検索し、前記検索した経路ルールとディスパッチルール、及び受信パケットをルール適用部４１に渡す。ルール抽出部３１が経路キャッシュを備えている場合には、ディスパッチルールの検索を、経路キャッシュを用いて行うようにしてもよい。 The reception accepting unit 71 receives a received packet from the network, and the rule extracting unit 31 searches the routing rule from the destination address of the received packet and the dispatch rule from the transmission source address. The received packet is passed to the rule application unit 41. When the rule extraction unit 31 includes a route cache, the search for the dispatch rule may be performed using the route cache.
　次に、本実施形態に係るパケット処理装置の動作について、図面を参照して説明する。図７は、本実施形態に係るパケット処理装置による送信処理を一例として示すフローチャートである。 Next, the operation of the packet processing apparatus according to the present embodiment will be described with reference to the drawings. FIG. 7 is a flowchart showing an example of transmission processing by the packet processing apparatus according to the present embodiment.
　図７を参照すると、アプリケーションまたはカーネル内部からパケットが到着すると、送信受付部６１に送信パケットが渡される。送信パケットを受け取った送信受付部６１は、ルール抽出部３１によって、送信パケットの宛先アドレスとマッチするルールをルールテーブル１１から検索する（ステップＳ１１）。ルール抽出部３１が経路キャッシュを備えている場合には、検索結果を経路キャッシュに保持することで以降の検索を高速化することができる。送信受付部６１は、ルールの検索結果を送信パケットとともにルール適用部４１に渡す。 Referring to FIG. 7, when a packet arrives from within the application or the kernel, the transmission packet is delivered to the transmission reception unit 61. Upon receiving the transmission packet, the transmission accepting unit 61 uses the rule extraction unit 31 to search the rule table 11 for a rule that matches the destination address of the transmission packet (step S11). When the rule extraction unit 31 includes a route cache, subsequent searches can be speeded up by holding the search results in the route cache. The transmission reception unit 61 passes the rule search result to the rule application unit 41 together with the transmission packet.
　次に、ルール適用部４１は、検索されたルールと送信パケットを受け取ると、基本適用部４１１が、該ルールに基づき、第１の処理として、送信パケットに対して出力インタフェースを設定する（ステップＳ１２）。対応する経路ルールがない場合には、基本適用部４１１は、送信パケットを破棄し、送信処理を完了する。 Next, when the rule application unit 41 receives the retrieved rule and the transmission packet, the basic application unit 411 sets an output interface for the transmission packet as a first process based on the rule (step S12). ). If there is no corresponding route rule, the basic application unit 411 discards the transmission packet and completes the transmission process.
　一方、ディスパッチ部４０２は、ルールの処理プロセッサ識別子に応じて処理プロセッサを選択する（ステップＳ１３のＹｅｓ、Ｓ１４）。また、ディスパッチルールで処理プロセッサ識別子が指定されていない場合には（ステップＳ１３のＮｏ）、ディスパッチ部４０２は、現在処理を実行中のプロセッサ（すなわち、ディスパッチ部４０２の処理を実行しているプロセッサ自身）を処理プロセッサとして選択する（ステップＳ１５）。 Meanwhile, the dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S13, S14). When the processing processor identifier is not specified in the dispatch rule (No in step S13), the dispatch unit 402 is the processor that is currently executing the processing (that is, the processor that is executing the processing of the dispatch unit 402 itself) ) Is selected as a processing processor (step S15).
　そして、ディスパッチ部４０２は、決定した処理プロセッサに対応する処理スレッド５０の処理キューに、送信パケットの上位プロトコルの送信処理をキューイングすることで処理を依頼する（ステップＳ１６）。依頼を受けた処理スレッド５０の送信処理部５０２は、パケットに対する第２の処理としてパケットの送信処理（パケットに対する下位レイヤの送信処理）を実行する。 Then, the dispatch unit 402 requests processing by queuing the transmission processing of the upper protocol of the transmission packet in the processing queue of the processing thread 50 corresponding to the determined processing processor (step S16). The transmission processing unit 502 of the processing thread 50 that has received the request executes a packet transmission process (a lower layer transmission process for the packet) as a second process for the packet.
　図８は、ルール抽出部３１が経路キャッシュを備えていない場合における、本実施形態に係るパケット処理装置による受信処理を一例として示すフローチャートである。ネットワークから受信パケットが到着すると、受信受付部７１はルール抽出部３１によって、受信パケットの宛先アドレスとマッチするルールをルールテーブル１１から検索する（ステップＳ２１）。 FIG. 8 is a flowchart illustrating an example of reception processing by the packet processing device according to the present embodiment when the rule extraction unit 31 does not include a route cache. When the received packet arrives from the network, the reception accepting unit 71 searches the rule table 11 for a rule that matches the destination address of the received packet by the rule extracting unit 31 (step S21).
　検索結果からパケット処理装置自身宛のパケットではないと判断された場合には（ステップＳ２２のＮｏ）、ルール適用部４１の基本適用部４１１は、受信パケットを転送して処理を終了する（ステップＳ２３）。一方、パケット処理装置自身宛のパケットと判断された場合には（ステップＳ２２のＹｅｓ）、受信受付部７１は、ルール抽出部３１を用いて、受信パケットの送信元アドレスに対応するディスパッチルールをルールテーブル１１から検索する（ステップＳ２４）。 If it is determined from the search result that the packet is not addressed to the packet processing device itself (No in step S22), the basic application unit 411 of the rule application unit 41 transfers the received packet and ends the process (step S23). ). On the other hand, when it is determined that the packet is addressed to the packet processing apparatus itself (Yes in step S22), the reception receiving unit 71 uses the rule extraction unit 31 to set a dispatch rule corresponding to the transmission source address of the received packet as a rule. Search from the table 11 (step S24).
　ディスパッチ部４０２は、ルールの処理プロセッサ識別子に応じて処理プロセッサを選択する（ステップＳ２５のＹｅｓ、Ｓ２６）。一方、ルールに処理プロセッサ識別子が指定されていない場合には（ステップＳ２５のＮｏ）、現在処理を実行中のプロセッサ（すなわち、ディスパッチ部４０２の処理を実行しているプロセッサ自身）を処理プロセッサとして選択する（ステップＳ２７）。 The dispatch unit 402 selects a processing processor according to the processing processor identifier of the rule (Yes in step S25, S26). On the other hand, when the processing processor identifier is not specified in the rule (No in step S25), the processor that is currently executing the processing (that is, the processor that is executing the processing of the dispatch unit 402) is selected as the processing processor. (Step S27).
　そして、ディスパッチ部４０２は、選択された処理プロセッサに対応する処理スレッド５０の処理キューに、受信パケットの上位プロトコルの受信処理をキューイングすることで処理を依頼する（ステップＳ２８）。依頼を受けた処理スレッド５０の受信処理部５０１は、パケットに対する第２の処理としてパケットの受信処理を実行する。 Then, the dispatch unit 402 requests processing by queuing the reception processing of the upper protocol of the received packet in the processing queue of the processing thread 50 corresponding to the selected processing processor (step S28). The reception processing unit 501 of the processing thread 50 that has received the request executes a packet reception process as a second process for the packet.
　図９は、ルール抽出部３１が経路キャッシュを備えている場合における、本実施形態に係るパケット処理装置による受信処理を一例として示すフローチャートである。図９において、ステップＳ２１からＳ２３およびステップＳ２５からＳ２８に関しては、ルール抽出部３１が経路キャッシュを備えていない場合（図８）と同様であるため、詳細な説明を省略する。図９は、図８のステップＳ２４の代わりに、ステップＳ２９およびステップＳ３０を含む点で、図８と相違する。 FIG. 9 is a flowchart illustrating an example of reception processing by the packet processing device according to the present embodiment when the rule extraction unit 31 includes a path cache. In FIG. 9, steps S21 to S23 and steps S25 to S28 are the same as when the rule extraction unit 31 does not include a path cache (FIG. 8), and thus detailed description thereof is omitted. FIG. 9 differs from FIG. 8 in that step S29 and step S30 are included instead of step S24 in FIG.
　ルール抽出部３１が経路キャッシュを備えている場合には、受信受付部７１は、経路キャッシュを利用して、ディスパッチルールを検索する（ステップＳ２９）。 When the rule extraction unit 31 includes a route cache, the reception receiving unit 71 searches for a dispatch rule using the route cache (step S29).
　経路キャッシュにマッチするルールが保持されていない場合には（ステップＳ３０のＮｏ）、プロセッサ識別子が指定されていないものとみなして、処理が行われる。このように、高速に検索を可能な経路キャッシュにルールが保持されている場合に（ステップＳ３０のＹｅｓ）、ディスパッチルールを利用する（ステップＳ２５～Ｓ２７）ことにより、検索に要する時間を削減することができる。 If no rule matching the path cache is held (No in step S30), it is assumed that no processor identifier is specified, and processing is performed. As described above, when a rule is held in a route cache that can be searched at high speed (Yes in step S30), the time required for the search can be reduced by using the dispatch rule (steps S25 to S27). Can do.
　経路キャッシュは、送信処理における経路検索で更新される（図７のステップＳ１１）。したがって、定期的に送信が行われているアドレスからの受信パケットであれば、経路キャッシュにマッチするルールが保持されるため（図９のステップＳ３０のＹｅｓ）、ディスパッチルールに基づくプロセッサの選択（図９のステップＳ２５～Ｓ２７）が可能となる。 The route cache is updated by route search in the transmission process (step S11 in FIG. 7). Therefore, if it is a received packet from an address that is periodically transmitted, a rule that matches the route cache is retained (Yes in step S30 in FIG. 9), and therefore the processor is selected based on the dispatch rule (FIG. 9). 9 steps S25 to S27) are possible.
　本実施形態では、図６に示すように、ルールテーブル１１に処理プロセッサを決定するディスパッチルールを設定する。第１の実施形態におけるフィルタリング処理は、パケット処理において常に必要とされるわけではない。一方、経路の検索処理は、パケットの処理に不可欠である。したがって、本実施形態に係るパケット処理装置は、フィルタリング処理を行わない場合のパケット転送にも適用することができ、ルールテーブル１１へのルールをユーザ側から設定することにより、柔軟なプロセッサ選択を行うことが可能である。また、本実施形態に係るパケット処理装置による送信処理では、送信パケットに対して出力インタフェースを設定する処理と、該送信パケットに対する第２の処理を行うプロセッサを選択する処理とを、１つの処理として実行するため、該送信パケットに対する処理時間を削減することができる。 In this embodiment, as shown in FIG. 6, a dispatch rule for determining a processing processor is set in the rule table 11. The filtering process in the first embodiment is not always required in packet processing. On the other hand, route search processing is indispensable for packet processing. Therefore, the packet processing apparatus according to the present embodiment can also be applied to packet forwarding when filtering processing is not performed, and performs flexible processor selection by setting rules in the rule table 11 from the user side. It is possible. In the transmission processing by the packet processing apparatus according to the present embodiment, the processing for setting the output interface for the transmission packet and the processing for selecting the processor that performs the second processing for the transmission packet are performed as one processing. As a result, the processing time for the transmission packet can be reduced.
　（実施形態３）
　第３の実施形態に係るパケット処理装置について、図面を参照して説明する。図１０は、本実施形態に係るパケット処理装置の構成を一例として示すブロック図である。図１０を参照すると、本実施形態に係るパケット処理装置は、ルールテーブル１２、ユーザアプリケーション２２、ルール抽出部３２、ルール適用部４２、処理スレッド５２、送信受付部６２、および、受信受付部７２を備えている。 (Embodiment 3)
A packet processing apparatus according to a third embodiment will be described with reference to the drawings. FIG. 10 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 10, the packet processing device according to the present embodiment includes a rule table 12, a user application 22, a rule extraction unit 32, a rule application unit 42, a processing thread 52, a transmission reception unit 62, and a reception reception unit 72. I have.
　ルールテーブル１２は、アドレスとポート番号とソケットの対応関係を保持する。ここで、ソケットは、ＴＣＰ、ＵＤＰ等に代表されるトランスポートレイヤの接続情報に関する制御データと、該制御データと関連付けられた処理プロセッサ識別子とを保持する。 The rule table 12 holds the correspondence between addresses, port numbers, and sockets. Here, the socket holds control data related to transport layer connection information represented by TCP, UDP, and the like, and a processor identifier associated with the control data.
　図１１は、本実施形態に係るパケット処理装置におけるルールテーブル１２を一例として示す図である。図１１を参照すると、ルールテーブル１２は、ソケットとして、プロトコル処理に必要な制御データ以外に、処理プロセッサ識別子を含む。 FIG. 11 is a diagram illustrating an example of the rule table 12 in the packet processing apparatus according to the present embodiment. Referring to FIG. 11, the rule table 12 includes a processing processor identifier as a socket, in addition to control data necessary for protocol processing.
　ユーザアプリケーション２２は、ソケットを特定するためのファイル記述子をもち、ファイル記述子を利用してシステムコール（例えば、ｓｅｔｓｏｃｋｏｐｔ）を利用し、ソケットの処理プロセッサ識別子を設定することができる。また、ユーザアプリケーション２２は、ファイル記述子を指定し、ｒｅａｄおよびｗｒｉｔｅシステムコールにより、特定のソケット（コネクション）を利用したデータの送受信を行うことができる。 The user application 22 has a file descriptor for specifying the socket, and can set a processing processor identifier of the socket by using a system call (for example, setsockopt) using the file descriptor. Further, the user application 22 can send and receive data using a specific socket (connection) by specifying a file descriptor and using read and write system calls.
　ルール抽出部３２は、パケットに格納されている送信元のアドレスとポート番号、および、送信先のアドレスとポート番号の４つ組から、トランスポートレイヤの制御情報を表すソケットを特定する。 The rule extraction unit 32 specifies a socket representing the control information of the transport layer from the quadruple of the transmission source address and port number and the transmission destination address and port number stored in the packet.
　ルール適用部４２は、基本適用部４２１およびディスパッチ部４２２を有する。ルール適用部４２は、送信受付部６２または受信受付部７２から送信パケットまたは受信パケットとソケットを受け取ると、基本適用部４２１は、第１の処理として、送信パケットまたは受信パケットがソケットに保持されるトランスポートレイヤの制御情報を利用して、送信または受信の設定を行う。また、ディスパッチ部４２２は、ソケットに保持されるプロセッサ識別子に応じてプロセッサを選択し、対応する処理スレッド５２に、第２の処理として、送信パケットまたは受信パケットの送信処理または受信処理を行うように依頼する。 The rule application unit 42 includes a basic application unit 421 and a dispatch unit 422. When the rule application unit 42 receives the transmission packet or the reception packet and the socket from the transmission reception unit 62 or the reception reception unit 72, the basic application unit 421 holds the transmission packet or the reception packet in the socket as the first processing. Use the transport layer control information to configure transmission or reception. In addition, the dispatch unit 422 selects a processor according to the processor identifier held in the socket, and performs the transmission process or the reception process of the transmission packet or the reception packet as the second process in the corresponding processing thread 52. Ask.
　処理スレッド５２は、第１の実施形態における処理スレッド５０と同様に、プロセッサ毎に用意されるカーネルスレッドである。ただし、本実施形態では、受信処理部５２１が受信パケットに対するレイヤ４の受信処理を行い、送信処理部５２２が送信パケットに対するレイヤ４以下の送信処理を行う点において、第１の実施形態と相違する。受信処理部５２１は、最終的に、受信パケットをユーザアプリケーション２２に届ける。 The processing thread 52 is a kernel thread prepared for each processor, like the processing thread 50 in the first embodiment. However, this embodiment is different from the first embodiment in that the reception processing unit 521 performs layer 4 reception processing on the received packet, and the transmission processing unit 522 performs layer 4 or lower transmission processing on the transmission packet. . The reception processing unit 521 finally delivers the received packet to the user application 22.
　送信受付部６２は、ユーザアプリケーション２２からファイル記述子と送信パケットを受け取る。送信受付部６２は、ファイル記述子と送信パケットを受け取ると、それが示すソケットを特定し、ルール適用部４２に渡す。 The transmission reception unit 62 receives a file descriptor and a transmission packet from the user application 22. When receiving the file descriptor and the transmission packet, the transmission reception unit 62 specifies the socket indicated by the file descriptor and passes it to the rule application unit 42.
　受信受付部７２は、ネットワークから受信パケットを受け取り、そのアドレスおよびポート番号でルールテーブル１２を検索する。また、受信受付部７２は、検索結果のソケットと受信パケットをルール適用部４２に渡す。 The reception receiving unit 72 receives a received packet from the network, and searches the rule table 12 by its address and port number. Also, the reception accepting unit 72 passes the search result socket and the received packet to the rule applying unit 42.
　次に、本実施形態に係るパケット処理装置による送受信処理について説明する。 Next, transmission / reception processing by the packet processing apparatus according to the present embodiment will be described.
　送信処理の動作は、次のとおりである。まず、ユーザアプリケーション２２はソケットを識別するためのファイル記述子と送信パケットを引数として、ｓｅｎｄシステムコールを呼び出す。ｓｅｎｄシステムコールにより、ファイル記述子と送信パケットを受け取ると、送信受付部６２は、ファイル記述子からソケットを特定する。次に、ルール適用部４２の基本適用部４２１は、第１の処理として、特定されたソケットに保持されるトランスポートレイヤの制御情報を用いて、送信パケットに対する送信の設定を行う。また、ディスパッチ部４２２は、ソケットに保持されるプロセッサ識別子から対応する処理スレッド５２を選択し、第２の処理として送信パケットの送信処理を依頼する。 The operation of the transmission process is as follows. First, the user application 22 calls a send system call using a file descriptor for identifying a socket and a transmission packet as arguments. When the file descriptor and the transmission packet are received by the send system call, the transmission reception unit 62 specifies the socket from the file descriptor. Next, as a first process, the basic application unit 421 of the rule application unit 42 sets transmission for the transmission packet using the control information of the transport layer held in the specified socket. Further, the dispatch unit 422 selects the corresponding processing thread 52 from the processor identifier held in the socket, and requests transmission processing of the transmission packet as the second processing.
　一方、受信処理の動作は、次のとおりである。ネットワークから受信パケットが到着すると、受信受付部７２は、受信パケットのアドレスおよびポート番号をもとに、ルールテーブル１２から対応するソケットを特定する。次に、ルール適用部４２の基本適用部４２１は、第１の処理として、特定されたソケットに保持されるトランスポートレイヤの制御情報を用いて、受信パケットの受信処理の設定を行う。また、ディスパッチ部４２２は、ソケットに保持されるプロセッサ識別子から対応する処理スレッド５２を選択し、第２の処理として受信パケットの受信処理を依頼する。 On the other hand, the operation of the reception process is as follows. When a received packet arrives from the network, the reception accepting unit 72 specifies a corresponding socket from the rule table 12 based on the address and port number of the received packet. Next, the basic application unit 421 of the rule application unit 42 sets the reception process of the received packet using the control information of the transport layer held in the specified socket as the first process. In addition, the dispatch unit 422 selects the corresponding processing thread 52 from the processor identifier held in the socket, and requests the reception processing of the reception packet as the second processing.
　本実施形態に係るパケット処理装置によると、ソケットが、トランスポートレイヤの接続情報に関する制御データと処理プロセッサとを関連付けて保持することにより、送信又は受信パケットに対する送信又は受信の設定と、該送信又は受信パケットに対する第２の処理を行うプロセッサの選択とを、１つの処理として実行するため、該送信又は受信パケットに対する処理時間を削減することができる。また、ｓｅｔｓｏｃｋｏｐｔ等の既存のシステムコールを利用することにより、ユーザアプリケーション２２が容易に第２の処理を行うプロセッサの設定を行うことができ、柔軟なプロセッサ選択を行うことが可能である。 According to the packet processing device according to the present embodiment, the socket holds the control data related to the transport layer connection information and the processing processor in association with each other, thereby setting the transmission or reception for the transmission or reception packet, and the transmission or reception. Since the selection of the processor that performs the second process on the received packet is executed as one process, the processing time for the transmitted or received packet can be reduced. Further, by using an existing system call such as setsockopt, the user application 22 can easily set a processor for performing the second process, and flexible processor selection can be performed.
　（実施形態４）
　本発明の第４の実施形態に係るパケット処理装置について、図面を参照して説明する。図１２は、本実施形態に係るパケット処理装置の構成を一例として示すブロック図である。図１２を参照すると、本実形態に係るパケット処理装置は、ルールテーブル１３、ルール抽出部３３、ルール適用部４０、処理スレッド５０、送信受付部６０、および、受信受付部７０を備えている。図１２に示した本実施形態の構成要素のうち、図２と同一の符号を付したものの動作は、第１の実施形態における構成要素の動作と同一であることから、説明を省略する。 (Embodiment 4)
A packet processing apparatus according to a fourth embodiment of the present invention will be described with reference to the drawings. FIG. 12 is a block diagram illustrating an example of the configuration of the packet processing apparatus according to the present embodiment. Referring to FIG. 12, the packet processing apparatus according to this embodiment includes a rule table 13, a rule extraction unit 33, a rule application unit 40, a processing thread 50, a transmission reception unit 60, and a reception reception unit 70. Among the components of the present embodiment shown in FIG. 12, the operations of those denoted by the same reference numerals as those in FIG. 2 are the same as the operations of the components in the first embodiment, and thus the description thereof is omitted.
　ルールテーブル１３は、パケット処理装置の外部に設けられたルール設定装置２３により、ルールが設定される。ルールテーブル１３およびルール設定装置２３に対して、一例として、非特許文献１に記載されているオープンフロー（ＯｐｅｎＦｌｏｗ）技術を採用することができる。 Rules are set in the rule table 13 by a rule setting device 23 provided outside the packet processing device. As an example, the open flow (OpenFlow) technique described in Non-Patent Document 1 can be adopted for the rule table 13 and the rule setting device 23.
　オープンフローは、通信をエンドツーエンドのフローとして捉え、フロー単位で経路制御、障害回復、負荷分散、最適化を行うものである。転送ノードとして機能するオープンフロースイッチ（ＯＦＳ：ＯｐｅｎＦｌｏｗ　Ｓｗｉｔｃｈ）は、制御サーバに位置付けられるオープンフローコントローラ（ＯＦＣ：ＯｐｅｎＦｌｏｗ　Ｃｏｎｔｒｏｌｌｅｒ）との通信用のセキュアチャネルを備え、オープンフローコントローラから適宜追加または書き換え指示されるフローテーブルに従って動作する。 Open flow is an end-to-end flow of communication, and performs path control, failure recovery, load balancing, and optimization on a flow basis. The OpenFlow Switch (OFS: OpenFlow Switch) that functions as a forwarding node has a secure channel for communication with the OpenFlow Controller (OFC: OpenFlow Controller) that is positioned in the control server, and is instructed to add or rewrite as appropriate from the OpenFlow Controller. It operates according to the flow table.
　本実施形態におけるパケット処理装置、ルール設定装置２３、ルールテーブル１３、および、ルールテーブル１３に格納されたルールは、それぞれ、オープンフローにおけるオープンフロースイッチ、オープンフローコントローラ、フローテーブル、および、フローテーブルのエントリに相当する。 The packet processing device, the rule setting device 23, the rule table 13, and the rule stored in the rule table 13 in the present embodiment are the OpenFlow switch, OpenFlow controller, Flow table, and Flow table in OpenFlow, respectively. Corresponds to an entry.
　図１３は、オープンフローのフローテーブルのエントリを一例として示す図である。図１３を参照すると、フローテーブルには、フロー毎に、パケットヘッダと照合する照合条件と、処理内容を定義したアクション（ａｃｔｉｏｎｓ）と、フロー統計情報（ｓｔａｔｓ）との組が定義される。 FIG. 13 is a diagram illustrating an example of an OpenFlow flow table entry. Referring to FIG. 13, for each flow, a set of a collation condition to collate with a packet header, an action (actions) that defines processing contents, and flow statistical information (stats) is defined for each flow.
　図１４は、非特許文献２に定義されているアクション名とアクションの内容を一例として示す表である。ＯＵＴＰＵＴは、指定ポート（インタフェース）に出力するアクションである。ＳＥＴ＿ＶＬＡＮ＿ＶＩＤからＳＥＴ＿ＴＰ＿ＤＳＴは、パケットヘッダのフィールドを修正するアクションである。 FIG. 14 is a table showing an example of action names and action contents defined in Non-Patent Document 2. OUTPUT is an action to be output to a designated port (interface). SET_VLAN_VID to SET_TP_DST are actions for modifying the field of the packet header.
　オープンフロースイッチは、パケットを受信すると、フローテーブル（図１３）から、受信パケットのヘッダ情報に適合する照合条件（ＦｌｏｗＫｅｙ）を持つエントリを検索する。検索の結果、受信パケットに適合するエントリが見つかった場合、オープンフロースイッチは、受信パケットに対して、当該エントリのアクションフィールドに記述された処理内容を実施する。一方、検索の結果、受信パケットに適合するエントリが見つからなかった場合、オープンフロースイッチは、セキュアチャネルを介して、オープンフローコントローラに対して受信パケットを転送し、受信パケットの送信元・送信先に基づいたパケットの経路の決定を依頼し、これを実現するフローエントリを受け取ってフローテーブルを更新する。このように、オープンフロースイッチは、フローテーブルに格納されたエントリを処理規則として用いてパケットを転送する。 When the OpenFlow switch receives the packet, it searches the flow table (FIG. 13) for an entry having a matching condition (FlowKey) that matches the header information of the received packet. When an entry that matches the received packet is found as a result of the search, the OpenFlow switch performs the processing content described in the action field of the entry on the received packet. On the other hand, if no entry matching the received packet is found as a result of the search, the OpenFlow switch forwards the received packet to the OpenFlow controller via the secure channel, and sends it to the source / destination of the received packet. Requests the determination of the route of the packet based on it, receives a flow entry that realizes this, and updates the flow table. In this way, the OpenFlow switch transfers a packet using the entry stored in the flow table as a processing rule.
　本実施形態のルールテーブル１３（図１２）は、図１３に示すように、照合条件フィールドおよびアクション（ａｃｔｉｏｎｓ）フィールドを有する。また、照合条件フィールドには、第１の実施形態におけるルールテーブル１０（図３）と同様に、照合条件が格納される。さらに、アクションフィールドには、第１の実施形態におけるルールテーブル１０（図３）と同様に、アクションおよび処理プロセッサ識別子が格納される。 The rule table 13 (FIG. 12) of the present embodiment has a matching condition field and an action field as shown in FIG. In the collation condition field, collation conditions are stored as in the rule table 10 (FIG. 3) in the first embodiment. Further, the action field stores an action and a processor identifier as in the rule table 10 (FIG. 3) in the first embodiment.
　ルール抽出部３３は、ルールテーブル１３を参照し、処理対象のパケットに適合するルールがルールテーブル１３に存在しない場合には、オープンフローコントローラに相当するルール設定装置２３に問い合わせる。ルール設定装置２３は、ルール抽出部１３から問い合わせを受けると、アクションと処理プロセッサ識別子と関連付けたルールをルールテーブル１０のルールとして設定する。 The rule extraction unit 33 refers to the rule table 13 and inquires the rule setting device 23 corresponding to the OpenFlow controller when there is no rule in the rule table 13 that matches the processing target packet. When receiving an inquiry from the rule extraction unit 13, the rule setting device 23 sets a rule associated with an action and a processor identifier as a rule in the rule table 10.
　本実施形態のように、複数のプロセッサを備えたパケット処理装置をオープンフローのオープンフロースイッチとして利用することで、各オープンフロースイッチは複数のプロセッサの中からパケットの処理を実行するプロセッサを柔軟かつ高速に選択することができる。 As in this embodiment, by using a packet processing device having a plurality of processors as an OpenFlow OpenFlow switch, each OpenFlow switch can flexibly and flexibly select a processor that executes packet processing from among a plurality of processors. Can be selected at high speed.
　本発明の全開示（請求の範囲を含む）の枠内において、さらにその基本的技術思想に基づいて、実施形態の変更・調整が可能である。また、本発明の請求の範囲の枠内において種々の開示要素（各請求項の各要素、各実施形態の各要素、各図面の各要素等を含む）の多様な組み合わせないし選択が可能である。すなわち、本発明は、請求の範囲を含む全開示、技術的思想にしたがって当業者であればなし得るであろう各種変形、修正を含むことは勿論である。 In the frame of the entire disclosure (including claims) of the present invention, the embodiment can be changed and adjusted based on the basic technical concept. Various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. . That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.
１０～１３，１１０　　ルールテーブル
２０、２１　　ルール設定部
２２　　ユーザアプリケーション
２３　　ルール設定装置
３０～３３，１３０　　ルール抽出部
４０，４１，４２，１４０　　ルール適用部
４０１，４１１，４２１　　基本適用部
４０２，４２２　　ディスパッチ部
５０，５２　　処理スレッド
５０１，５２１　　受信処理部
５０２，５２２　　送信処理部
６０～６２　　送信受付部
７０～７２　　受信受付部 10 to 13, 110 Rule table 20, 21 Rule setting unit 22 User application 23 Rule setting device 30 to 33, 130 Rule extraction unit 40, 41, 42, 140 Rule application unit 401, 411, 421 Basic application unit 402, 422 Dispatch Units 50 and 52 Processing threads 501 and 521 Reception processing units 502 and 522 Transmission processing units 60 to 62 Transmission reception units 70 to 72 Reception reception units

Claims (20)

  1. 　パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルと、
    　処理すべきパケットである対象パケットに格納された情報に対応するルールを、前記ルールテーブルから抽出するルール抽出部と、
    　抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行うルール適用部と、を備えていることを特徴とするパケット処理装置。     A rule table that holds information stored in a packet, a processing rule that indicates a first process for the packet, and a rule that associates a processor identifier that identifies a processor that performs the second process for the packet;
    A rule extraction unit that extracts a rule corresponding to information stored in a target packet, which is a packet to be processed, from the rule table;
    A rule applying unit configured to execute the first process in accordance with the processing rule for the target packet based on the extracted rule and to request the second process to the processor corresponding to the processor identifier; A packet processing apparatus comprising:
  2. 　前記第１の処理は、前記対象パケットを破棄すべきか否かを判定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であることを特徴とする、請求項１に記載のパケット処理装置。     The first process is a process for determining whether or not to discard the target packet;
    The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The packet processing device according to claim 1, wherein in some cases, the processing is a lower layer process for the target packet.
  3. 　前記ルール適用部は、前記第１の処理において前記対象パケットが破棄すべきパケットでない場合には、前記対象パケットに対する前記第２の処理を前記プロセッサに依頼することを特徴とする、請求項２に記載のパケット処理装置。 The rule applying unit requests the processor to perform the second process on the target packet when the target packet is not a packet to be discarded in the first process. The packet processing apparatus as described.
  4. 　前記ルールテーブルは、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子、および、該パケットを含むフローを定義するフィールドを示すフロー定義フィールドを互いに関連付けるルールを保持し、
    　前記ルール適用部は、抽出されたルールに複数のプロセッサ識別子が含まれる場合には、前記フロー定義フィールドを参照し、該複数のプロセッサ識別子に相当する複数のプロセッサのうちのいずれかのプロセッサに対して、同一のフローに含まれるすべての対象パケットに対する前記第２の処理を依頼することを特徴とする、請求項２または３に記載のパケット処理装置。     The rule table defines information stored in a packet, a processing rule indicating a first process for the packet, a processor identifier for identifying a processor that performs a second process for the packet, and a flow including the packet Holds rules that associate flow definition fields that represent fields with each other,
    When a plurality of processor identifiers are included in the extracted rule, the rule application unit refers to the flow definition field, and selects one of a plurality of processors corresponding to the plurality of processor identifiers. The packet processing apparatus according to claim 2, wherein the second processing is requested for all target packets included in the same flow.
  5. 　前記ルール抽出部は、前記ルールテーブルが前記対象パケットに格納された情報に対応するルールを保持していない場合には、前記ルールを設定可能なルール設定装置に該情報に適合するルールを設定するように依頼することを特徴とする、請求項２ないし４のいずれか１項に記載のパケット処理装置。 When the rule table does not hold a rule corresponding to the information stored in the target packet, the rule extraction unit sets a rule that matches the information in a rule setting device capable of setting the rule. The packet processing device according to claim 2, wherein the packet processing device is requested as follows.
  6. 　前記第１の処理は、前記対象パケットの宛先を判定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であることを特徴とする、請求項１に記載のパケット処理装置。     The first process is a process of determining a destination of the target packet;
    The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The packet processing device according to claim 1, wherein in some cases, the processing is a lower layer process for the target packet.
  7. 　前記ルール適用部は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合において、前記対象パケットの宛先が前記パケット処理装置である場合には、前記対象パケットに対する前記第２の処理を前記プロセッサに依頼することを特徴とする、請求項６に記載のパケット処理装置。 When the target packet is a packet to be received by the packet processing device and the destination of the target packet is the packet processing device, the rule application unit performs the second processing on the target packet. The packet processing apparatus according to claim 6, wherein the packet processing apparatus requests the processor.
  8. 　前記ルール抽出部は、抽出したルールを一時的に保持するキャッシュを有し、前記対象パケットに格納された情報に適合するルールを該キャッシュから抽出し、
    　前記ルール適用部は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合において、前記対象パケットに適合するルールが前記ルール抽出部により前記キャッシュから抽出されたときには、前記対象パケットに対する前記第２の処理を前記プロセッサに依頼することを特徴とする、請求項６または７に記載のパケット処理装置。     The rule extraction unit has a cache that temporarily holds the extracted rules, and extracts rules that match the information stored in the target packet from the cache,
    The rule application unit, when the target packet is a packet to be received by the packet processing device, and when a rule that matches the target packet is extracted from the cache by the rule extraction unit, the rule application unit The packet processing device according to claim 6, wherein the packet processing device requests the processor to perform a second process.
  9. 　前記第１の処理は、前記対象パケットを送受信する際のトランスポートレイヤにおける制御情報を特定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４の受信処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４以下の送信処理であることを特徴とする、請求項１に記載のパケット処理装置。     The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
    When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. The packet processing device according to claim 1, wherein when the packet is to be transmitted by the packet processing device, the packet processing device is a layer 4 or lower transmission processing for the target packet using the specified control information. .
  10. 　前記ルールテーブルは、優先度に応じてソートされた複数のルールを保持し、
    　前記ルール抽出部は、前記対象パケットに格納された情報に適合する複数のルールが前記ルールテーブルに格納されている場合には、該複数のルールのうちの優先度が高いものを抽出することを特徴とする、請求項１に記載のパケット処理装置。     The rule table holds a plurality of rules sorted according to priority,
    The rule extraction unit, when a plurality of rules that match the information stored in the target packet is stored in the rule table, to extract a rule having a high priority among the plurality of rules. The packet processing device according to claim 1, wherein the packet processing device is characterized by:
  11. 　前記ルールテーブルのルールは、パケットに格納された情報として、送信元アドレス、宛先アドレス、送信元ポート番号、および、宛先ポート番号のうちの少なくともいずれかを含んでいることを特徴とする、請求項１に記載のパケット処理装置。 The rule of the rule table includes at least one of a source address, a destination address, a source port number, and a destination port number as information stored in a packet. 2. The packet processing device according to 1.
  12. 　前記ルールテーブルに対して、ルールの追加、変更、または、削除を行うルール設定部をさらに備えていることを特徴とする、請求項１に記載のパケット処理装置。 The packet processing device according to claim 1, further comprising a rule setting unit for adding, changing, or deleting a rule with respect to the rule table.
  13. 　複数のプロセッサのうちの一のプロセッサが、パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルから、処理すべきパケットである対象パケットに格納された情報に対応するルールを抽出する工程と、
    　前記一のプロセッサが、抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行う工程と、を含むことを特徴とするパケット処理方法。     One of the plurality of processors associates the information stored in the packet, the processing rule indicating the first process for the packet, and the processor identifier that identifies the processor performing the second process for the packet Extracting a rule corresponding to information stored in a target packet, which is a packet to be processed, from a rule table holding rules;
    Based on the extracted rule, the one processor executes the first process according to the processing rule for the target packet, and requests the second process to the processor corresponding to the processor identifier. A packet processing method comprising the steps of:
  14. 　前記第１の処理は、前記対象パケットを破棄すべきか否かを判定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であることを特徴とする、請求項１３に記載のパケット処理方法。     The first process is a process for determining whether or not to discard the target packet;
    The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. 14. The packet processing method according to claim 13, wherein the packet processing is a lower layer process for the target packet in some cases.
  15. 　前記第１の処理は、前記対象パケットの宛先を判定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であることを特徴とする、請求項１３に記載のパケット処理方法。     The first process is a process of determining a destination of the target packet;
    The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. 14. The packet processing method according to claim 13, wherein the packet processing is a lower layer process for the target packet in some cases.
  16. 　前記第１の処理は、前記対象パケットを送受信する際のトランスポートレイヤにおける制御情報を特定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４の受信処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４以下の送信処理であることを特徴とする、請求項１３に記載のパケット処理方法。     The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
    When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. 14. The packet processing method according to claim 13, wherein when the packet is to be transmitted by the packet processing device, the packet processing method is a layer 4 or lower transmission process for the target packet using the specified control information. .
  17. 　パケットに格納された情報、該パケットに対する第１の処理を示す処理規則、および、該パケットに対する第２の処理を行うプロセッサを識別するプロセッサ識別子を互いに関連付けるルールを保持するルールテーブルから、処理すべきパケットである対象パケットに格納された情報に対応するルールを抽出する処理と、
    　抽出されたルールに基づいて、前記対象パケットに対する前記処理規則に従った前記第１の処理の実行と、前記プロセッサ識別子に相当するプロセッサに対する前記第２の処理の依頼とを行う処理と、を複数のプロセッサのうちの一のプロセッサに実行させることを特徴とするプログラム。     Processing should be performed from a rule table that holds information stored in a packet, a processing rule indicating a first process for the packet, and a rule that associates a processor identifier that identifies a processor that performs the second process for the packet. A process for extracting a rule corresponding to information stored in a target packet that is a packet;
    A plurality of processes for executing the first process according to the processing rule for the target packet and performing a request for the second process to the processor corresponding to the processor identifier based on the extracted rule One of the processors is executed by a program.
  18. 　前記第１の処理は、前記対象パケットを破棄すべきか否かを判定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であることを特徴とする、請求項１７に記載のプログラム。     The first process is a process for determining whether or not to discard the target packet;
    The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The program according to claim 17, wherein in some cases, the processing is a lower layer process for the target packet.
  19. 　前記第１の処理は、前記対象パケットの宛先を判定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には前記対象パケットに対する上位レイヤの処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には前記対象パケットに対する下位レイヤの処理であることを特徴とする、請求項１７に記載のプログラム。     The first process is a process of determining a destination of the target packet;
    The second process is an upper layer process for the target packet when the target packet is a packet to be received by the packet processing device, and the target packet is a packet to be transmitted by the packet processing device. The program according to claim 17, wherein in some cases, the processing is a lower layer process for the target packet.
  20. 　前記第１の処理は、前記対象パケットを送受信する際のトランスポートレイヤにおける制御情報を特定する処理であり、
    　前記第２の処理は、前記対象パケットが前記パケット処理装置で受信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４の受信処理であり、前記対象パケットが前記パケット処理装置で送信すべきパケットである場合には、特定された制御情報を用いた前記対象パケットに対するレイヤ４以下の送信処理であることを特徴とする、請求項１７に記載のプログラム。     The first process is a process of specifying control information in a transport layer when transmitting / receiving the target packet;
    When the target packet is a packet to be received by the packet processing device, the second process is a layer 4 reception process for the target packet using the specified control information. 18. The program according to claim 17, wherein if the packet is to be transmitted by the packet processing device, the program is a transmission process of layer 4 or lower for the target packet using the specified control information.
PCT/JP2012/052465 2011-02-04 2012-02-03 Packet processing device, packet processing method and program WO2012105677A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
JP2012555968A JP5900352B2 (en) 2011-02-04 2012-02-03 Packet processing apparatus, packet processing method and program

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2011022303 2011-02-04
JP2011-022303 2011-02-04

Publications (1)

Publication Number Publication Date
WO2012105677A1 true WO2012105677A1 (en) 2012-08-09

Family

ID=46602877

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2012/052465 WO2012105677A1 (en) 2011-02-04 2012-02-03 Packet processing device, packet processing method and program

Country Status (2)

Country Link
JP (1) JP5900352B2 (en)
WO (1) WO2012105677A1 (en)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014042141A1 (en) * 2012-09-11 2014-03-20 日本電気株式会社 Controller, communication system, communication method and program
WO2015133448A1 (en) * 2014-03-04 2015-09-11 日本電気株式会社 Packet processing device, packet processing method, and program
JP5917678B1 (en) * 2014-12-26 2016-05-18 株式会社Pfu Information processing apparatus, method, and program
JP2017509055A (en) * 2014-01-29 2017-03-30 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． Method and apparatus for processing data packets based on parallel protocol stack instances
WO2017110619A1 (en) * 2015-12-21 2017-06-29 Kddi株式会社 Device for controlling packet transfer device that has multi-core cpu, and computer-readable storage medium
JP2018516001A (en) * 2015-05-11 2018-06-14 日本電気株式会社 Communication apparatus, system, method, and program
US11194734B2 (en) 2016-06-08 2021-12-07 Nec Corporation Packet processing device, packet processing method, and recording medium

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002164928A (en) * 2000-10-11 2002-06-07 Lucent Technol Inc Communication method, communication system, and communication unit
JP2006174374A (en) * 2004-12-20 2006-06-29 Fujitsu Ltd Relay system
JP2007166513A (en) * 2005-12-16 2007-06-28 Nippon Telegr & Teleph Corp <Ntt> Device and method for processing communication

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4827499A (en) * 1987-06-12 1989-05-02 American Telephone And Telegraph Company At&T Bell Laboratories Call control of a distributed processing communications switching system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002164928A (en) * 2000-10-11 2002-06-07 Lucent Technol Inc Communication method, communication system, and communication unit
JP2006174374A (en) * 2004-12-20 2006-06-29 Fujitsu Ltd Relay system
JP2007166513A (en) * 2005-12-16 2007-06-28 Nippon Telegr & Teleph Corp <Ntt> Device and method for processing communication

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPWO2014042141A1 (en) * 2012-09-11 2016-08-18 日本電気株式会社 Control device, communication system, communication method, and program
WO2014042141A1 (en) * 2012-09-11 2014-03-20 日本電気株式会社 Controller, communication system, communication method and program
US10069947B2 (en) 2014-01-29 2018-09-04 Huawei Technologies Co., Ltd. Method and apparatus for processing data packet based on parallel protocol stack instances
JP2017509055A (en) * 2014-01-29 2017-03-30 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． Method and apparatus for processing data packets based on parallel protocol stack instances
JPWO2015133448A1 (en) * 2014-03-04 2017-04-06 日本電気株式会社 Packet processing apparatus, packet processing method and program
WO2015133448A1 (en) * 2014-03-04 2015-09-11 日本電気株式会社 Packet processing device, packet processing method, and program
US10284478B2 (en) 2014-03-04 2019-05-07 Nec Corporation Packet processing device, packet processing method and program
JP5917678B1 (en) * 2014-12-26 2016-05-18 株式会社Pfu Information processing apparatus, method, and program
JP2018516001A (en) * 2015-05-11 2018-06-14 日本電気株式会社 Communication apparatus, system, method, and program
US10649847B2 (en) 2015-05-11 2020-05-12 Nec Corporation Communication apparatus, system, method, and non-transitory medium
WO2017110619A1 (en) * 2015-12-21 2017-06-29 Kddi株式会社 Device for controlling packet transfer device that has multi-core cpu, and computer-readable storage medium
JP2017117009A (en) * 2015-12-21 2017-06-29 Kddi株式会社 Control device of packet transfer device having multicore cpu, and program
US11194734B2 (en) 2016-06-08 2021-12-07 Nec Corporation Packet processing device, packet processing method, and recording medium

Also Published As

Publication number Publication date
JP5900352B2 (en) 2016-04-06
JPWO2012105677A1 (en) 2014-07-03

Similar Documents

Publication Publication Date Title
JP5900352B2 (en) Packet processing apparatus, packet processing method and program
JP6592595B2 (en) Method and system for managing data traffic in a computing network
KR101703088B1 (en) Aggregated routing method based on sdn and system thereof
RU2589340C2 (en) Network system and method of acquiring vlan tag data
US8863269B2 (en) Frontend system and frontend processing method
US20160182385A1 (en) Shortening of service paths in service chains in a communications network
WO2011118566A1 (en) Packet transfer system, control apparatus, transfer apparatus, method of creating processing rules, and program
JP5800019B2 (en) Communication path control system, path control device, communication path control method, and path control program
WO2014112616A1 (en) Control apparatus, communication apparatus, communication system, switch control method and program
US10069648B2 (en) Communication system, control apparatus, communication control method and program
JP5858141B2 (en) Control device, communication device, communication system, communication method, and program
US9515926B2 (en) Communication system, upper layer switch, control apparatus, switch control method, and program
JP5725236B2 (en) Communication system, node, packet transfer method and program
JP2015533045A (en) Communication system, communication method, information processing apparatus, communication control method, and program
KR101812856B1 (en) Switch device, vlan configuration and management method, and program
WO2015075862A1 (en) Network control device, network control method, and program
US20150381775A1 (en) Communication system, communication method, control apparatus, control apparatus control method, and program
JP6292128B2 (en) COMMUNICATION SYSTEM, NODE, CONTROL DEVICE, COMMUNICATION METHOD, AND PROGRAM
KR101707073B1 (en) Error detection network system based on sdn
JP5854488B2 (en) Communication system, control device, processing rule setting method and program
JP5359357B2 (en) Packet processing apparatus, packet processing order control method and packet processing order control program used in the processing apparatus
WO2014142081A1 (en) Transfer node, control device, communication system, packet processing method and program
WO2015118811A1 (en) Communication system, packet-forwarding device, packet-forwarding method, and packet-forwarding program
Iida et al. Network Infrastructure Technology Supporting Parallelization and Multiplexing of Services

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12742523

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2012555968

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12742523

Country of ref document: EP

Kind code of ref document: A1