JP6453154B2 - Network management system and network management method - Google Patents

Description

  The present invention relates to a network management system and a network management method.

  The present invention uses an integrated management system that manages service nodes and networks, and authentication in two steps between three parties of the management domain adjacent to the integrated management system in the management system, so that the integrated management system has a plurality of management systems. This technology relates to a technology that reliably manages a network that spans the network and realizes highly reliable and flexible network management.

  Currently, SDN (Software Defined Networking) and NFV (Network Function Virtualization) are being studied as virtualization technologies for NW and NW appliances.

  SDN is being standardized by ONF (Open Networking Foundation) (see Non-Patent Document 1, for example). The user can make settings such as opening, changing, and deleting paths at the end-end from the SDN controller that manages the SDN network devices arranged at each site, and automates SO (Service Order) and shortens the construction time. There is a merit such as.

  Further, the network device is divided into virtual networks assigned to users by the virtualization technology, and there is an advantage that an operation independent of the physical configuration becomes possible. NFV is being standardized by ETSI ISG NFV (for example, see Non-Patent Document 2), and standardization for automatic provisioning of network services virtualized by server virtualization technology is being studied.

Open network foundation https: // www. openworking. org / ETSI ISG NFV http: // www. etsi. org / technologies-clusters / technologies / nfv

  FIG. 1 is a configuration diagram showing related technology. The user 11 requests the integrated management system 12 to generate a virtualization service across the domain 17. Upon receiving the request, the integrated management system 12 uses the path calculation unit 13 from the data of the configuration management unit 19 that manages the information of the domain 17 to connect which domain 17 with what policy, and the policy generated by the user 11・ Calculate whether service requirements can be met. The integrated management system 12 requests the management system 14 that manages the corresponding domain 17 obtained as a result of the calculation to generate a virtualization service that connects the domains. The management system 14 that has received the request creates a service node 16 in the domain, and creates a virtual NW (network) 15 for connecting the domains. As a result, communication between the service nodes 16 can be performed on a virtualized service across domains. In this case, the domains 17 are premised on being connected by IP (Internet Protocol), and it is necessary to set the nodes 18 that connect the domains 17 in advance.

  FIG. 14 shows setting items generally required in the node 18 that connects the domains. Setting of interface connecting between nodes, setting of inter-domain connection information exchange for exchanging connection information between domains such as BGP (Border Gateway Protocol), and between adjacent nodes for communication between nodes connecting between domains Connection settings. Among these, the setting of the exchange of connection information between domains and the connection setting between adjacent nodes change every time the network resources are paid out, and if they are fixedly set in the adjacent nodes, the efficiency of the network resources Cannot be used effectively. In addition, since the domain connection information exchange setting is a setting for exchanging route information between domains, there is a problem that the end-to-end route is not always optimal across domains. Have.

  If the integrated management system 12 has all the configuration management units 19 in the management domain, the amount of data managed by the integrated management system 12 becomes enormous and flexible operation becomes difficult. Further, the enlargement / complication of the integrated management system 12 makes it difficult to operate, and the manager needs advanced skills and know-how.

  The above problem is that the monitoring system 14 has the configuration management unit 19, creates an interface for exchanging information between the management systems 14, and exchanges information with each other, thereby placing a burden on the integrated management system 12. However, considering the provision of services by connecting management systems between multiple operators, sharing configuration management information between operators is not practical in terms of confidentiality of information assets. .

  In order to solve the above problems, the present invention provides a communication system in which an integrated management system exchanges network-to-network connection information between management systems through reliable communication, and enables reliable and safe communication. It aims to provide a method.

  In order to achieve the above object, the present invention uses authentication in two steps between three parties: an integrated management system that manages service nodes and networks, an integrated management system in the management system, and an adjacent management domain. Perform network management.

Specifically, the network management system according to the present invention is:
A plurality of management systems respectively arranged in each domain for managing a network between service nodes; an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
The plurality of management systems and the integrated management system selectively form connection paths according to shared network-to-network connection information.

In the network management system according to the present invention,
The integrated management system includes:
Based on the policy requirement and service requirement sent by the user terminal, the network / network connection information created by the integrated management system and the created encryption key and decryption key for encrypting and decrypting the network / network connection information Add and send to each management system,
The management system includes:
The network / network connection information sent by the integrated management system is received, the network / network connection information that needs to be set between domains is encrypted with an encryption key, and different management is performed via the integrated management system or adjacent nodes. A connection route may be selectively formed according to the network-to-network connection information sent to each management system that manages the domain and added to the network-to-network connection information.

In the network management system according to the present invention,
The integrated management system includes:
When the network / network connection information generated by the integrated management system and the network / network connection information generated by the management system are exchanged with the management system,
One-step authentication is performed between one management system of the plurality of management systems and the integrated management system, and 2 is performed between the one management system and the other management system connected adjacent to the one management system. Step verification may be performed.

In the management network system according to the present invention,
The integrated management system includes:
A route calculator that calculates a route that satisfies the policy requirements and service requirements generated by the user terminal;
A connection request notification unit for notifying a management system of a connection request for connecting between management domains obtained by the calculation result of the route calculation unit;
A domain information management unit that manages connection information between domains;
An authentication key generation unit that generates an encryption key and a decryption key and distributes them to each management system;
An integrated management system processing unit that performs transmission and reception with the management system;
The management system includes:
A management system processing unit that performs transmission and reception with the integrated management system transmission and reception unit;
A configuration management unit that manages configuration management information for each network in the domain;
An information transmission unit that receives the notification of the connection request, reserves a resource in a domain that is a connection destination according to the service requirement, and transmits resource reservation information and a public key to the integrated management system processing unit;
An intra-domain node setting unit for setting information of nodes in the management domain based on the network-to-network connection information acquired from the integrated management unit;
A key authentication unit that performs key exchange with the connection destination management system described in advance in the network-network connection information, and performs key authentication of the mutual network-network connection information;
An adjacent node setting unit for setting information of adjacent nodes of the management domain based on the network-to-network connection information;
After the information setting performed by the adjacent node setting unit, a setting notification unit that stores the information in the configuration management unit and notifies the integrated management system processing unit,
The configuration management unit may store the network-network connection information.

In the management network system according to the present invention,
The management system includes:
In the case of network connection between domains, the network layer reachability information is used by using the network layer reachability information (NLRI) information of BGP (Border Gateway Protocol) as the network-to-network connection information. It may be shared between management systems.

Specifically, the network management method according to the present invention includes:
A plurality of management systems respectively arranged in each domain for managing a network between service nodes; an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
The plurality of management systems and the integrated management system selectively form connection paths according to the shared network-to-network connection information.

In the network management method according to the present invention,
The integrated management system includes:
Based on the policy requirements and service requirements sent by the user terminal, the integrated management system adds an encryption key and a decryption key for encrypting and decrypting the network / network connection information and the network / network connection information. Send it to each management system as network connection information,
The management system includes:
The network / network connection information sent by the integrated management system is received, the network / network connection information that needs to be set between domains is encrypted with an encryption key, and different management is performed via the integrated management system or adjacent nodes. A connection route may be selectively formed according to the network-to-network connection information sent to each management system that manages the domain and added to the network-to-network connection information.

In the network management method according to the present invention,
The integrated management system and the management system are:
When the network / network connection information generated by the integrated management system and the network / network connection information generated by the management system are exchanged with the management system,
One-step authentication is performed between one management system and the integrated management system among the plurality of management systems, and two steps are performed between the one management system and the other management system connected adjacent to the one management system. Authentication may be performed.

In the network management method according to the present invention,
In a network management method of a network management system comprising a plurality of management systems respectively arranged in each domain for managing a network between service nodes, and an integrated management system that manages the management system in an integrated manner and is connected to a user terminal When changing the network status,
An identification information notification procedure in which the integrated management system notifies the management system of network identification information at the time of generation;
In the management system, the network identification information notified in the identification information notification procedure is compared with the network identification information of the management system, the resource is confirmed, and a response procedure for responding to the integrated management system;
A setting request procedure in which the integrated management system makes a setting request to the management system;
A setting processing procedure in which the management system performs setting processing based on connection settings may be performed.

In the network management method according to the present invention,
Each adjacent node accommodated in each management system is set by the management system that is opposite to each other among the management systems according to the network-to-network connection information shared between the management systems. Sharing settings for sharing
A monitoring function confirmation procedure for sending a monitoring packet between adjacent nodes in the management domain and confirming communication with the adjacent node or management system;
A setting state confirmation procedure for confirming a network setting state between management domains by a management system by communication between management systems authenticated in advance when the monitoring packet does not arrive;
When the change in the setting state confirmed in the setting state confirmation procedure is confirmed, an update procedure for notifying the integrated management system and updating the connection information between networks may be performed.

In the network management method according to the present invention,
An identification number acquisition procedure for acquiring a list of network identification numbers of networks across management domains by the network-network connection information of the integrated management system at an adjacent node;
A network-to-network connection information acquisition procedure for acquiring information on packets that flow into the management domain and connection settings at adjacent nodes by network-to-network connection information shared between management systems;
A header analysis procedure for analyzing the header of a packet flowing in from the management domain by the packet analysis unit of the adjacent node,
For a packet that matches the packet information described in the network-network connection information, a domain distribution procedure for distributing the packet to a destination domain is performed according to the network-network connection information, or tunnel identification Perform a load balancing procedure that distributes the load using the number as a key.
For a packet that does not match the tunnel identification number, a domain processing procedure for confirming or discarding the packet to the management domain may be performed.

In the network management method according to the present invention,
The integrated management system notifies the transmission side management system and the reception side management system of a function for encrypting or decrypting the user's packet, respectively;
The transmitting-side management system performs a setting process of a packet that flows into the domain from the service node according to the function for encryption acquired from the integrated management system; and
The receiving-side management system decodes a packet flowing into a domain that accommodates a service node according to a function for decoding acquired from the integrated management system; and
May be performed.

In the network management method according to the present invention,
In the case of network connection between domains, the management system uses the network layer reachability information of NLRI (Network Layer Reachability Information) of BGP (Border Gateway Protocol) as the network-to-network connection information. Reachability information may be shared between management systems.

  The above inventions can be combined as much as possible.

  According to the present invention, the integrated management system provides the encryption / decryption function and the network / network connection information to the service node through the management system through reliable communication, and the user is correctly authenticated between the management systems. Therefore, it is possible to provide a communication system and method that can communicate only the flow and can perform reliable and safe communication.

An example of the block diagram for demonstrating the integrated management system and management system which concern on related technology is shown. An example of the block diagram for demonstrating the network management system which concerns on this embodiment is shown. An example of the block diagram for demonstrating the network management system which concerns on Embodiment 1 is shown. The sequence at the time of connecting between the service nodes of Embodiment 1 is shown. The sequence at the time of connecting between the service nodes of Embodiment 1 is shown. 4 shows a sequence when a resource is added between service nodes according to the first embodiment. 4 shows a sequence when a resource is added between service nodes according to the first embodiment. An example of the block diagram for demonstrating the adjacent node 32 of Embodiment 2 is shown. An example of the block diagram for demonstrating the node redundancy of Embodiment 2 is shown. 6 shows a flow for explaining a monitoring function unit according to the second embodiment. An example of the block diagram for demonstrating the tunnel analysis part of Embodiment 2 is shown. 10 is a flowchart for explaining two-step authentication of user communication according to the third embodiment. The figure explaining the connection form in overlay of Embodiment 4 is shown. The example of a setting item exchanged between the existing domains which concern on embodiment or related technology is shown. The example of the setting item exchanged between the domains which concern on this embodiment is shown. The example of a setting to the adjacent node from the management system which concerns on this embodiment is shown.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited to embodiment shown below. These embodiments are merely examples, and the present invention can be implemented in various modifications and improvements based on the knowledge of those skilled in the art. In the present specification and drawings, the same reference numerals denote the same components.

(Embodiment 1)
The network management system 21 according to this embodiment includes an integrated management system 22 and a management system 26. FIG. 2 illustrates a management system according to the first embodiment of the network management system 21 according to the present invention. The integrated management system 22 includes a route calculation unit 23 that calculates a route for each management domain, and a domain information management unit that associates and manages domain information for each management domain and network-to-network connection information that is network-to-network connection information for each network. 24, an authentication key generation unit 25 that encrypts network-to-network connection information. The management system 26 includes a configuration management unit 27 that manages configuration management information in the domain.

  FIG. 3 shows details of the flow of network-to-network connection information in the network management system 21 according to the present embodiment. In FIG. 3, the route calculation unit 23 provided in the integrated management system 22 calculates which domain is connected with what setting (step S011). Next, the integrated management system 22 that performs primary authentication performs resource confirmation of the corresponding management system 26 (step S012). It is assumed that the integrated management system 22 can communicate with the management system 26 using a public key in advance. Here, FIG. 15 shows network / network identification information exchanged between domains in the case of connection according to the present embodiment. In the case of connection in the present embodiment, only the minimum setting with which the adjacent node 32 communicates is commonly performed in advance (corresponding to 1 to 2), and the rest is set every time the virtual NW 15 is generated. The integrated management system provides customer identification ID and identification policy for end-to-end management (corresponding to 3-4). Information set by each domain is exchanged between the domains (corresponding to 5 to 9).

  The integrated management system 22 uses the authentication key generation unit 25 to generate a key for encryption for each virtual NW and for each domain (step S013). The key for encrypting information of the management system is the encryption key A, the key for returning the encryption based on the decryption key A, the key for encrypting the information of other adjacent management systems is the encryption key B, and the encryption is based on the encryption The key to be returned is a decryption key B. The integrated management system 22 has network-to-network connection information for the management system 26 (corresponding to 3-4 in FIG. 15), encryption key A, decryption key B, and IP address information of other adjacent management systems 26. Are encrypted with the public key and notified to the management domain 26 (step S014). Similarly, the integrated management system 22 also connects the network-to-network connection information (corresponding to 3-4 in FIG. 15), the encryption key B, the decryption key A, and the adjacent management system 26 to the adjacent management system 26. The IP address information of the system 26 is notified. The management system 26 decrypts the information using the secret key, and the management system 26 performs setting in the domain based on the network / network identification information (3 to 4 in FIG. 15) received from the integrated management system. Further, the network / network identification information (5 to 9 in FIG. 15) necessary for setting the adjacent node is encrypted with the encryption key A. Other adjacent management systems 26 similarly encrypt the network / network identification information (5 to 9 in FIG. 15) with the encryption key B. The management system 26 communicates with another adjacent management system 26 via the adjacent nodes 32 to perform authentication. After authentication, the management system 26 transmits network / network connection information (corresponding to 5 to 9 in FIG. 15) encrypted with the encryption key A to another adjacent management domain. The other adjacent management system 26 decrypts the network / network connection information using the decryption key A and sets the adjacent node 32. The other adjacent management system 26 similarly decrypts the network / network connection information with the decryption key B, and sets the adjacent node 32 (step S015). Here, the network / network connection information is exchanged via the adjacent node 32, but the management systems may exchange the network / network connection information via the integrated management system.

  FIG. 4 shows a sequence when the service nodes 28 according to the first embodiment of the present invention are connected. An example is shown in which the integrated management system 21 opens a network that connects the service nodes 28 belonging to the management system # 1 and the management system # 2. For the connection between domains, only basic interface settings and settings for common parts of domain connection information (1-2 in FIG. 15) are set.

  The route calculation unit 23 calculates which management domains are connected to connect the service nodes 28 in order to satisfy the policy and service requirements set by the user 11. At this time, the parameter information is obtained from the domain information management unit 24 to calculate the route satisfying the service requirements. The domain information includes information such as the status of the management system and the status between adjacent nodes 32.

  Next, the integrated management system 22 issues a resource confirmation request for newly deploying the service node 28 to the management systems # 1 and # 2 (steps S101 and 103). The integrated management system 22 and the management system 26 are previously authenticated by public key authentication. The management systems # 1 and # 2 confirm the internal resources, and if the resources are available, reply to that effect (steps S102 and 104). If the resource is not available, the integrated management system 22 performs route calculation again.

  The integrated management system 22 sets the encryption keys A and B and the decryption keys A and B (the encryption key A and the decryption key A, the encryption key B and the decryption key B generated by the authentication key generation unit 23 for each virtual NW 15 and each adjacent node 18. ) And network-to-network connection information (3-4 in FIG. 15). The encryption keys A and B, the decryption keys A and B, and the network / network connection information are generated every time a network is generated.

  The integrated management system 22 sends a new deployment request for the virtual NW 15 and the service node 28 to the management systems # 1 and # 2 (steps S105 and S106). Management system # 1 has encryption key A, decryption key B, and network / network connection information (3-4 in FIG. 15), and management system # 2 has connection between encryption key B, decryption key A, and network / network. Information (3-4 in FIG. 15) is notified. This is the first level authentication between the integrated management system 22 and the management system 26.

  The management system # 1 performs the new deployment of the service node 28 in the domain and the setting of the virtual NW 15 based on the requirements of the integrated management system 22, and at the same time, using the encryption key A provided from the integrated management system 22 The network connection information (5 to 9 in FIG. 15) is encrypted. Similarly, the management system # 2 performs the new deployment of the service node 28 in the domain and the setting of the virtual NW 15, and at the same time, the encryption of the network-to-network connection information (5 to 9 in FIG. 15) using the encryption key B. To do.

  The management system # 1 and the management system # 2 exchange network-to-network connection information (5 to 9 in FIG. 15) via the adjacent node 32 or the integrated management system 22. The management systems # 1 and # 2 decrypt the network-to-network connection information with the decryption key B and the decryption key A, respectively. (Steps S107 and 108). This is the second level authentication.

  Next, the management system 26 performs network setting based on the network / network connection information (5 to 9 in FIG. 15) received from the integrated management system 22. FIG. 16 shows a setting example from the management system 26 to the adjacent node 32. The management systems 1 and 2 share network / network connection information such as IP-segment-list and Access list. Based on this, the management system 1 performs bgp setting, access list setting, and the like for the adjacent node 32. Network / network connection information may be converted into BGP NLRI (Network Layer Reachability Information), and information may be exchanged between management systems.

  After setting the network, the management system # 1 stores the set configuration information in the configuration management unit 27 and notifies the integrated management system 22 (steps S109 and S110).

  As described above, information can be exchanged between the management systems 26 by secure communication, and control between the management domains not belonging to the management domain can be performed by the integrated management system 22, and the management system 26 can transfer the internal information to the integrated management system. Therefore, the burden on the integrated management system 22 can be reduced. FIG. 5 is a modification of the sequence shown in FIG. 4, and is a sequence when a network service is realized by a management system of a plurality of integrated management systems. In this embodiment, you may operate | move according to step S201-214 in FIG.

  FIG. 6 shows a sequence when adding resources between the service nodes 28 according to the first embodiment of the present invention. The integrated management system 22 has resources that can be added to the virtual NW 15 from the service node 28 to the adjacent node 32 for the management system # 1 by designating the customer identification ID of the network-to-network connection information described above to the management system 26. A confirmation request is made (step S301).

  When the resource can be confirmed, the management system # 1 returns a resource confirmation request response to the integrated management system 22 (step S302). The same operation is performed for the management system # 2 (steps S303 and 304), and when the resources can be secured, the integrated management system 22 designates the customer identification ID and requests the resource allocation request of the service node 28 to the management systems # 1 and # 2. (Steps S305 and S306). The authentication at this time may use the above-described two-step authentication mechanism.

  The management system # 1 newly deploys the service node 28 and sets the network. Next, the management system # 1 # 2 uses the above-described encryption key to exchange network-to-network connection information set in the adjacent node 32 (steps S307 and S308). After setting to the adjacent node, the network-to-network connection information is updated, and the completion of node resource allocation is notified to the integrated management system 22 (step S309). By setting the management system # 2 in the same manner, it is possible to increase resources between service nodes (step S310). FIG. 7 is a modification of the sequence shown in FIG. 6, and is an example in which the service bandwidth is changed between the management systems when the integrated management system has a plurality of times. In this embodiment, you may operate | move according to step S401-413 in FIG.

(Embodiment 2)
FIG. 8 is a diagram for explaining the adjacent node 32 according to the second embodiment of the present invention. The adjacent node 32 includes a monitoring function unit 34 and a tunnel analysis unit 35, and is connected to the other adjacent node 32 by a link 38. Note that these functions in the configuration diagram of FIG. 8 may be provided in the management system 26 instead of the adjacent node 32. In this case, the monitoring function unit 34 may send a monitoring packet from the management system 26 to the adjacent node 32, and the tunnel analysis unit 35 may send a packet from the adjacent node 32 to the management system 26. The packet may be analyzed with

  FIG. 9 is a diagram for explaining node redundancy according to the second embodiment of the present invention. As a route between management domains, there are a plurality of links 38 in the node as shown in FIG. 8, and there may be redundancy in that, or there may be a plurality of adjacent nodes 32 between the management domains as shown in FIG. is there. Which adjacent node 32 is used and how to make it redundant are registered in the network-to-network connection information.

  FIG. 10 shows a flow for explaining the monitoring function unit 34 according to the second embodiment of the present invention. The monitoring function unit 34 generates a monitoring packet and performs monitoring between adjacent nodes 32 (steps S501 and S502). The monitoring method at this time is shown in 9. of FIG. Follow. When the monitoring packet between the adjacent nodes 32 does not reach, registered by the network-to-network connection information shared between the adjacent nodes in FIG. The recovery is performed by the recovery method described in (1) (switching to the constructed standby route (step S503), switching to a route from another adjacent node 32, etc.). Specifically, when there is a registered switch, the registered switch is executed (steps S504 and S505). If there is no registered switch, an inquiry process for making an inquiry to the management system is performed (steps S506 and S507).

  Further, the adjacent node 32 prevents the traffic from being concentrated, as shown in 8 of FIG. The traffic load is distributed among multiple links and multiple nodes by the method described in (1). At this time, in the method of distributing based on the address (hashing or the like), in the case of the same address segment, it is not properly distributed. In the case of network connection between domains, the management system 26 uses BGP (Border Gateway) which is a protocol for performing path control used to accurately grasp and maintain the destination of a packet to be communicated as network-to-network connection information. Protocol). Network / network connection information is network layer reachability information used as BGP NLRI (Network Layer Reachability Information), network layer reachability information is shared between management systems, and network layer reachability information is shared. And the exchange is performed by the management system 26.

  FIG. 11 is a diagram for explaining the tunnel analysis unit 35 according to the second embodiment of the present invention. The adjacent node 32 uses the network-to-network connection information acquired by the management system 26 in advance by two-step authentication to indicate the type of tunnel (VXLAN) and VXLAN ID that pass between domains in FIG. Get in. The tunnel analysis unit 35 analyzes up to and including the VXLAN header of the packet that has entered the adjacent node 32 (step S602). And 604). Specifically, when it matches the registered tunnel number, the forwarding process is performed on the destination domain (steps S604 and 605). If it does not match the registered tunnel number, confirmation processing for confirming with the management domain is performed (steps S606 and 607). Of course, you may transfer as it is according to IP routing.

  At that time, VXLAN_ID is added to the key and hashed to appropriately distribute between networks. In the case of an unregistered VXLAN ID, the management system 26 can be inquired or discarded to prevent extra traffic from flowing to other domains. The entire header may be hashed.

(Embodiment 3)
By using the two-step authentication according to the present invention for the communication of the user 11, more reliable communication can be realized. FIG. 12 shows a flow for explaining two-step authentication of user communication according to the third embodiment of the present invention. The accommodating node indicates the node 11 that accommodates the service node 28 with which the user 11 communicates. In the network management system 21 according to the present embodiment, steps S701 to 711 may be executed according to the flow of FIG.

  Assume that the user 11 requests the integrated management system 22 for an encrypted path when requesting a path. The integrated management system 22 notifies the management system 26 of the procedure for encryption / decryption together with the network-to-network connection information, and opens the path by two-step authentication as in FIG.

  In the accommodating node on the transmission side, the packet is encrypted and transferred by the encryption procedure acquired from the management system 26 when the packet is transferred. Similarly, the receiving side restores the packet and distributes it to the opposite service node by the decoding procedure acquired from the management system 26.

  In the existing method, when a VPN is established between user terminals and communication is encrypted, it is necessary to provide a means for passing the key to the other party in the first authentication. However, this key exchange is performed using a means different from the communication path. If it is not performed, it cannot be guaranteed that the partner terminal that received the key is the correct partner, and communication reliability is lost.

  Therefore, in the case of the present invention, the integrated management system and the management system 26 exchange the keys, thereby enabling authentication on a route different from the communication route, and registration of the management system 26 and authentication of the communication route are possible. Communication is established only when it matches correctly.

  As a result, a highly reliable path can be constructed. Furthermore, the normal communication encryption mechanism requires an additional header for encryption / decryption, but the present invention does not require a header. In addition, since encryption and decryption processing can be realized by a normal switch chip, processing can be performed at high speed. In the above example, user communication is shown. However, for example, when a monitoring packet is sent end-to-end on a user communication path, the information of the monitoring packet may be encrypted by the above-described method.

(Embodiment 4)
FIG. 13 is a diagram illustrating a connection form in overlay according to the fourth embodiment of the present invention. Some management systems 26 may not be directly connected.
For example, it is assumed that the management system # 1 and the management system # 3 only have a method of transiting and connecting the management domain # 2.

  In this case, the adjacent nodes 32 between the management domain # 1 and the management domain # 2 are connected by BGP in the same way as existing. The adjacent nodes 32 between the management domain # 2 and the management domain # 3 are similarly connected by BGP. After that, by establishing an overlay tunnel between the management domain # 1 and the management domain # 3, the adjacent node 32 of the management domain # 1 and the adjacent node 32 of the management domain # 3 are virtually directly connected. It becomes a state. Accordingly, the same function can be realized even when a management domain not supported by the management system 26 is connected.

  Hereinafter, configuration examples and effects of the network management system 21 and the network management method according to the present invention will be described. In the embodiment described above and the configuration example described below, the network-to-network connection information held and managed by the domain information management unit 24 provided in the integrated management system 22 is the first inter-network connection information, and the management system 26 The network-to-network connection information held and managed by the domain information management unit 27 included in the network information may be distinguished from the second network connection information.

  In the present embodiment, the network management system 21 is a management system 26 that manages a network between service nodes 28 and an integrated management system 22 that manages the management system 26 in an integrated manner. Two steps of encrypting the configuration information and policy information generated for each network, and performing authentication between the integrated management system 22 and the management system 26 as an authentication method when exchanging the information, and further between the three adjacent management systems 26 The use of authentication, the provision of the authentication key generation unit 25 for generating a key for performing the authentication, the information of the management system 26, and the domain information management unit 24 for managing the network-to-network connection information and between the domains A route calculation unit 23 for calculating an optimal route is provided.

  In the network management system and the network management method, the integrated management system 22 acquires network-to-network connection information from the domain information management unit 24 when the network is opened, and calculates a route that satisfies the requirements by the route calculation unit 23. A step of notifying the management system 26 of a request to connect the management domains to the management system 26 obtained by the route calculation; The network resources and network connection information and the public key information sent to the integrated management system, and the authentication key generator 25 sends the network and network connection information of the management system 26 to each management system. Is the public key generated by 26? A step of creating a random number, encrypting it with information generated by the random number, and distributing the random number to each management system 26, and the management system 26 is a management system described in the network-to-network connection information acquired from the integrated management system 22 A key exchange with the network 26 and performing key authentication of the network / network connection information obtained from the integrated management system using each other's public key, and the management system 26 adjoins the management domain based on the network / network connection information. A step of setting the node 32; a management system 26, after the setting, issues an identification number for managing the network-to-network connection information, stores it in the domain information management unit 27, and notifies the integrated management system 22; The integrated management system 22 is a domain information management Wherein the storing the network connection information to the section 24.

  As a result, the integrated management system 22 can share the network-to-network connection information with the management domain, and it is sufficient to share the minimum information without sending information to all the management domains, thereby reducing the burden on the integrated management system 22. In addition, the integrated management system 22 provides the setting of the inter-management domain adjacent node 32 that is outside the scope of the management system 26 as network-to-network connection information, so that information between the management domains can be managed.

  Also, the management system 26 that has received the network-network connection information decrypts and then communicates with the opposite management system 26 to decrypt the neighboring node information between the network and the network by two-step authentication to acquire each other's key. By acquiring, it can communicate safely.

  Further, the network management system and method includes a step of notifying the management system 26 of network identification information at the time of generation when the integrated management system 22 changes the network state, and the management system 26 compares it with the internal network identification information. Confirming resources and responding to the integrated management system 22, the integrated management system 22 including a step of making a setting request to the management system 26, and the management system 26 performing a setting based on the setting. Features.

  As a result, a system in which the integrated management system 22 and the adjacent management system 26 mutually authenticate each other with respect to the network created by the user 11 is introduced, and the management system 26 via the integrated management system 22 By establishing an information exchange scheme, information of the user 11 can be exchanged safely between the management systems 26, and connection portions between adjacent nodes 32 that are outside the scope of the management system 26 are integrated. By managing the management system 22 and delegating the management to the management system 26, flexible network control is possible while minimizing the functions of the integrated management system 22.

  Further, in the network management system and the network management method, the adjacent node 32 shares the switching means of the adjacent node 32 with the opposite management domain based on the network-network connection information of the integrated management system 22, and the monitoring function unit The management system 26 sends a monitoring packet between the adjacent nodes 32 of the management domain via 34 and confirms the communication and when the monitoring packet does not reach, the management system 26 communicates with the network between the management domains by communication between the management systems 26 authenticated in advance. And a step of notifying the integrated management system 22 when the state changes and updating the network-to-network connection information.

  As a result, the integrated management system 22 provides the network-to-network connection information to the adjacent node 32 via the management system 26 with reliable communication, and the adjacent node 32 is switched by the integrated management system 22 at the time of failure. By switching the communication of the user 11 based on the switching means, switching management between adjacent nodes 32 managed by the integrated management system 22 is possible.

  Further, in the tunnel analysis unit 35 in the network management system and the network management method, the adjacent node 32 obtains a list of tunnel identification numbers across management domains based on the network-to-network connection information of the integrated management system 22; The packet analysis unit analyzes the header of the packet flowing in from the management domain, and for packets that match the tunnel number described in the network-network connection information, the packet is determined according to the network-network connection information. A step of distributing to a destination domain, a step of distributing a load using a tunnel identification number as a key, or a step of confirming or discarding a packet that does not match the tunnel number to the management domain, And wherein the Ukoto.

  As a result, the integrated management system 22 provides a list of network-to-network connection information and tunnel identification numbers to the adjacent nodes 32 through the management system 26 with reliable communication. By performing control in comparison with the identification number, communication between adjacent domains between adjacent nodes is reduced based on the management of the integrated management system 22, and more flexible traffic control is possible.

  Further, in the tunnel analysis unit 35 in the network management system and the network management method, when load is distributed to a plurality of routes, in addition to the source and destination addresses, the tunnel identification number or the tunnel identification information obtained by the packet analysis unit A hash value is calculated by adding a header, and traffic is distributed to a plurality of paths.

  As a result, even if communication between management domains has the same source and destination addresses, traffic can be distributed by distributing the load to a plurality of routes.

  Further, in the network management system and the network management method, the integrated management system 22 notifies the transmission-side management system 26 and the reception-side management system 26 of a function for encrypting and decrypting the network-network connection information. The transmission-side management system 26 processes the packet flowing into the domain that accommodates the service node 28 using the encryption function acquired from the integrated management system 22, and the reception-side management system 26 is the same. And the step of decrypting the packet flowing into the domain accommodating the service node 28 by the decrypting function acquired from the integrated management system 22.

  In the above-described embodiment, the integrated management system 22 includes a connection request notification unit that notifies the management system 26 of a connection request for connecting between management domains obtained from the calculation result of the route calculation unit 23. In addition, an integrated management system processing unit that transmits and receives communication information with the management system 26 may be provided.

  The management system 26 also includes a management system processing unit that performs transmission and reception with the integrated management system processing unit. The management system 26 receives a connection request notification from the connection request notification unit, and in the domain that is the connection destination according to the service requirements. A domain information management unit comprising an information transmission unit that reserves resources, acquires network-to-network connection information from the domain information management unit 27, and transmits the network-to-network connection information and public key information to the integrated management system processing unit 24, the network-to-network connection information is acquired via the integrated management system processing unit, a random number is created from the public key generated by each management system 26, encrypted with the random number information generated by the random number, and each management An authentication key generation unit distributed to the system 26 may be provided.

  Furthermore, the management system 26 performs key exchange with the connection destination management system described in advance in the network-to-network connection information, and uses the mutual public key to authenticate the network-to-network connection information acquired from the integrated management system 22. A key authentication unit that performs the setting, and includes an adjacent node setting unit that sets the adjacent node 32 of the management domain based on the network-to-network connection information. After the setting performed by the adjacent node setting unit, the network-to-network connection information An identification number notifying unit that pays out an identification number for managing the ID number, stores the ID number in the domain information management unit, and notifies the integrated management system processing unit of the identification number may be provided.

  The present invention can be applied to the information communication industry.

11: user 12: integrated management system 13: route calculation unit 14: management system 15: virtual network 16: service node 17: domain 18: node 19: configuration management unit 22: integrated management system 23: route calculation unit 24: domain information Management unit 25: Authentication key generation unit 26: Management system 27: Configuration management unit 28: Service node 32: Adjacent node 35: Tunnel analysis unit 36: Logical port 37: Transfer unit 38: Link

Claims (11)

Are arranged in a plurality of domains, and a plurality of management system for managing the network between the service node, wherein the management system integrally manages, and a integrated management system connected to the user terminal,
Sharing network-to-network connection information between the integrated management system and each management system,
Depending on sharing the said network network connection information, a network management system for selectively forming a connection path between the management domains, each of the management system to manage,
The integrated management system includes:
Based on the service requirements transmitted by the user terminal, first network-to-network connection information including setting information that meets the service requirements is transmitted to each management system that manages a management domain to be connected;
The management system includes:
The first network / network connection information sent by the integrated management system is received, and the second network / network connection information including setting information specific to a service and setting information necessary for connection between domains is integrated. The second network-to-network connection information exchanged with another management system that manages the management domain to be connected through the management system or an adjacent node, and exchanged with the other management system. A network management system characterized in that an adjacent node is set in response and an identification number for managing the second network-network connection information is issued and notified to the integrated management system. A plurality of management systems respectively arranged in a plurality of domains, for managing a network between service nodes; and an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
A network management system that selectively forms a connection path between management domains managed by each of the management systems according to the shared network-network connection information,
If you replace the connection information between the network network with other management systems connected adjacent one management system as the one of the management system of the plurality of management systems,
Run the first stage authentication between said integrated management system and the one of the management system and the other management system,
Features and to Rene Ttowaku management system to perform the second stage authentication between said as one of the management system and the other management systems. The integrated management system includes:
A route calculator that calculates a route that satisfies the policy requirements and service requirements generated by the user terminal;
A connection request notification portion that notifies a connection request for connecting the management domain obtained by the calculation result of the route calculation unit to the management system,
A domain information management unit for managing network-to-network connection information including connection information between domains;
It generates an encryption key and a decryption key, and an authentication key generation unit to be delivered to the management system,
The management system includes :
Which receives the notification of the connection request, and the information transmission unit that the service requirements depending on the reserved resources in the domain to which it is connected, transmits a public key reservation information of the resource to the integrated management system,
An intra-domain node setting unit for setting information of nodes in the management domain based on network-to-network connection information acquired from the integrated management system ;
It performs the management system and key exchange of the serial mounting connection destination between the network network connection information, and key authentication unit for performing key authentication between network network connection information with each other,
An adjacent node setting unit for setting information of an adjacent node connected to another management domain based on the network-to-network connection information;
The rear adjacent node information setting the setting section has performed, and stored in the configuration management unit configuration information of the network after setting, a setting notifying unit that notifies the integrated management system, Ru provided with,
The network management system according to claim 1 or 2 , characterized in that The management system includes:
In the case of network connection between domains, the network layer reachability information is used by using the network layer reachability information (NLRI) information of BGP (Border Gateway Protocol) as the network-to-network connection information. network management system according to any of claims 1 to 3, characterized in that shared between the management system. Are arranged in a plurality of domains, and a plurality of management system for managing the network between the service node, wherein the management system integrally manages, and a integrated management system connected to the user terminal,
Sharing network-to-network connection information between the integrated management system and each management system,
Depending on sharing the said network network connection information, a network management method of selectively forming a connection path between the management domains, each of the management system to manage,
The integrated management system includes:
Based on the service requirements transmitted by the user terminal, first network-to-network connection information including setting information that meets the service requirements is transmitted to each management system that manages a management domain to be connected;
The management system includes:
The first network / network connection information sent by the integrated management system is received, and the second network / network connection information including setting information specific to a service and setting information necessary for connection between domains is integrated. The second network-to-network connection information exchanged with another management system that manages the management domain to be connected through the management system or an adjacent node, and exchanged with the other management system. A network management method comprising: setting an adjacent node in response, giving out an identification number for managing the second network-network connection information, and notifying the integrated management system . A plurality of management systems respectively arranged in a plurality of domains, for managing a network between service nodes; and an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
A network management method for selectively forming a connection path between management domains managed by each management system according to the shared network-network connection information,
If you replace the connection information between the network network with other management systems connected adjacent one management system as the one of the management system of the plurality of management systems,
Run the first stage authentication between said integrated management system and the one of the management system and the other management system,
Features and to Rene Ttowaku management method to perform the second stage authentication between said as one of the management system and the other management systems. A plurality of management systems respectively arranged in a plurality of domains, for managing a network between service nodes; and an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
A network management method for selectively forming a connection path between management domains managed by each management system according to the shared network-network connection information,
If you want to change the network state,
The integrated management system, the identification information notification procedure of notifying the network identification information generated at the time of the management system,
The management system, the response procedure the confirmed resources as well as compares the network identification information of the notified identification information notification procedure network identification information and the management system, responsive to said integrated management system,
The integrated management system, the setting request procedure for requesting for connecting the management domain to the management system,
A setting processing procedure in which the management system performs connection setting processing based on the request ;
Features and to Rene Ttowaku management method to be performed. A plurality of management systems respectively arranged in a plurality of domains, for managing a network between service nodes; and an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
A network management method for selectively forming a connection path between management domains managed by each management system according to the shared network-network connection information,
By the inter-network network connection information shared between the management system, management system facing each other to each other among the previous SL management system, a setting shared To share the switching processing setting management domain of the adjacent nodes,
The administrative domain between adjacent nodes send monitoring packet, the adjacent node or the management system, the monitoring function verification steps to verify the rapport,
If the monitoring packet does not reach, the management system, the communication between the pre-authenticated the management system, and setting status checking procedure to check the setting state of the network between administrative domains,
If you see the change in the pre-Symbol set state by the setting status checking procedure, the update procedure in which the management system notifies the integrated management system, the integrated management system updates the connection information between the network network,
Features and to Rene Ttowaku management method to be performed. A plurality of management systems respectively arranged in a plurality of domains, for managing a network between service nodes; and an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
A network management method for selectively forming a connection path between management domains managed by each management system according to the shared network-network connection information,
Adjacent nodes connected to other administrative domains
By the inter-network network connection information of the integrated management system, an identification number obtaining procedures to obtain a list of tunnel identification number is the identification number of the network across administrative domains,
Wherein by said between network network connection information shared between the management system, and inter-network network connection information acquisition procedure for acquiring the connection settings in information and the neighbor nodes of the packet that has flowed into the administrative domain,
A header analysis procedure for analysis of the header of the incoming packet from the management domain
For a packet having a header that matches the tunnel identification number described in the network-network connection information, a domain distribution procedure for distributing the packet to a destination domain according to the network-network connection information ;
For a packet having a header that does not match the tunnel identification number described in the network-to-network connection information, a domain processing procedure for confirming or discarding to the management domain;
Features and to Rene Ttowaku management method to be performed. A plurality of management systems respectively arranged in a plurality of domains, for managing a network between service nodes; and an integrated management system for managing the management system in an integrated manner and connected to a user terminal;
Sharing network-to-network connection information between the integrated management system and each management system,
A network management method for selectively forming a connection path between management domains managed by each management system according to the shared network-network connection information,
The integrated management system includes a notification procedure for notifying the respective functions for encrypting or decrypting packets of user management system sender and receiver management system,
Management system of the sender, the encryption processing procedure for setting processing of the packet that has flowed into the domain from the service node in response to a function for encrypting acquired from the integrated management system,
Management system of the receiving side, a decoding procedure to decode the packet flowing into the domain accommodating the service node in response to a function for decoding obtained from the integrated management system,
Features and to Rene Ttowaku management method to be performed. In the case of network connection between domains, the management system uses the network layer reachability information of NLRI (Network Layer Reachability Information) of BGP (Border Gateway Protocol) as the network-to-network connection information. network management method according to any one of claims 5 to 10, characterized in that share reachability information between management systems.

Images