Communication system, virtual network management apparatus, virtual network management method and program

Abstract

A communication system includes: a network configuration memory that stores network configuration information of a first layer in which an area of the first layer whose low level configuration is desired to be concealed is represented by a preset symbol and that also stores network configuration information of a second layer showing the area represented by the preset symbol. The system also includes a network configuration management section that allows a first user to manage a network of the first layer using the network configuration information of the first layer and that also allows a second user to manage a network of the second layer using at least the network configuration information of the second layer.

Claims

1. A communication system, comprising: a network configuration memory that stores: network configuration information of a first layer in which an area of the first layer whose low level configuration is desired to be concealed is represented by a preset symbol; and network configuration information of a second layer showing the area represented by the preset symbol; a network configuration management section that allows: a first user to manage a network of the first layer using the network configuration information of the first layer; and a second user to manage a network of the second layer using at least the network configuration information of the second layer; a mapping information memory that stores a relation of correspondence between a first identifier for identifying a user in the first layer, and a second identifier for identifying a user in the second layer; and a switch controller that causes a switch on a path of a user packet to write the second identifier in a header of the user packet, based on the first identifier contained in the user packet.

2. The communication system according to claim 1, wherein, the second identifier is stored in a preset area of an additional header that stores an identifier of the first layer.

3. The communication system according to claim 2, wherein, the network of the second layer showing the area represented by the preset symbol is associated with the network of the first layer in a one to multiple relation.

4. The communication system according to claim 1, wherein, the second identifier is stored in a preset area of the header of the user packet.

5. The communication system according to claim 4, wherein, the network of the second layer showing the area represented by the preset symbol is associated with the network of the first layer in a one to multiple relation.

6. The communication system according to claim 1, wherein, the network of the second layer showing the area represented by the preset symbol is associated with the network of the first layer in a one to multiple relation.

7. A virtual network management apparatus comprising: a network configuration memory that stores: network configuration information of a first layer in which an area of the first layer whose low level configuration is desired to be concealed is represented by a preset symbol; and network configuration information of a second layer showing the area represented by the preset symbol; a network configuration management section that allows: a first user to manage a network of the first layer using the network configuration information of the first layer; and a second user to manage a network of the second layer using at least the network configuration information of the second layer; a mapping information memory that stores a relation of correspondence between a first identifier for identifying a user in the first layer, and a second identifier for identifying a user in the second layer; and a switch controller that causes a switch on a path of a user packet to write the second identifier in a header of the user packet, based on the first identifier contained in the user packet.

8. A method for management of a virtual network including a network configuration memory that stores network configuration information of a first layer in which an area of the first layer whose low level configuration is desired to be concealed is represented by a preset symbol, and that also stores network configuration information of a second layer showing the area represented by the preset symbol, the method comprising: accepting an operation on a network of the first layer made by a first user with the use of the network configuration information of the first layer; accepting an operation on a network of the second layer made by a second user with the use of at least the network configuration information of the second layer; storing a relation of correspondence between a first identifier for identifying a user in the first layer, and a second identifier for identifying a user in the second layer; and causing a switch on a path of a user packet to write the second identifier in a header of the user packet, based on the first identifier contained in the user packet.

9. The method according to claim 8, wherein: the second identifier is stored in a preset area of an additional header that stores an identifier of the first layer.

10. The method according to claim 8, wherein: the second identifier is stored in a preset area of the header of the user packet.

11. The method according to claim 8, wherein: the network of the second layer showing the area represented by the preset symbol is associated with the network of the first layer in a one to multiple relation.

12. A non-transitory computer-readable recording medium storing a program that causes a computer, arranged in a virtual network including a network configuration memory that stores network configuration information of a first layer in which an area of the first layer whose low level configuration is desired to be concealed is represented by a preset symbol, and that also stores network configuration information of a second layer showing the area represented by the preset symbol, to execute a method, the method comprising: accepting an operation on a network of the first layer made by a first user with the use of the network configuration information of the first layer; accepting an operation on a network of the second layer made by a second user with the use of at least the network configuration information of the second layer; storing a relation of correspondence between a first identifier for identifying a user in the first layer, and a second identifier for identifying a user in the second layer; and causing a switch on a path of a user packet to write the second identifier in a header of the user packet, based on the first identifier contained in the user packet.

13. The non-transitory computer readable recording medium according to claim 12, wherein: the second identifier is stored in a preset area of an additional header that stores an identifier of the first layer.

14. The non-transitory computer readable recording medium according to claim 12, wherein: the second identifier is stored in a preset area of the header of the user packet.

15. The non-transitory computer readable recording medium according to claim 12, wherein: the network of the second layer showing the area represented by the preset symbol is associated with the network of the first layer in a one to multiple relation.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) FIG. 1 is a schematic view showing a configuration of an exemplary embodiment of the present invention.

(2) FIG. 2 is a block diagram showing a configuration of a network management device according to the exemplary embodiment.

(3) FIG. 3 is a schematic view to be used as reference for understanding a first exemplary embodiment of the present invention.

(4) FIG. 4 is a schematic view showing a configuration of a virtual network of the first exemplary embodiment of the present invention.

(5) FIG. 5 is a block diagram showing a configuration of a network management device according to the first exemplary embodiment of the present invention.

(6) FIG. 6 is a diagrammatic view showing example storage locations of an identifier for the first layer and an identifier for the second layer.

(7) FIG. 7 is a diagrammatic view showing modified example storage locations of an identifier for the first layer and an identifier for the second layer.

(8) FIG. 8 is a schematic view showing a physical configuration of a virtual network according to a second exemplary embodiment of the present invention.

(9) FIG. 9 is a tabulated view showing the configuration information of domains and boundaries in the network configuration of FIG. 8.

(10) FIG. 10 is a tabulated view showing the configuration information of a virtual network of a second layer constituted by switches #1 and #2 of FIG. 8, with a schematic view showing the virtual network.

(11) FIG. 11 is a tabulated view showing the configuration information of a first layer in which a virtual network of the second layer of FIG. 10 is arranged as a virtual tunnel, with a schematic view showing the virtual network placed as a virtual tunnel in the first layer.

(12) FIG. 12 is a tabulated view showing modified configuration information of a first layer in which a virtual network of the second layer of FIG. 10 is arranged as a virtual tunnel, with a schematic view showing the virtual network placed as a virtual tunnel in the first layer.

(13) FIG. 13 is a schematic expanded view of a virtual network constructed from the network configuration of FIG. 8.

(14) FIG. 14 is an expanded schematic view of a virtual network according to a third exemplary embodiment of the present invention.

(15) FIG. 15 is an expanded schematic view of a virtual network according to a fourth exemplary embodiment of the present invention.

PREFERRED MODES

(16) In the present disclosure, there are various possible modes, which include the following, but not restricted thereto. Initially, a summary of a preferred mode of the present invention will be described with reference to the drawings. It is noted that symbols are entered in the following summary merely as examples to assist in understanding and are not intended to limit the present invention to the mode illustrated.

(17) In a preferred mode, the present invention may be implemented by a communication system including a network management device 20 composed of a network configuration memory (21 of FIG. 2) and a network configuration management section (22 of FIG. 2). The network configuration memory stores the network configuration information of a first layer in which an area of the first layer whose low level configuration is desired to be concealed is represented by a preset symbol and that also stores the network configuration information of a second layer showing the area represented by the preset symbol. The network configuration management section allows a first user to manage the network of the first layer using the network configuration information of the first layer and that also allows a second user to manage the network of the second layer using at least the network configuration information of the second layer (see FIG. 1). It is noted that the content for processing, accepted by the network configuration management section (22 of FIG. 2) from the user, is forwarded to a control device, not shown, for controlling the individual switches.

(18) In an example of FIG. 1, a user to whom a network identifier: 1 is allocated and another user to whom a network identifier: 2 is allocated share a virtual network constituted from one and the same physical network. The network management device 20 configures a virtual node 11, using a plurality of physical switches, and places the so configured virtual node in a network of a second layer. In a first layer, the network of the second layer is represented by a symbol. Hence, the users, to whom are allocated the network identifier: 1 and the network identifier: 2 are able to manage and use their respective dedicated networks without being concerned about the configuration of the second layer.

(19) On the other hand, the second layer is managed by a third user who manages the network of the second layer.

(20) In this manner, ease in construction as well as management of the virtual network may be enhanced. The reason is that a virtual network is split into a plurality of layers and that, in an upper layer, an area whose low level configuration is desired to be concealed is represented by a symbol.

First Exemplary Embodiment

(21) A first exemplary embodiment of the present invention will now be described in detail with reference to the drawings. FIG. 3 is a schematic view which may be referenced in understanding the first exemplary embodiment. Referring to FIG. 3, there are shown a physical network made up of four physical switches and a single-layer virtual network including virtual nodes 10, 11. In this situation, a network management device X20 is able to exercise flow-based control to permit a plurality of users, namely a user with VN1=1 and another user with VN1=2, to use the virtual network. By the way, VN1 is an acronym of VXLAN Network Identifier and VXLAN an acronym of Virtual Extensible Local Area Network.

(22) However, the single-layer virtual network of FIG. 3 suffers a problem that, if a virtual node 11 is presented to a certain user, for example, a user with the VNI=1, and the user is allowed to change its setting, such change affects a network of a user with the VN1=2. Hence, in the subject exemplary embodiment, the virtual node 11 of the virtual network of FIG. 3 is placed in a second layer with virtual end points, as shown in FIG. 4, and network slicing is made by VXLAN in the first layer. Moreover, in the first layer, the above mentioned virtual node of the network of the second layer is represented by a symbol ‘virtual tunnel’ that has interfaces mapped to the virtual end points of the second layer.

(23) Also, in the subject exemplary embodiment, flow control that takes the VNIs into consideration may be exercised in the second layer as well.

(24) A user or a user group in the second layer may be identified by imparting an identifier for the second layer to e.g., a header of a user packet. FIG. 5 shows a configuration of a network management device 20A of the first exemplary embodiment of the present invention. The network management device of the subject exemplary embodiment differs from the network management device shown in FIG. 2 in such points that there are provided a mapping information memory 23 that stores the relation of correspondence between the user identifiers of the first and second layers and a switch controller 24 that causes the switch(es) on the physical network to perform the processing of writing the user identifier in a packet header based on this relation of correspondence.

(25) FIG. 6 shows an example storage location of the identifier for the second layer. In the example of FIG. 6, an identifier for the second layer is stored at a preset location of an additional header of VXLAN etc. This enables flow identification making use of an identifier for the second layer as well.

(26) FIG. 7 shows another example of the storage location for the identifier for the second layer. The example of FIG. 7 is such a one in which the identifier for the second layer is stored at a preset location of a header of an upper layer protocol on an inner side of the additional header of VXLAN etc. By so doing, even in such a case where the additional header is stripped off by a gateway and a resulting packet is forwarded to an outer address, as shown in a lower part of FIG. 7, it is possible for the outer network node to exercise flow control that takes the VNIs into account.

Second Exemplary Embodiment

(27) A second exemplary embodiment of the present invention will now be explained in detail with reference to the drawings. FIG. 8 illustrates a physical configuration of a virtual network of the second exemplary embodiment of the present invention. Since the subject exemplary embodiment may be implemented by a configuration similar to that of the first exemplary embodiment, the following description is centered about the points of difference from the above described first exemplary embodiment.

(28) FIG. 8 shows a configuration in which switches #1, #2 controlled to perform slicing by a VSID (Virtual Subset iDentifier) in accordance with NVGRE (Network Virtualization using Generic Routing Encapsulation) are connected via a gateway GW to switches #3, #4 that are outside the NVGRE. To the switch #1, there are connected hypervisor hosts #1, #2 implemented by a hypervisor type server virtualization application. In the drawing, b1 through to b4 denote boundaries of domains configured by a controller.

(29) FIG. 9 shows an example of the configuration information of the domains and the boundaries in the network configuration of FIG. 8. In the example of FIG. 9, five domains and the boundaries b1 through to b4 lying at border lines thereof are defined by the combinations of switches and ports, as seen from FIG. 8.

(30) FIG. 10 shows an example of the configuration information of a virtual network of the second layer composed of the switches #1, #2 of FIG. 8. Referring to FIG. 10, a virtual bridge vbr1 constituted by the switches #1, #2, interfaces of the virtual bridge and virtual links defined by tunnel end points (vteps) are defined. The virtual links are mapped to the boundaries b1 through to b3 of FIG. 8 and ‘10’ is donated to each of the links as vlan-id.

(31) FIG. 11 shows an example of the configuration information of the first layer in which the virtual network of the second layer of FIG. 10 is placed as a virtual tunnel. In FIG. 11, the virtual network, shown in FIG. 10, is represented by a virtual tunnel vtunnel1 having the VSID: 10 and is connected to virtual bridges vbr1, vbr2 of the first layer. The virtual tunnel vtunnel1 has its interfaces mapped to virtual tunnel end points vtep1, vtep3 of FIG. 10. Likewise, end points 1, 4, connecting to interfaces of virtual bridges vbr1, vbr3 of the network of the first layer, are mapped to a port of the hypervisor host #1 and to a port of the switch #4.

(32) FIG. 12 shows another example of the configuration information of the first layer in which the virtual network of the second layer shown in FIG. 10 is placed as a virtual tunnel. Referring to FIG. 12, the virtual network, shown in FIG. 10, is represented by a virtual tunnel vtunnel1 having a VSDI: 20, and is connected to the virtual bridges vbr1, vbr2 of the first layer. The virtual tunnel vtunnel1 has its interfaces mapped to virtual tunnel end points vtep2, vtep3 of FIG. 10. Likewise, end points 2, 3, connecting to interfaces of the virtual bridges vbr1, vbr3 of the network of the first layer, are mapped to a port of the hypervisor host #2 and to a port of the switch #3.

(33) As a result of the above, the physical network is ultimately expanded, as shown in FIG. 13, into a virtual network having two layers whose corresponding elements are mapped. The user with the VSID: 1 is able to set and manage a network on the basis of a virtual network vtn1-A that is simplified by the virtual tunnel. Likewise, the user with the VSID: 2 is able to set and manage a network on the basis of a virtual network vtn1-B that is simplified by the virtual tunnel. Moreover, in setting or managing the second layer, flow control etc. by VLAN ID may be exercised based on the virtual network vtn1 of the second layer.

Third Exemplary Embodiment

(34) A third exemplary embodiment of the present invention will now be explained in detail with reference to the drawings. FIG. 14 illustrates a configuration of a virtual network of the third exemplary embodiment of the present invention. Since the subject exemplary embodiment may be implemented by a configuration and the manner of configuration about similar to those of the second exemplary embodiment, the following description is centered about the points of difference from the above described second exemplary embodiment.

(35) In an example of FIG. 14, a physical network interconnects two data centers via EoMPLS (Ethernet (registered trademark) over MPLS). The EoMPLS (Ethernet (registered trademark) over MPLS) part is represented, in a virtual network, by a network of a third layer including a virtual switch that exercises control by an MPLS label. In the configuration of a second layer, higher in level than the third level, the network of the third layer is represented by a virtual tunnel, and a virtual bridge or a virtual router is arranged from one domain to another. In the configuration of a first layer, higher in level than the second layer, the network of the second layer is represented by a virtual tunnel and a virtual router is arranged from one domain to another.

(36) According to the present invention, described above, it is possible to simplify the configuration of a virtual network, run in operation by an end user, even in a complex configuration comprised of an interconnection of a plurality of data centers. The reason is that, even if there are a large number of domains and it is necessary to provide a corresponding large number of virtual nodes, these may be arranged as virtual tunnels that do not have to be managed by the end users.

Fourth Exemplary Embodiment

(37) A fourth exemplary embodiment of the present invention will now be explained in detail with reference to the drawings. FIG. 15 illustrates a configuration of a virtual network of the fourth exemplary embodiment of the present invention. Since the subject exemplary embodiment may be implemented by the configuration and the manner of configuration similar to those of the second and third exemplary embodiments, the following description is centered about the points of difference from these exemplary embodiments.

(38) In the example of FIG. 15, slicing is performed in the first to third layers using a physical network including an EoMPLS network and a legacy switch. The virtual network, sliced in a lower layer, is represented as a virtual tunnel in an upper layer, and relevant ones of the virtual tunnel end points and interfaces are mapped one to another.

(39) As described above, the present invention can be applied to such a case where slicing is made in a plurality of layers of, for example, MPLS, VLAN or NVGRE, so that, as in the above described exemplary embodiments, it is possible to simplify the configuration of the virtual network operated by the end user.

(40) It should be noted that, while preferred exemplary embodiments of the present invention are described above, the present invention is not to be restricted to these particular modes, such that further changes, substitutions or adjustments may be made within the range not departing from the basic technical concept of the invention. For example, the configurations of the networks or elements are merely illustrative and are shown to assist in understanding but are not intended to limit the present invention to the mode illustrated.

(41) Also, in the above described exemplary embodiments, it is presupposed that slicing is carried out using VXLAN or NVGRE in the upper layer. However, these are given only as examples and any other suitable system may be used. Moreover, it is presupposed that VLAN or MPLS is to be used in the lower layer as well. These are similarly shown only as examples and any other suitable system may be used.

(42) In the above described exemplary embodiments, it is also presupposed that the network management device includes the network configuration memory and the network configuration management section. However, these may be arranged as separate devices, or may be implemented as respective functions of a control device controlling the physical switches.

(43) Finally, certain preferred modes of the present invention will be summarized.

(44) (Mode 1)

(45) Reference is made to the communication node according to the first aspect.

(46) (Mode 2)

(47) The communication system according to mode 1, further comprising a mapping information memory that stores a relation of correspondence between an identifier for identifying a user in the first layer and another identifier for identifying a user in the second layer, wherein the both identifiers are used so as to perform management so that flow control can be exercised in both the first and second layers.

(48) (Mode 3)

(49) The communication system according to mode 2, further comprising a switch controller that causes a switch on a path to perform the processing of writing the identifier for identifying the user in the second layer in a header based on the identifier that identifies the user in the first layer and that is contained in a user packet.

(50) (Mode 4)

(51) The communication system according to mode 3, wherein, the identifier for identifying the user in the second layer is stored in a preset area of a header that stores the identifier of the first layer.

(52) (Mode 5)

(53) The communication system according to mode 3 or 4, wherein, the identifier for identifying the user in the second layer is stored in a preset area of a second header lying on an inner side of the header storing the identifier of the first layer.

(54) (Mode 6)

(55) The communication system according to any one of modes 1 to 5, wherein,

(56) the network of the second layer showing the area represented by the symbol is associated with the network of the first layer in a one to multiple relation.

(57) (Mode 7)

(58) Reference is made to the virtual network management apparatus according to the second aspect.

(59) (Mode 8)

(60) The virtual network management apparatus according to mode 7, further comprising:

(61) a mapping information memory that stores a relation of correspondence between an identifier for identifying a user in the first layer and another identifier for identifying another user in the second layer, and a network management section that performs management to exercise flow control in both the first and second layers using the both identifiers.
(Mode 9)

(62) The virtual network management apparatus according to mode 8, further comprising

(63) a switch controller that causes a switch on a path to perform a processing of writing the identifier for identifying the user in the second layer in a header based on the identifier that identifies the user in the first layer and that is contained in a user packet.
(Mode 10)

(64) Reference is made to the method for management of the virtual network according to the third aspect.

(65) (Mode 11)

(66) Reference is made to the program according to the fourth aspect.

(67) It is noted that the mode 7 can be expanded to the modes 4 to 6, as in the above mode 1, and that the modes 10, 11 can be expanded to the modes 2 to 6, as in the above mode 1.

(68) The disclosures of the above mentioned Patent Literatures as well as non-Patent Literatures are to be incorporated herein by reference. The exemplary embodiments or Examples may be modified or adjusted within the concept of the total disclosures of the present invention, inclusive of claims, based on the fundamental technical concept of the invention. A wide variety of combinations or selections of elements herein disclosed (elements of claims, Examples and drawings) may be made within the context of the claims of the present invention. That is, the present invention may include a wide variety of changes or corrections that may occur to those skilled in the art in accordance with the total disclosures inclusive of the claims and the drawings as well as the technical concept of the invention. In particular, it should be understood that any optional numerical figures or sub-ranges contained in the ranges of numerical values set out herein ought to be construed to be specifically stated even in the absence of explicit statements. 10, 11 virtual nodes 20, 20A, X20 network management devices 21 network configuration memory 22 network configuration management section 23 mapping information memory 24 switch controller b1 to b4 boundaries vtep1 to vtep3 virtual tunnel end points vbr1 to vbr3 virtual bridges vtunnel1 virtual tunnel