KR20150130729A - Method and apparatus for controlling and verifying network - Google Patents

Abstract

A system for controlling and verifying a network in a network environment in which heterogeneous network devices are interlocked is disclosed. The network control and verification system includes an interface for controlling operations of network devices in the lower hierarchy and the network devices, an application interface for performing communication between the network devices in the lower hierarchy and the network in the upper hierarchy, And a network controller for controlling networking operations between the lower layer network devices and a network for verifying whether an error occurs and whether a normal networking operation can be performed when applying a network setting state set by a user to an actual network through an open interface, And a verification unit.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and apparatus for network control and verification,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to network control and verification, and more particularly, to a structure and a method for easily controlling the operation of a network device while ensuring reliability through software defined by a user

A network device such as a switch provided by a single vendor generally has a data plane that implements various network protocols and a control plane for setting and controlling the network device as one system / RTI > Recently, a software defined network (SDN) separates the control plane and the data plane of a network device and defines an open interface between the control plane and the data plane, thereby enabling mutual interoperation between heterogeneous devices At the same time, the operation of the data plane is also opened to arbitrarily define a path.

The open interface facilitates interworking between heterogeneous devices and enables faster networking innovations. As a result, open interfaces are actively being used in a variety of environments, including data centers and the cloud.

Unlike the advantages of open networking technology, unintentional errors can occur in the process of defining new functions that are made up of large or complex operations using open interfaces. These unintended errors involve the risk of network failure.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a structure and a method for conveniently controlling the operation of a network device while ensuring reliability through software defined by a user.

Another object of the present invention is to provide a structure and a method of a control device and a verification device for reliably defining a network operation and detecting an unintended error in an environment in which heterogeneous equipment interoperates through an open interface will be.

A system for controlling and verifying a network in a network environment in which heterogeneous network devices according to an exemplary embodiment of the present invention are interworked includes a device interface for controlling operations of the network devices and the network devices in a lower layer; An application interface for performing communication between the network devices of the lower layer and a network of an upper layer; A network controller for controlling a networking operation between the upper layer network and the lower layer network devices; And a network verifying unit verifying whether an error occurs and whether a normal networking operation is possible when the network setting state set by the user through the open interface is applied to an actual network.

According to an exemplary embodiment, the upper layer network may include network virtualization, object internet applied to small devices, and network applications.

According to one embodiment, the verification unit includes an intra-domain verification unit that verifies an attribute of a partial network controlled by a specific NOS (Network Operating System) or a specific network device; And an inter-domain verification unit for performing verification of network attributes related to at least one or more domains in the network of the higher layer.

According to one embodiment, the network control and verification system includes a network status base that stores information related to network status and network equipment status currently managed in a Network Operating System (NOS); A distributed processing module that is required for network control and verification operations, and configures an upper domain for processing network control and verification operations by connecting domains for a network device distributed on a network and applications; And a policy management module that defines a network policy and applies the defined network policy to the network settings.

According to one embodiment, the open interface may be implemented via a Software Defined Network.

The present invention relates to an open interface based user or software defined network environment such as a software defined network (SDN) and Internet of Thing (hereinafter referred to as "IoT"), By complementing the disadvantages that can not be provided by the current software defined network technology while maintaining the advantages of a user or software definition network in which heterogeneous devices are linked through an open interface, It has the effect of greatly increasing the utilization and dependence of software defined networks.

1 is a diagram illustrating an overall structure and an application example of a network control and verification system according to an embodiment.
2 illustrates a specific structure of a network control and verification system according to one embodiment.
3 illustrates a network control and verification system applied to a network virtualization application, such as the cloud, according to one embodiment.
4 shows a network control and verification system applied to a network for a small device, such as the Internet of Things (IoT), according to one embodiment.
Fig. 5 is a diagram showing a structure for controlling the small device of Fig. 4;

The terms used in this specification will be briefly described and the present invention will be described in detail.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Also, in certain cases, there may be a term selected arbitrarily by the applicant, in which case the meaning thereof will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term, not on the name of a simple term, but on the entire contents of the present invention.

When an element is referred to as "including" an element throughout the specification, it is to be understood that the element may include other elements as well, without departing from the spirit or scope of the present invention. Also, the terms "part," " module, "and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

1 is a diagram illustrating an overall structure and an application example of a network control and verification system according to an embodiment.

Referring to FIG. 1, a network control and verification system 100 includes a network control device 110, a network verification device 120, an application interface 130, and a device interface 140. The network control and validation system 100 may provide a network configuration state set by the user via an open interface such as SDN in a network and network application 180 such as the Internet of objects applied to the network virtualization 160, It can verify errors that may occur when applied to a network.

Network virtualization 160 represents an application that is applied in an environment such as a cloud or a data center. The network control and verification system 100 can verify whether an error occurs and normal networking operations are possible when performing connection and control between the virtual network and the real network.

The small device 170 represents an application in which a network function is enhanced in a device such as a home appliance, a smart phone, a car, or a home network, which is used in real life such as Internet (IoT). The network control and verification system 100 can be applied to connect a plurality of devices to be managed by a user, such as IoT, to a network, and to prevent an error occurring during a linking process between a plurality of devices.

The network application 180 represents applications that are primarily applied in existing network environments such as routers, firewalls, and VPNs (Virtual Private Networks). Unlike the network environment applied to the network virtualization 160 and the small appliance 170, the network application 180 represents a widely used network environment.

The network virtualization 160, the small appliance 170, and the network application 180 commonly use the components provided by the network control and verification system 100, as shown in FIGS. 2 to 5, And the detailed modules used may be different.

Network device 150 may be any programmable network device, such as a programmable switch. The network device 150 may be an IP or non-IP based wired network device, a wireless network such as Wifi or LTE, a small wireless network device such as Bluetooth or Zigbee, In addition, functions of L3 and above can be added / deleted by programming. The network device 150 communicates with other modules via a network, and may use existing Internet / Intranet or self-defined communication technologies.

The device interface 140 controls the network devices 150 and connects the network device 150, which is an upper layer application and lower layer devices. The control method and protocol dependent on the network device 150 are processed by referring to the information and functions provided by the network control device 110.

The control protocol 111 of the network control apparatus 110 and the interface conversion apparatus 112 perform an interface and protocol conversion operation when the interface and protocol of the network device 150 which are the upper layer application and the lower layer devices are different Thereby enabling the networking operation between the application of the upper layer and the network device 150 of the lower layer.

The network verifier 120 may be configured to allow the user to interact with the network virtualization 160 via an open interface such as SDN in a network and network application 180 such as the object Internet applied to the network virtualization 160, It is possible to verify the error that may occur when the set network setting state is applied to the actual network.

Although the network control apparatus 110 and the network verification apparatus 120 are logically represented as one system, the network control apparatus 110 and the network verification apparatus 120 can be configured as a plurality of distributed nodes through the distributed processing module 192 and can be performed.

The application interface 130 may also be referred to as an " Open API "as an open application interface part. The application interface 130 communicates between the network and network applications 180, such as the object internet, applied to the network virtualization 160, the handheld device 170, and the standard network stack required for such communication Can be performed.

The network status database 191 may store information related to network status and network equipment status currently managed by a Network Operating System (NOS). For example, values such as topology information, link state information, flow rules, other statistical information, current attributes, and the like are stored in the network state database 191. The network state database constructs data structures and operations based on graph types optimized for network state and network device state. The network state database ensures consistency even when multiple nodes are accessed in a distributed manner through the distributed processing module. Information that is frequently used and that should guarantee a fast response speed can be stored and managed in the form of an in-memory database of key-value pairs.

The distributed processing module 192 functions to combine information on network devices and applications distributed on the network, which are necessary for control and verification, into one consistent information. Devices and applications connected to the network are composed of separate domains for efficiency and scalability, and the result of combining all these domains can represent the state of the entire network. The distributed processing module 192 constitutes one upper domain for processing the control and verification tasks by connecting these domains. It analyzes the operations to perform control and verification, distributes them to several sub-domains, combines the results of independent operations in each sub-domain, and outputs the results of the parent domain configured for control and verification .

The policy management module 193 defines a new policy and reflects the policy in the network configuration. When a specific policy is created in the network setting, the policy is managed in an intermediate language provided by the network verification apparatus 120 or the like to verify the policy attribute, and the verified attribute is utilized in defining a new policy. When processing a virtual network or an application unit in which different domains are woven together and processing an NOS-related operation, the related policy can be defined, verified, and inquired through the policy management module 193. At the same time as the virtual network and the external domain are opened, the related policy can be defined, verified, and inquired through the policy management module 193.

2 illustrates a specific structure of a network control and verification system according to one embodiment.

Network devices may be referred to as programmable switch 240. Programmable switch 240 refers to all networking devices whether IP based or wired or wireless. In addition to the existing L2 switch, functions of L3 and above can be added / deleted by programming. Between the programmable switch 240 and another module on the network, communication can be generally performed using the existing Internet / Intranet, or communication can be performed by applying a self-defined communication technology in some cases.

Programmable switch 240 and a variety of service applications are described as an app. An app can have a variety of forms ranging from simple learning switches to firewalls and load balancing. The application can be divided into a remote application (250) and a native application (260). The remote application 250 does not operate directly on a control device called a NOS (Network OS) 210 that performs a function of a control plane but uses an application that uses the network function in a standard-based remote procedure call method such as REST API . Native application 260, on the other hand, operates directly in conjunction with NOS 210, and the implementation language is also dependent on NOS 210. The remote application 250 and the native application 260 perform the same functions except for the interworking method.

The NOS (Network OS) 210 is a module for controlling network equipment and its operation, and includes a core module 211 for connecting an upper application and a lower layer programmable switch 240, and a network database 212).

The core module 211 is a module for processing a standard protocol necessary for controlling a network device, and provides Internet protocol including IP and network control protocol such as OpenFlow.

The network database 212 is a database storing the statuses of all the network devices controlled by the NOS 210. The network database 212 is referred to not only in the NOS 210 but also in the upper application and the verifiers 220 and 230. Currently, the network and equipment status managed by NOS is stored in a database module, and stores values such as topology information, link status information, flow rules, other statistical information, and current attributes. Information that is frequently used and has a fast response speed can be implemented as an in-memory database of key-value pairs, a graph-based database for network topology information processing, You can also use a non-SQL based database.

The network verification unit is divided into an inter-domain verification unit 230 and an intra-domain verification unit 220. The inter-domain verification unit 230 performs verification from the viewpoint of the entire network, and the intra-domain verification unit 220 verifies the attributes of the partial network controlled by the specific NOS or the specific network device. Here, a domain represents a management entity or a unit for managing a physical network and a network equipment as a policy. For example, a company's entire network can be a domain. In addition, a company's entire network can be divided into multiple domains by building or floor. In addition, domains may be classified at various policy levels, including service providers or billing. Accordingly, the inter-domain verification unit 230 operates over a plurality of domains that can be managed by the current user, and the intra-domain verification unit 220 operates solely for the current domain. When operating across multiple domains, they must be validated through the policy manager and the verification department of each domain.

The intra-domain verification unit 220 and the inter-domain verification unit 230 are composed of three modules such as a policy management unit 221, a search graph 222, and a conversion unit 223.

The policy management unit 221 reflects a specific policy at the time of network setting. The reflected policy is used to verify the attribute or define a new policy by managing the intermediate language provided by the verification units 220 and 230 and the conversion unit 223. In particular, when processing virtual networks, apps, and NOS-related calculations related to different domains, policy definition, verification, and inquiry functions are processed through the policy management unit 221. The policy management unit 221 may also provide related functions for the virtual network and the external domain interworking.

The conversion unit 223 is responsible for a format that expresses settings or commands transmitted from an upper layer and a format for internally managing information for verification and control.

The search graph 222 is a data structure for performing a specific verification process and provides various verification algorithms. This data structure reflects the characteristics of network and virtualization applications, small appliances and applications, and the communication protocols used by them, and has an optimized structure for verification, but it is configured in a form independent of specific devices, applications, and protocols.

The inter-domain verification unit 230 performs verification of a function or an attribute defined in the application or an upper layer, as opposed to the NOS 210 or the intra-domain verification unit 220 operating at the network device level. For example, when a match-action rule is input for a specific OpenFlow switch through an application, the interdomain verification unit 230 may generate an infinite loop or a black hole in the structure specified by the application, . If the attribute to be verified is related to the NOS internal state, the function provided by the intra-domain verification unit 220 may be used. Unlike the inter-domain verification unit 230, the inter-domain verification unit 230 is connected to a remote procedure call interface such as REST, and is interlocked with a specific NOS in an independent manner. Accordingly, the inter-domain verification unit 230 may process the verification operation in a manner independent of the specific programming that implements the application or the NOS. To this end, the inter-domain verification unit 230 verifies a specific input language and a remote It also provides the function of mutual conversion in the form of procedure call.

3 illustrates a network control and verification system applied to a network virtualization application, such as a cloud system, in accordance with one embodiment.

The first network control and verification system 315 may occur when the upper layer virtual network management module 310 applies the setting to the lower physical network state when performing the setting operation for the virtual network through SDN or the like Verify the error.

The first network control and verification system 315 receives the settings and requirements of the upper layer from the plug-in provided in the network virtualization environment, the platform independent REST type API, the interface depending on the network device, Verifies key attributes by retrieving detailed information from the actual network management module.

The second network control and verification system 320 collects information directly from the actual network device or verifies the attribute within the partial network range based on the information collected from the network controller

The first network control and verification system 315 performs verification for the entire network in the upper layer and the second network control and verification system 320 performs the verification for the entire network in the upper layer, And the first network control and verification system 315 and the second network control and verification system 320 may operate in cooperation with each other as needed.

The first network control and verification system 315 focuses on overall structural attribute inspection rather than speed, and the second network control and verification system 320 performs real-time inspection of the underlying error in the lower layer.

4 shows a network control and verification system applied to a network for a small device, such as the Internet of Things (IoT), according to one embodiment.

Small devices to which the Internet (IoT) is applied may be different from other network applications in that the network control and verification system 420 according to the embodiment of the present invention is not fixed, Do. Therefore, in order to control and verify a network for small devices such as the Internet, a network control and verification method different from the network control and verification method of FIG. 3 described above is required.

IoT device 410 can control devices having various interfaces such as automobile, home network, home appliance, and smart device through wireless communication technology such as Wifi, Bluetooth and Zigbee. At this time, control interfaces, operations, and attributes for various devices connected to the IOT device 410 are stored in separate databases. When the network control and verification system 420 finds the corresponding devices, You can import the module through. The specific communication protocol used in the device connected to the IoT device 410 is processed through the communication interface module, converted to protocol neutral, and then verified through the same method as the above-described FIG. 1 and 2 have.

Fig. 5 is a diagram showing a structure for controlling the small device of Fig. 4;

Referring to FIG. 5, a small device (IoT device) is controlled in such a manner that three modules, such as a device module 510, a browser module 520, and a server module 530, interlock with each other.

The device module 510 is a module for managing the properties of the small device and can be divided into a local device and a remote device depending on whether the network control and verification system 420 is directly connected or not. In addition, the device module 510 can be divided into a sensor and an actuator according to device attributes. In addition, the device module 510 may be classified into a public device and a private device according to an access right.

The local device may be directly connected to the network control and verification system 420 to directly control the small device (IoT device), and the remote device indirectly controls the small device (IoT device) through a separate control module. Even the same device can be switched between local and remote depending on its position and status.

A sensor is a device that reads data, and an actuator can perform a specific write operation to a device that can write data. Both attributes may be present according to device 510.

Public devices are shared with other users or control modules, and private devices can only be accessed by users. The network control and verification system 420 performs the verification by referring to the access control rules when verifying the access procedure of the public device and the private device. The network control and validation system 420 blocks access to the device 510 if it is beyond the scope of an unauthorized user or share.

The browser module 520 serves as an interface between the user and the control module and provides the user with the property information for the device 510 and a module for controlling the device 510.

The browser module 520 provides a list of devices that are controllable at their current location and status, and provides the status and control interface of each device.

Upon discovering a particular IoT device in the network control and verification system 420 of the present invention, the network control and verification system 420 requests the information from the server module 530 and delivers it to the browser. This information includes device information and a device control interface. The server module 530 and the information contained therein may be comprised of a primary server module configured directly in the network control and verification system 420 and a secondary server module provided by the manufacturer of the apparatus 510.

Device information includes device name and location, user or share status, and status. The device control interface provides the specific instructions necessary to operate the device. For example, on / off of camera direction, On / Off and strategy usage measurement command in case of electrical outlet, and commands for operating the device in case of home appliance, can be controlled through the device control interface.

When a user accesses a specific device through the browser module 520, the specific device can be controlled within a range that does not deviate from the access and operation rights to the device stored in the server module 530. The user can not perform any operations beyond the privileges and rules defined in the server.

The self-defined rules (access rights, etc.) for each device are processed through the intra-domain verification unit 220 of the lower layer described in FIGS. 2 and 3, and the overall structural verification in which all currently controllable devices are connected The inter-domain verification unit 230 of the higher layer described in FIG. 2 and FIG.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (5)

A system for controlling and verifying a network in a network environment in which heterogeneous network devices are interlocked,
A device interface for controlling operations of the network devices of the lower layer and the network devices;
An application interface for performing communication between the network devices of the lower layer and a network of an upper layer;
A network controller for controlling a networking operation between the upper layer network and the lower layer network devices; And
And a network verifying unit for verifying whether an error occurs and whether a normal networking operation is possible when the network setting state set by the user through the open interface is applied to an actual network. The method according to claim 1,
The upper layer network
Network virtualization, objects applied to small appliances, Internet and network applications. The method according to claim 1,
The verification unit
An intra domain verification unit for verifying an attribute of a partial network controlled by a specific NOS (Network Operating System) or a specific network device; And
And an inter-domain verification unit that verifies network attributes related to at least one or more domains in the network of the higher layer. The method according to claim 1,
A network state base for storing information related to a network state and a network equipment state managed by a NOS (Network Operating System);
A distributed processing module that is required for network control and verification operations, and configures an upper domain for processing network control and verification operations by connecting domains for a network device distributed on a network and applications; And
Further comprising a policy management module that defines a network policy and applies the defined network policy to the network settings. The method according to claim 1,
Wherein the open interface is implemented via a software defined network.

Images