WO2012029409A1

WO2012029409A1 - A control apparatus, a communication system, a communication method and a recording medium having recorded thereon a communication program

Info

Publication number: WO2012029409A1
Application number: PCT/JP2011/065645
Authority: WO
Inventors: Shuji Ishii
Original assignee: Nec Corporation
Priority date: 2010-09-03
Filing date: 2011-07-01
Publication date: 2012-03-08
Also published as: JP2013539246A; RU2013114830A; US9531566B2; EP2612468A4; JP5846199B2; US20130144995A1; EP2612468A1; RU2576492C2; CN103081415A; CN103081415B; BR112013005060A2

Abstract

[Technical Problem] There is a limitation in the number of identifiers for a virtual network, and it is difficult to establish a large scale network using the virtual network. [Solution to Problem] A control apparatus for controlling packet transfer between terminals belonging to a first virtual network identified by a first identifier comprising: a network configuration information management means for holding configuration information on a second virtual network identified by a second identifier so that the terminals belong to the second virtual network; and a path control means for controlling communication between the terminals based on the configuration information on the second virtual network.

Description

DESCRIPTION

Title of Invention

A CONTROL APPARATUS, A COMMUNICATION SYSTEM, A COMMUNICATION METHOD AND A RECORDING MEDIUM HAVING RECORDED THEREON A COMMUNICATION PROGRAM

Technical Field

The present invention relates to a control apparatus provided in a network for performing communication , a communication system , a communication method and a recording medium of which a communication program recorded .

Background Art

I n recent years , with surging traffic in a commun ication network and growing number of services performed in the network, a lot of technologies for establishing a virtual network additionally in the communication network have been developed . There is a VLAN (Virtual Local Area Network) disclosed in the non patent literature 1 as one of typical methods for establishing such a virtual network.

In a network in which a plurality of servers are connected like a large-scale data center, virtualization is generally realized using a VLAN-I D which is an identif ier of each VLAN in addition to an I P (I nternet Protocol ) address for each usage of the server. By this virtual ization , a network is designed so as not to be inf luenced in communication even if an identical I P address is used among a plurality of servers .

However, there is a limitation in the number of VLAN-I D to be allocated , and its number is at most 4,096. When a VLAN is used in a large-scale network, if the VLAN-I D is assigned for each I P address of a server by a method as mentioned above , the number of VLAN- I D becomes insuff icient. As a result, there is a problem that sufficient number of the virtual networks cannot be provided . Technology for solving such problem is disclosed in the patent literature 1. In the patent literature 1, a VLAN domain ID which is another identifier different from the VLAN-ID described in the non patent literature 1 is newly proposed. In the patent literature 1, it describes a technology that a switching hub identifies a VLAN to which a received frame belongs, by combining the VLAN domain ID and the VLAN-ID.

In the patent literature 2, it describes a technology that a source MAC (Media Access Control) address is stored in a MAC address learning table associated with VLAN tag information when a packet has been received.

[Citation List]

[Patent Literature]

[Patent Literature 1] Japanese Patent Application Laid-Open No. 2003-318937

[Patent Literature 2] Japanese Patent Application Laid-Open No. 2006-311066

[Non Patent Literature]

[Non Patent Literature 1 ] IEEE Standard 802.1 Q. -2005 and IEEE Standard for Local and metropolitan area networks -Virtual Bridged Local Area Networks

[Non Patent Literature 2] OpenFlow Switch Specification Version 1.0.0 (Wire Protocol 0x01), December 31, 2009, [searched on July 20, 2010], the internet

<URL:http: //www. openflowswitch.org/documents/openflow-spec-v1.0.0. pdf>

Summary of Invention

[Technical Problem]

As mentioned above, the technology described in the patent literature 1 has tried to avoid a limitation in the number of VLAN-ID by combining the existing VLAN-ID and newly provided VLAN domain ID.

However, as the technology described in the patent literature 1 provides a f ield for the VLAN domain I D in a frame, it also has a limitation in the number of VLAN domain I D , and it still unchanged that there exist a lim itation in the number of the virtual network to be provided when a large-scale network is established .

The object of the present invention is to provide a control apparatus , a communication system , a communication method and a recording medium having recorded thereon a communication program which are capable of solving the problem mentioned above .

[Solution to Problem ]

A control apparatus for controlling packet transfer between terminals belonging to a f irst virtual network identif ied by a f irst identif ier comprising : a network conf iguration inf ormation management means for holding configuration information on a second virtual network identif ied by a second identifier so that the terminals belong to the second virtual network; and a path control means for controlling communication between the terminals based on the conf iguration information on the second virtual network.

A communication system comprising : a terminal which belongs to a f irst virtual network identif ied by a f irst identifier; and a control apparatus for controlling packet transfer between the terminals ; wherein the control apparatus including : a network conf iguration information management means for holding configuration information on a second virtual network identified by a second identif ier so that the term inals belong to the second virtual network; and a path control means for controlling communication between the terminals based on the conf iguration information on the second virtual network.

A commun ication method for controlling packet transfer between terminals belonging to a f irst virtual network identif ied by a first identif ier, comprising : controlling commun ication between the terminals so that the terminals belong to a second virtual network identif ied by a second identifier based on configuration information on the second virtual network which is held in a network configuration information management means.

A recording medium having recorded thereon a communication program for causing a computer to execute a process of controlling packet transfer between terminals belonging to a first virtual network identified by a first identifier, comprising: a path control process for controlling communication between the terminals so that the terminals belong to a second virtual network identified by a second identifier based on configuration information on the second virtual network which is held in a network configuration information management means.

[Advantageous Effects of Invention]

According to the present invention, it is possible to establish a large scale network using a second virtual network in spite of the limitation in the number of identifier of the virtual network.

Brief Description of Drawings

[Fig. 1 ] is a block diagram showing the configuration of the first exemplary embodiment.

[Fig. 2] is a figure showing the composition of the network configuration information table 101.

[Fig. 3] is a figure showing the composition of the forwarding table 112. [Fig. 4] is a flowchart showing operation of the first exemplary embodiment.

[Fig. 5] is a flowchart showing operation of the first exemplary embodiment.

[Fig. 6] is a block diagram showing the configuration of the second exemplary embodiment.

[Fig. 7] is a figure showing the composition of the network configuration information table 201.

[Fig.8] is a block diagram showing the composition of the third exemplary embodiment. [Fig. 9] is a figure showing the composition of the network configuration information table 301.

[Fig. 10] is a figure showing the composition of the flow table 312.

[Fig. 11] is a flowchart showing operation of the third exemplary embodiment.

[Fig. 12] is a flowchart showing operation of the third exemplary embodiment.

[Fig. 13] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 14] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 15] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 16] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 17] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 18] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 19] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 20] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 21] is a figure showing a specific example of the third exemplary embodiment.

[Fig. 22] is a block diagram showing the configuration of the fourth exemplary embodiment.

[Fig. 23] is a block diagram showing the outline of the first exemplary embodiment. Description of Embodiments

Hereinafter, the exemplary embodiments of the present invention will be described in detail with reference to the drawings.

<First exemplary embodiment

(OUTLINE)

First, the outline of the first exemplary embodiment will be described below with reference to Fig. 23. Fig. 23 is a block diagram showing an exemplary system configuration according to the first exemplary

embodiment. The system of Fig.23 includes a controller 100, a switch 110, a switch 120, a terminal 130, a terminal 131, a terminal 140 and a terminal 141. The terminal 130 and the terminal 140 belong to a virtual network (NW) 1. The terminal 131 and the terminal 141 belong to NW2. Hereinafter, the virtual network NW is called as "NW".

The controller 100 manages communication performed in the system. The controller 100 includes a network configuration information management unit 101, a search unit 102 and a path control unit 103. Details about the configuration and operation of each unit will be described later.

The switch 110 and the switch 120 send packets communicated between each terminal according to a set processing rule. The terminal 130 and the terminal 131 are connected to the switch 110, and the terminal 140 and the terminal 141 are connected to the switch 120 respectively, and each terminal communicates among them.

According to the first exemplary embodiment, the controller 100, which controls communication between terminals belonging to a VLAN, holds configuration information on a NW in the network configuration information management unit 101 so that each terminal may belong to a virtual network NW which is a different network from the VLAN. Also, the controller 100 controls communication between terminals based on the configuration information on a NW.

NW1 and NW2 are different virtual networks from above-mentioned VLAN. Establishment of a virtual network, having been realized by a VLAN, is now realized by this NW and a virtual network NW-ID which is an identifier of the NW.

Each terminal belongs to a NW and a VLAN and has both identifiers (IDs). As the terminal 130 belongs to the NW1 and the VLAN1 , the NW-ID is 1 and the V LAN-ID is 1. Similarly, the terminal 131 belongs to the NW2 and the VLAN2, the terminal 141 belongs to the NW1 and the VLAN2 and the terminal 142 belongs to the NW2 and the VLAN1 respectively. The NW1 is indicated by a dotted line and the NW2 is indicated by a broken line respectively in Fig. 23.

Although a VLAN-ID is assigned to each terminal, it is not used for establishing a virtual network, but it is used as an identifier for identifying each terminal. More specifically, in a network configuration information table 101 shown in Fig. 2, each terminal is identified by combination of an identifier of a terminal, as represented by a MAC address, and a VLAN-ID.

Accordingly, because of the identical NW-IDs, it is possible to

communicate between the terminal 130 and the terminal 140 having different VLAN-ID each other. Setting of this communication is performed by the controller 100 which holds the configuration information on a NW. Hereinafter, the first exemplary embodiment will be described in detail with reference to Figs. 1 to 5.

(CONFIGURATION)

The configuration of the first exemplary embodiment will be described with reference to Fig. 1. Fig. 1 is a block diagram showing the system configuration according to the first exemplary embodiment.

According to Fig. 1, the system of the first exemplary embodiment includes a controller 100, a switch 110, a switch 120, a terminal 130 and a terminal 140.

Further, although a case of four terminals has been exemplified in the above-mentioned outline description (Fig. 23) of the first exemplary embodiment, hereinafter, for the sake of simplicity, a case of two terminals as a number of terminals will be described.

The controller 100 includes a network configuration information table 101, a search unit 102 and a path control unit 103. The controller 100 is an apparatus which manages the switch 110, the switch 120, the terminal 130 and the terminal 140.

The network configuration information table 101 is a table which holds information on terminals (the terminal 130 and the terminal 140) in the network which is under the control of the controller 100. Detailed

description will be made later in Fig. 2.

Based on information on a packet (hereinafter, "a received packet") which each switch has received, the search unit 102 searches for a VLAN-ID to which a destination terminal of the received packet belongs from the network configuration information table 101.

The path control unit 103 takes out a list of switches which belong to the same network as a source terminal or a destination terminal of the received packet from the network configuration information table 101. Next, a processing rule (an entry) is set to the switch taken out so that

communication between the source terminal and the destination terminal of the received packet may become possible.

The switch 110 includes a packet transfer unit 111 and a forwarding table 112. Similarly, the switch 120 includes a packet transfer unit 121 and a forwarding table 122.

The packet transfer unit 111 searches for the received packet whether there is a processing rule corresponding to the received packet in the forwarding table 112. When there is a corresponding processing rule, a processing is performed with reference to a content of processing indicated in the processing rule. For example of the content of processing, there is a processing such as sending the packet to the switch 120 via a specific port (not shown in the figure), discarding the packet, rewriting a header of the packet or broadcasting the packets. When a processing rule corresponding to the received packet is not indicated in the forwarding table 112, the packet transfer unit 111 inquires the controller 100 how the processing is to be performed.

The forwarding table 112 stores information, which correlates the contents of information (a header) on the received packet of the switch 110 to a content of processing according to the header of the received packet, in one entry as a processing rule. As mentioned above, the packet transfer unit 111 performs a processing according to this processing rule for the received packet. Detailed description will be made later in Fig. 3.

Further, because the packet transfer unit 121 and the forwarding table 122 of the switch 120 are similar to the packet transfer unit 111 and the forwarding table 112 of the switch 110, the description for them will be omitted. Although the number of switches shown in Fig. 1 is two, it is not limited to this and it operates similarly even in a case of equal to or more than three.

The terminal 130 performs packet communication with the terminal 140. Similarly, the terminal 140 performs packet communication with the terminal 130. Henceforth, although it will be described as the packet communication is to be performed in a direction from the terminal 130 to the terminal 140, it is not limited to this and it operates even in a case of an opposite direction.

Fig.2 is a figure showing details of the network configuration information table 101. The network configuration information table 101 includes network configuration information entries 101-1 and 101-2 or the like. Each of the network configuration information entries holds information on a terminal in the network which the controller 100 manages. Accordingly, the network configuration information table 101 holds as many network configuration information entries as the number of terminals, N.

A network configuration information entry includes a VLAN-ID, a MAC address, a NW-ID which is an identifier for identifying a NW and a switch list. Hereinafter, the network configuration information entry 101-1 will be described as an example. The network configuration information entry 101-1 corresponds to the terminal 130 in Fig. 1. An identifier of the VLAN to which the terminal 130 belongs is stored in the "VLAN-ID". A MAC address which is a specific identifier of the terminal 130 is stored in the "MAC address". Further, according to the first exemplary embodiment, although a MAC address is used as a specific identifier of a terminal, it is not limited to this. For example, an IP address can be used.

An identifier of the NW to which the terminal 130 belongs is stored in the "NW-ID". Further, as the NW-ID, for example, a network address which is expressed by using a front half part of an IP address assigned to each terminal or an SSID (Service Set Identifier) or the like which is an identifier of a wireless LAN (Local Area Network) is mentioned. As far as it is different from an ID of the VLAN which is a virtual network, it is not limited to these and new identifiers can be set and used.

Finally, a list of the switches belonging to the NW to which the terminal 130 belongs is stored in the "switch list". In the example of Fig. 2, the switch 110 and the switch 120 are stored. This switch list is generated from information on each switch (a VLAN-ID, a MAC address and a NW-ID) that the controller 100 has collected. As other composition of the switch list, for example, a list of switches that exist on a calculated route obtained by calculating a transfer route of the received packet can be stored.

The switch list is not indispensable to the network configuration information table 101. It is also possible that information on the switches controlled by the controller 100 is collected whenever the network configuration information table 101 is searched by the search unit 102 or the path control unit 103, and use the information temporarily.

Fig. 3 is a figure showing details of the forwarding table 112. The forwarding table 112 includes forwarding table entries 112-1 and 112-2 or the like.

As mentioned above, the forwarding table entry indicates the processing rule, in which the processing to be performed for a header of the received packet of the switch 110 is written down. As the contents of the forwarding table entry, a VLAN-ID, a source MAC address, a destination MAC address, a content of process, an input port and an output port are included. Here, some among information indicated in a header of the received packet of the switch 110 are treated as the search keys when a search for the forwarding table 112 is performed. For example, it is possible that the VLAN-ID, the source MAC address and the destination MAC address are used as the search keys. The same processing will be performed to a packet defined by the same search key.

(OPERATION)

Next, operation of the first exemplary embodiment will be described in detail with reference to Fig.4 and Fig.5. As mentioned above, a case where communication is performed in a direction from the terminal 130 to the terminal 140 of Fig. 1 will be described. Fig. 4 is a flowchart showing operation of the switch 110. Fig. 5 is a flowchart showing operation of the controller 100.

First, operation of the switch 110 will be described with reference to Fig. 4. The switch 110 receives a packet from the terminal 130 (Fig. 4: Step S1001 ). Next, the packet transfer unit 111 refers to the forwarding table 112 and determines whether a forwarding table entry corresponding to the received packet exists (Fig. 4: Step S1002).

When it is determined that the forwarding table entry corresponding to the received packet exists in Step S1002, Step S1003 is performed. The packet transfer unit 111 deals with the received packet according to a content of process and an output port or the like indicated in the corresponding forwarding table entry (Fig. A- Step S1003).

When it is determined that the forwarding table entry corresponding to the received packet does not exist in Step S1002, Step S1004 is performed. The packet transfer unit 111 sends a packet received message, which inquires for a report that it has received a packet for which a processing rule is unknown, to the controller 100. This packet received message includes information about the received packet including the header. Accordingly, it is also possible to send the received packet just as it is instead of the packet received message.

After Step S1004 has been performed, the controller 100 performs operation shown in Fig. 5. Hereinafter, operation of the controller 100 will be described with reference to Fig. 5.

First, the controller 100 receives the packet received message from the switch 110. (Fig. 5: Step S1005).

Next, the search unit 102 searches for whether a NW-ID corresponding to a source terminal (terminal 130) of the received packet exists from the network configuration information table 101 (Fig. 5: Step S1006). More specifically, the search unit 102 searches for the corresponding NW-ID using a VLAN-ID and a source MAC address of the received packet as the search keys.

When the NW-ID corresponding to the source terminal of the received packet does not exist in the network configuration information table 101 in Step S1006, it orders the switch 110 to discard the received packet (Fig.5: Step S1007). When the controller 100 is receiving the received packet itself, not the packet received message, the controller 100 discards the received packet.

When the NW-ID corresponding to the source terminal of the received packet exists in the network configuration information table 101, and has been searched in Step S1006, Step S1008 is performed. The search unit 102 searches for whether there is a VLAN-ID corresponding to the destination terminal (terminal 140) of the received packet from the network

configuration information table 101 (Fig.5: Step S1008). More specifically, a destination MAC address of the received packet and the NW-ID having been searched in Step S1006 are used as the search keys for searching the corresponding VLAN-ID.

When the VLAN-ID corresponding to the destination terminal of the received packet does not exist in the network configuration information table 101 in Step S1008, it orders the switch 110 to discard the received packet (Fig. 5: Step S1009). When the controller 100 is receiving the received packet itself, not the packet received message like Step S1007, the controller 100 discards the received packet.

When the VLAN-ID corresponding to the destination terminal of the received packet exists in the network configuration information table 101, and has been searched in Step S1008, Step S1010 is performed. First, the path control part 103 searches for the switch list corresponding to the terminal (destination terminal), which has been found when the VLAN-ID was searched in Step S1008, from the network configuration information table 101. In the first exemplary embodiment, it is supposed that the switch 110 and the switch 120 are indicated. After that, an entry rewriting message is sent to each switch that is indicated in the searched switch list (Fig. 5: Step S 1010) . This entry rewriting message is an order to newly add an entry corresponding to the received packet to each entry of the forwarding table 112 of the switch 110 and the forwarding table 122 of the switch 120. The entry rewriting message includes a header (a VLAN-ID, a source MAC address and a destination MAC address) of the received packet, a content of process corresponding to the header, an input port and an output port. The entry rewriting message will be described more in detail. To either of the switch 110 or the switch 120, the VLAN-ID of an entry which is to be newly added is rewritten by the VLAN-ID which has been searched in Step S1008. To the other switch of the switch 110 or the switch 120, the processing, which rewrites the VLAN-ID indicated in a header of the received packet by the VLAN-ID which has been searched in Step S1008 when the switch receives the corresponding packet, is set as a content of process. Further, when there are more than three switches, the entry rewriting message which is the same as message for the switch 120 may be sent to the switch to which the processing rule should be set other than the switch 120.

Finally, the controller 100 issues an instruction for sending the received packet to the destination terminal (terminal 140) to the source switch (the switch 110) of the entry rewriting message. When the controller 100 is receiving the received packet just as it is, not the packet received message, the received packet may be sent directly to the destination terminal (terminal 140) of the received packet (Fig. 5: Step S 1011 ) .

(EFFECTS)

As described above, in the first exemplary embodiment, the controller 100 controls communication between terminals by holding configuration information so that a terminal, which belongs to a VLAN, may belong to a NW which is a different virtual network from the VLAN. By this configuration, this embodiment has the following effects;

(1) As far as the terminals belong in the same NW, it is possible to communicate between the terminals in which a VLAN-ID is different with each other. For example, each of the terminal 130 and the terminal 140 shown in Fig. 23 has different VLAN-ID, but they have an identical NW-ID. Even when communication between the terminal 130 and the terminal 140 is not established, it becomes possible to perform communication in the NW by control of the controller 100.

(2) An identical VLAN-ID can be used by a plurality of terminals, as far as the NW is different. For example, the terminal 131 and the terminal 140 shown in Fig.23 have the identical VLAN-ID "2". Because the terminal 131 and the terminal 140 belong to the different NW respectively, it does not communicate each other unless the NW configuration is changed. Therefore, the terminal 131 and the terminal 140 can hold the identical VLAN-ID. As it has been described by (1) and (2) above, establishment of a virtual network does not depend on a VLAN and a VLAN-ID because a NW and a NW-ID are used. Accordingly, the problem of number restriction of VLAN-ID can be eliminated. Because a VLAN-ID is not used for establishing a virtual network, a VLAN-ID can be used for multiplexing of a NIC (Network

Interface Card) provided in each terminal.

<Second exemplary embodiment

(OUTLINE)

Next, the second exemplary embodiment of the present invention will be described in detail with reference to Fig.6 and Fig.7. A difference between the second exemplary embodiment and the first exemplary embodiment is in the information used by the controller at the time of searching for a NW-ID in which a source terminal of the received packet of the switch (Fig.5: Step S1006) and in the information used at the time of searching for a VLAN-ID to which a destination terminal of the received packet belongs (Fig.5: Step S1008).

(CONFIGURATION)

Fig. 6 is a block diagram showing the configuration of the system of the second exemplary embodiment. The system according to the second exemplary embodiment includes a controller 200, a switch 210, a switch 220, a terminal 230 and a terminal 240.

The controller 200 includes a network configuration information table 201 , a search unit 202 and a path control part 203.

The switch 210 includes a packet transfer unit 211 and a forwarding table 212. Similarly, the switch 220 includes a packet transfer unit 221 and a forwarding table 222.

Further, because the configuration except for the network configuration information table 201 of the controller 200 is the same as that of the first exemplary embodiment, the description will be omitted here.

Hereinafter, the network configuration information table 201 will be described with reference to Fig. 7. Fig. 7 shows a detailed composition of the network configuration information table 201.

The network configuration information table 201 includes network configuration information entries 201 -1 and 201 -2 or the like. Each network configuration information entry holds information on a terminal in the network controlled by the controller 200. Accordingly, the network configuration information table 201 holds as many network configuration information entries as the number of terminals, N, similar to the first exemplary embodiment.

The network configuration information entry includes a VLAN-ID, a MAC (Media Access Control) address, an L3 (Layer 3) address, a NW-ID and a switch list. A difference from the first exemplary embodiment is that the L3 address is included in the network configuration information entry. L3 represents the third layer (the layer 3, or the network layer) of seven hierarchies of the OSI (Open Systems Interconnection) reference model. As a typical example of the L3 address, an IP address is mentioned.

Hereinafter, the network configuration information entry 201-1 will be described as an example. The network configuration information entry 201-1 is corresponding to the terminal 230 of Fig.6. As mentioned above, the L3 address is added compared with the first embodiment in Fig.2. The L3 address which is an identifier of the terminal 230 is stored in the "L3 address". Because other than the L3 address among the network configuration information entries, i.e., a VLAN- ID, a MAC address, a NW-ID and a switch list, are the same as those of the first exemplary embodiment, the description will be omitted.

(OPERATION)

As described above, the differences in operation of the second exemplary embodiment and the first exemplary embodiment are Step S1006 and Step S1008 of Fig.5. Hereinafter, the differences in Step S1006 and Step S1008 will be described with reference to Fig. 5. In Step S1006, the search unit 202 searches for whether a NW-ID corresponding to a source terminal (terminal 230) of the received packet exists from the network configuration information table 201. According to the second exemplary embodiment, the search unit 202 searches for the corresponding NW-ID using the L3 address of the source terminal (terminal 230) as a key in addition to the VLAN-ID of the received packet and the source MAC address.

When the NW-ID corresponding to the source terminal of the received packet exists in the network configuration information table 201 and has been searched in Step S1006, Step S1008 is performed. The search unit 202 searches for whether there is a VLAN-ID corresponding to the destination terminal (terminal 240) of the received packet from the network configuration information table 201 (Fig. 5: Step S1008). According to the second exemplary embodiment, the corresponding VLAN-ID is searched by using the L3 address of the destination terminal (terminal 240) as a key in addition to the destination MAC address of the received packet and the NW-ID searched in Step S1006.

(EFFECTS)

The second exemplary embodiment has the same effects as those of the first exemplary embodiment as it has been described above.

<Third exemplary embodiment

(OUTLINE)

The third exemplary embodiment of the present invention will be described in detail with reference to the figures. The third exemplary embodiment will describe a case where the first exemplary embodiment is applied to the technology called OpenFlow (OF) described in the non patent literature 2.

(CONFIGURATION)

The configuration of the third exemplary embodiment will be described with reference to Figs. 8 to 10. Fig. 8 is a block diagram showing the conf iguration of the system according to the third exemplary embodiment.

According to Fig . 8 , the system of the third exemplary embodiment includes an OF controller 300 , an OF switch 31 0, an OF switch 320, a terminal 330 and a terminal 340.

The OF controller 300 includes a network conf iguration information table 301 , a search unit 302 and a path control un it 303. The OF controller 300 is an apparatus which manages the OF switch 31 0, the OF switch 320 , the terminal 330 and the terminal 340.

The network conf iguration information table 301 is a table which holds information on terminals (the terminal 330 and the terminal 340) in the network which is controlled by the OF controller 300. Detailed description will be made later (Fig . 9) .

Based on inf ormation on a packet (hereinafter, " received packet" ) which each OF switch has received , the search unit 302 searches for a VLAN-I D to which a destination terminal of the received packet belongs, f rom the network conf iguration information table 301 .

The path control unit 303 takes out a l ist of OF switches belonging to the same NW as a source terminal or a destination terminal of the received packet f rom the network conf iguration information table 301 . Next, the path control unit 303 sets a processing rule (entry) to the switch which has been taken out so that communication between the source terminal and the destination terminal of the received packet may become possible .

The OF switch 31 0 includes a packet transfer unit 31 1 and a flow table 31 2. Sim ilarly, the OF switch 320 includes a packet transfer unit 321 and a flow table 322.

The packet transfer unit 31 1 searches for the received packet, whether there is a processing rule corresponding to the received packet in the f low table 31 2. When there is a corresponding processing rule , the packet transfer unit 31 1 refers to a content of process indicated in the processing rule , and perf orms an "Action " . The Action includes, for example , processing such as sending the packet to the OF switch 320 via a specif ic port (not shown in the figure) , discarding the packet, rewriting the packet header and broadcasting the packets . When a processing rule corresponding to the received packet is not indicated in the f low table 31 2 , the packet transfer unit 31 1 inquires the OF controller 300 which Action is to be performed .

The flow table 31 2 stores each entry as a processing rule by correlating the contents of information (a header) on the received packet of the OF switch 31 0 with the Action corresponding to the header of the received packet. As mentioned above , the packet transfer unit 31 1 performs the

Action corresponding to the received packet. Detailed description will be made later in Fig . 1 0.

Further, because the packet transfer unit 321 and the flow table 322 of the

OF switch 320 are similar to the packet transfer un it 31 1 and the flow table 31 2 of the OF switch 31 0 , the description of these will be omitted . Although the number of switches shown in Fig . 8 is two, it is not l imited to this and it operates sim ilarly even in a case of more than three .

The terminal 330 performs packet communication with the terminal 340.

Similarly, the terminal 340 performs packet communication with the terminal 330. Henceforth , although it will be described as the packet communication is to be performed in a direction f rom the terminal 330 to the terminal 340, it is not limited to this and it operates even in a case of an opposite direction .

Fig . 9 is a figure showing details of the network conf iguration information table 301 . The network configuration information table 301 includes network configuration information entries 301 - 1 and 301 -2 or the like . Each network configuration information entry holds information on terminals in the network controlled by the OF controller 300. Accordingly, the network conf iguration information table 301 holds as many network configuration information entries as the number of terminals , N . The network configuration information entry includes a VLAN-ID, a MAC address, a NW-ID and a switch list. Hereinafter, the network configuration information entry 301-1 will be described as an example. The network configuration information entry 301-1 is corresponding to the terminal 330 of Fig. 8. An identifier of the VLAN to which the terminal 330 belongs is stored in the "VLAN-ID". A MAC address which is a specific identifier of the terminal 330 is stored in the "MAC address". Further, similarity to the first exemplary embodiment, a MAC address is used as a specific identifier of a terminal also in the third exemplary embodiment, however, it is not limited to this. For example, an IP address can be used.

An identifier of the NW to which the terminal 330 belongs is stored in the "NW-ID". Further, as the NW-ID, for example, a network address which is expressed by using a front half part of an IP address assigned to each terminal or an SSID or the like which is an identifier of a wireless LAN is mentioned. As far as it is different from an ID of the VLAN which is a virtual network, it is not limited to these and new identifiers can be set and used.

Finally, a list of the switches belonging to the NW to which the terminal 330 belongs is stored in the "switch list". This switch list is generated from information (a VLAN-ID, a MAC address and a NW-ID) on each switch that the OF controller 300 has collected. As other composition of the switch list, for example, a list of OF switches that exist on a calculated route obtained by calculating a transfer route of the received packet can be stored.

The switch list is not indispensable to the network configuration information table 301 , similary to the first exemplary embodiment. It is also possible that information on the switches managed by the OF controller 300 is collected whenever the network configuration information table 301 is searched by the search unit 302 or the path control unit 303, and use the information temporarily.

In Fig.9, it shows an example which includes four kinds of information, a VLAN-ID, a MAC address, a NW-ID and a switch list in the network configuration information entry; however, it is possible to add an L3 address similar to the second exemplary embodiment. Because the configuration and operation in that case are almost the same as those of the second exemplary embodiment, the description will be omitted here.

Fig.10 is a figure showing details of the flow table 312. The flow table 312 includes flow table entries 312-1 and 312-2 or the like.

As mentioned above, the flow table entry indicates the processing rule in which the processing to be performed for a header of the received packet of the switch 110 is written down. As the contents of the entry, a VLAN-ID, a source MAC address, a destination MAC address, an Action, an input port and an output port are included. Here, some among information indicated in a header of the received packet of the OF switch 310 are treated as the search keys when searching for the flow table 312. For example, it is possible that the VLAN-ID, the source MAC address and the destination MAC address are used as the search keys. The same Action will be performed to a packet defined by the same search key.

(OPERATION)

Next, operation of the third exemplary embodiment will be described in detail with reference to Fig. 11 and Fig. 12. As mentioned above, a case where communication is performed in a direction from the terminal 330 to the terminal 340 of Fig.8 will be described hereinafter. Fig.11 is a flowchart showing operation of the OF switch 310. Fig. 12 is a flowchart showing operation of the OF controller 300.

First, operation of the OF switch 310 will be described with reference to Fig. 11. The OF switch 310 receives a packet from the terminal 330 (Fig. 11 : Step S3001 ). Next, the packet transfer unit 311 refers to the flow table 312 and determines whether a flow table entry corresponding to the received packet exists (Fig. 11: Step S3002).

When it is determined that the flow table entry corresponding to the received packet exists in Step S3002, Step S3003 is performed. The packet transfer unit 311 deals with the received packet according to a content of process and an output port or the like indicated in the corresponding flow table entry (Fig. 11: Step S3003).

When it is determined that the flow table entry corresponding to the received packet does not exist in Step S3002, Step S3004 is performed. The packet transfer unit 311 sends a message to the OF controller 300 to notify that it has received a packet for which a processing rule is unknown. This message is called "Packet-in" in the non patent literature 2. This Packet-in includes information about the received packet including a header. Accordingly, it is also possible to send the received packet just as it instead of the Packet-in.

When Step S3004 is performed, the OF controller 300 performs operation shown in Fig. 12. Hereinafter, operation of the OF controller 300 will be described with reference to Fig. 12.

First, the OF controller 300 receives the Packet-in from the OF switch 310.

(Fig. 12: Step S3005).

Next, the search unit 302 searches for whether a NW-ID corresponding to a source terminal (terminal 330) of the received packet exists from the network configuration information table 301 (Fig. 12: Step S3006). More specifically, the search unit 302 searches for the corresponding NW-ID using a VLAN-ID and a source MAC address of the received packet as the keys.

When the NW-ID corresponding to the source terminal of the received packet does not exist in the network configuration information table 301 in Step S3006, it orders the OF switch 310 to discard the received packet (Fig. 12: Step S3007). When the OF controller 300 is receiving the received packet itself, not the Packet-in, the OF controller 300 discards the received packet.

When the NW-ID corresponding to the source terminal of the received packet exists in the network configuration information table 301 and has been searched in Step S3006, Step S3008 is performed. The search unit 302 searches for whether there is a VLAN-ID corresponding to the destination terminal (terminal 340) of the received packet from the network configuration information table 301 (Fig. 12: Step S3008). More specifically, a destination MAC address of the received packet and the NW-ID having been searched in Step S3006 are used as the keys for searching the corresponding VLAN-ID.

When the VLAN-ID corresponding to the destination terminal of the received packet does not exist in the network configuration information table 301 in Step S3008, it orders the OF switch 310 to discard the received packet (Fig. 12: Step S3009). More specifically, the order means that it orders the OF switch 310 to set an entry including the Action in which processing to discard the received packet is written.

In the non patent literature 2, such order is set to the OF switch by a message called "flow_mod". This flow_mod is a message from the OF controller, which is for setting an entry in the flow table to the OF switch. For example, an initial registration, change, overwriting and deletion are included in setting of the flow table entry.

When the OF controller 300 is not receiving the Packet-in and is receiving the received packet itself like Step S3007, the OF controller 300 discards the received packet.

When the VLAN-ID corresponding to the destination terminal of the received packet exists in the network configuration information table 301 and has been searched in Step S3008, Step S3010 is performed. First, the path control unit 303 searches for the OF switch list corresponding to the terminal (a destination terminal), which has been found when the VLAN-ID was searched in Step S3008 from the network configuration information table 301. In the third exemplary embodiment, it is supposed that the OF switch 310 and the OF switch 320 are indicated. After that, the flow_mod is sent to each OF switch that is indicated in the searched OF switch list (Fig. 12: Step S3010). The flow_mod is sent in order to newly add an entry corresponding to the received packet to the entry of the flow table 312 of the OF switch 310 and the entry of the flow table 322 of the OF switch 320. The flow_mod sent in Step S3010 will be described more in detail. To either of the OF switch 310 or the OF switch 320, a VLAN-ID of an entry which is to be newly added is rewritten by the VLAN-ID which has been searched in Step S3008. To the other switch of the OF switch 310 or the OF switch 320, the processing, which rewrites a VLAN-ID indicated in a header of the received packet by the VLAN-ID which has been searched in Step S3008 when the OF switch receives the corresponding packet, is set as an Action. Further, when there are more than three switches, the flow_mod which is the same flow_mod for the OF switch 320 may be sent to the OF switch to which the processing rule should be set other than the OF switch 320.

Finally, the OF controller 300 issues an order for sending the received packet to the destination terminal (terminal 340) to the source switch (the switch 310) of the packet-in. This order corresponds to a message called Packet-out in the non patent literature 2. When the OF controller 300 is receiving the received packet just as it is, not the Packet-in, the received packet may be sent directly to the destination terminal (terminal 340) of the received packet (Fig. 12: Step S3011).

(EXAMPLE OF OPERATION)

Hereinafter, an example of operation of the third exemplary embodiment will be described in detail with reference to Figs. 13 to 21.

Fig. 13 shows the system configuration for this example of operation. The system shown in Fig. 13 includes the OF controller 300, the OF switch 310, the OF switch 320, the terminal 330 and the terminal 340.

The OF switch 310, the OF switch 320, the terminal 330 and the terminal 340 are included in the network 1 (NW1) as shown in Fig. 13. It is supposed the OF switch 310 and the terminal 330 are included in the VLAN1 and that the OF switch 320 and the terminal 340 are included in the VLAN2 respectively. The MAC address of the terminal 330 is set as "330", and the MAC address of the terminal 340 is set as "340" respectively. Further, in this example of operation, for the sake of simplicity, it shows operation in a case where a number of NW is one.

A, B, C or D indicated in Fig. 13 expresses a port of each OF switch. The port A of the OF switch 310 connects with the terminal 330. The port B of the OF switch 310 connects with the OF switch 320. The port C of the OF switch 320 connects with the OF switch 310. The port D of the OF switch 320 connects with the terminal 340.

Here, in Fig. 13, although it shows a configuration in a case where the OF controller 300 is not included in the NW1 , it can be included in the NW1. The OF controller 300, the OF switch 310 and the OF switch 320 can be connected via a dedicated network, or the OF controller 300 can be connected via the network (NW1) which links the OF switch 310 and the OF switch 320 together.

Fig. 14 shows an example of operation of Step S3001, Step S3002 (Fig. 11), Step S3004 and Step S3005 (Fig. 12) of the third exemplary embodiment.

In addition to Fig. 13, it shows the contents of the flow table 312, the flow table 322 and a header of the packet received by the OF switch 310. It is supposed that the entry corresponding to the received packet has not been written in both of the flow table 312 and the flow table 322 yet.

First, the terminal 330 sends a packet having a destination address of the terminal 340. In a header of this packet, "1" as a VLAN-ID to which the terminal 330 belongs, "330" of the terminal 330 as the source MAC address and "340" of the terminal 340 as the destination MAC address are written respectively.

The packet transfer unit 311 of the OF switch 310 that has received this packet searches for whether there is an entry corresponding to the received packet in the flow table 312 (Fig. 11 : Step S3001 and Step S3002). Because there is no corresponding entry in the flow table 312, the packet transfer unit 311 inquires a content of process to the OF controller 300 using the packet-in (Fig. 11: Step S3004). Then, the OF controller 300 receives this packet-in (Fig. 12: Step S3005).

Fig. 15 and Fig. 16 show an example of operation of Step S3006 of the third exemplary embodiment. Fig. 15 and Fig. 16 show the contents of the network configuration information table 301 held in the OF controller 300, in addition to Fig. 14.

In this example of operation, entries corresponding to the terminal 330 and the terminal 340 are stored as entires in the network configuration information table 301.

In the entry corresponding to the terminal 330, it stores "1 " as a VLAN-ID, "330" as a MAC address, "1" as a NW-ID and "310 and 320" as a switch list (SW-list) respectively.

Similarly, in the entry corresponding to the terminal 340, it stores "2" as a VLAN-ID, "340" as a MAC address, "1" as a NW-ID and "310 and 320" as a switch list respectively.

The search unit 302 of the OF controller 300 searches for the corresponding NW-ID from the network configuration information table 301 using the VLAN-ID (1) of the received packet and the source MAC address (330) as the keys in Step S3006.

As a result of this search, the NW-ID "1" to which the terminal 330 belongs can be obtained from the network configuration information table 301 (Fig. 16).

Fig. 17 and Fig. 18 show an example of operation of Step S3008 of the third exemplary embodiment. In Step S3008, the search unit 302 searches for the corresponding VLAN-ID using the destination MAC address (340) of the received packet and the NW-ID (1) which has been obtained in Step S3006 as the keys (Fig. 17). As a result, "2" as the VLAN-ID can be obtained (Fig. 18).

Fig. 19 shows an example of operation of Step S3010 and Step S3011 of the third exemplary embodiment.

First, the path control unit 303 of the OF controller 300 searches for the OF switch list, which is corresponding to the terminal (a destination terminal) found at the time when the VLAN-ID has been searched in Step S3008, from the network configuration information table 301. In this case, "310" and "320" are stored as the switch list.

After that, the flow_mod is sent to each switch indicated in the switch list (Fig. 12: Step S3010). This flow_mod is sent in order to newly add an entry corresponding to the received packet to each entry of the flow table 312 of the OF switch 310 and the flow table 322 of the OF switch 320. The following two kinds are considered as the contents of this flow_mod.

(1 ) It sets "1 " as the VLAN-ID, "330" as the source MAC address, "340" as the destination MAC address, "outputs to the port B" and "rewrites a

VLAN-ID of the packet by 2" as the contents of process, "A" as the input port, and "B" as the output port respectively to the flow table 312 of the OF switch 310. At the same time, it sets "2" as the VLAN-ID, "330" as the source MAC address, "340" as the destination MAC address, "outputs to the port D" as the content of process, "C" as the input port, and "D" as the output port respectively to the flow table 322 of the OF switch 320.

Thus, by setting as above, the VLAN-ID of the packet is rewritten by "2" from "1" when the OF switch 310 receives the relevant packet, and it becomes possible to communicate with the terminal 340 which belongs to the VLAN-ID "2".

(2) It sets "1 " as the VLAN-ID, "330" as the source MAC address, "340" as the destination MAC address, "outputs to the port B" as the content of process, "A" as the input port, and "B" as the output port respectively to the flow table 312 of the OF switch 310. It sets "1" as the VLAN-ID, "330" as the source MAC address, "340" as the destination MAC address, "outputs to the port D" and "rewrites a VLAN-ID of the packet by 2" as the contents of process, "C" as the input port, and "D" as the output port respectively to the flow table 322 of the OF switch 320.

Thus, by setting as above, it becomes possible to communicate from the OF switch 310 to the OF switch 320 without rewriting the VLAN-ID of the relevant packet from "1 ". Also, it becomes possible to communicate with the terminal 340 which belongs to the VLAN-ID "2" by rewriting the VLAN-ID of the packet by "2" at the OF switch 320.

Finally, in Step S3011 , the OF controller 300 sends the Packet-out to the OF switch 310, and orders to send the received packet to the destination terminal.

Fig.20 and Fig.21 show an example of operation after the flow table 312 and the flow table 322 have been updated by the operation mentioned above. Fig. 20 shows an example of operation when each flow table has been updated as (1) of Fig. 19 by the flow_mod in Step S3010. Fig. 21 shows an example of operation when each flow table has been updated as (2) of Fig. 19 by the flow_mod in Step S3010.

In an example of Fig. 20, first, when the OF switch 310 has received the relevant packet, the flow table 312 is searched. In the corresponding entry of the flow table 312, it shows "Set V-ID 2" as the Action, in other words, to rewrite the VLAN-ID by 2. According to this, the VLAN-ID of the received packet header is rewritten by 2. After that, in the OF switch 320, transmission is performed to the terminal 340 according to the corresponding entry of the flow table 322.

Communication between different VLANs becomes possible by performing this rewriting of VLAN-ID in the OF switch 310 which belongs to the VLAN (1).

In an example of Fig. 21, first, when the OF switch 310 has received the relevant packet, the flow table 312 is searched. Because the corresponding entry exists in the flow table 312, the OF switch 310 sends the received packet to the OF switch 320 according to the entry.

Next, when the OF switch 320 has received the relevant packet, the flow table 322 is searched and the VLAN-I D of the received packet is rewritten by 2 according to "Set V-I D 2" indicated in the Action .

I n the example of Fig . 21 , it becomes possible to communicate between different VLANs by setting the VLAN-I D of the relevant entry of the f low table 322 to " 1 " in advance.

(EFFECTS)

The third exemplary embodiment has the same effects as those of the f irst exemplary embodiment as it has been described above.

<Fourth exemplary embodiment

The fourth exemplary embodiment of the present invention will be described in detail with reference to Fig . 22.

(CONFIGU RATION)

The configuration of the fourth exemplary embodiment will be described with reference to Fig . 22. Fig . 22 is a block diagram showing the system conf iguration according to the fourth exemplary em bodiment.

According to Fig . 22 , the system of the fourth exemplary embodiment includes a control apparatus 400 , a terminal 430 and a terminal 440.

The control apparatus 400 incl udes a network conf iguration inf ormation management unit 401 and a path control unit 403. The control apparatus 400 is an apparatus which controls commun ication (packet transferring) performed between the terminal 430 and the terminal 440.

The terminal 430 and the terminal 440 belong to the first virtual network identif ied by the f irst identif ier respectively.

The network conf iguration information management un it 401 holds configuration information on the second virtual network so that the terminal 430 and the terminal 440 may belong to the second virtual network identified by the second identif ier.

The path control unit 403 controls communication between each terminal based on configuration information on the second virtual network held by the network conf iguration information management unit 401 .

(EFFECTS)

According to the fourth exemplary embodiment, the control apparatus controls communication between the terminals by holding conf iguration information so that the terminal belonging to the f irst virtual network may belong to the second virtual network. As a result, even in a case where there is restriction on the use of the number of the identif ier of the f irst virtual network, it becomes possible to establish a large scale network by using the second virtual network.

While this invention has been particularly shown and described with reference to exemplary embodiments thereof , the invention is not limited to those specif ic embodiments. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention .

This application claims priority from Japanese Patent Application No . 201 0- 1 97630, f iled on September 3, 201 0, the contents of which are incorporated herein by reference in their entirety.

The whole or part of the exemplary embodiments disclosed above can be described as , but not limited to, the following supplementary notes.

(SU PPLEMENTARY NOTE 1 )

A control apparatus f or controlling packet transfer between terminals belonging to a first virtual network identif ied by a first identifier comprising :

a network configuration inf ormation management means for holding conf iguration information on a second virtual network identif ied by a second identifier so that the terminals belong to the second virtual network; and

a path control means for controlling communication between the terminals based on the conf iguration information on the second virtual network.

(SUPPLEMENTARY NOTE 2)

The control apparatus according to supplementary note 1 , wherein the network configuration information management means manages identification information on the terminal for each of the terminals by correlating an identif ier of the terminal to the f irst identif ier provided in the terminal .

(SU PPLEM ENTARY NOTE 3)

The control apparatus according to supplementary note 1 or 2 , wherein the network configuration information management means manages configuration information on the second virtual network for each of the terminals by correlating identification information on the terminal to the second identif ier provided in the term inal .

(SUPPLEMENTARY NOTE 4)

The control apparatus according to any one of supplementary notes

1 to 3 , further comprising :

a searching means for searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier from the network conf iguration information management means based on information on the received packet, when an inquiry about a received packet of a transfer apparatus which sends a packet is received , searching for the first identif ier of the destination terminal from the network configuration information management means, when each of the source terminal and the destination terminal of the received packet has the identical second identif ier, and discards the received packet when each of the source terminal and the destination terminal of the received packet has a different second identif ier; and

wherein the path control means calculates a transfer route between the source term inal and the destination terminal , an d notif ies of an order to set a processing rule including a process for the received packet to the transfer apparatus on the transfer route based on the detected f irst identifier of the destination term inal .

(SU PPLEM ENTARY NOTE 5)

The control apparatus according to supplementary note 4;

wherein the searching means searches for the second identif ier provided in the source term inal from the network configuration information management means based on the first identif ier of the source terminal and an identifier of the source terminal , and for the f irst identifier provided in the destination terminal from the network configuration information

management means based on an identif ier of the destination terminal and the second identifier provided in the source term inal obtained as a result of the search .

(SU PPLEMENTARY NOTE 6)

The control apparatus according to supplementary note 4 or 5 , wherein the path control means sets a processing rule including a process to update the f irst identifier in a header of the received packet by the f irst identif ier provided in the destination terminal , for a source transfer apparatus of the inquiry, and updates the f irst identif ier of the header of the received packet in the processing rule corresponding to the received packet by the first identif ier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

(SU PPLEM ENTARY NOTE 7)

The control apparatus according to supplementary note 4 or 5, wherein the path control means sets the processing rule including a process to update the second identifier in the header of the packet by the f irst identif ier provided in the destination terminal for the transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

(SUPPLEM ENTARY NOTE 8) The control apparatus according to any one of supplementary notes

3 to 7,

wherein the network configuration information management means further stores an IP address of a terminal as the second network configuration information; and

wherein the searching means searches for the second identifier provided in the source terminal from the network configuration information management means based on the first identifier provided in the source terminal, the identifier of the source terminal and the IP address of the source terminal, and searches for the first identifier provided in the destination terminal from the network configuration information

management means based on the identifier of the destination terminal, the second identifier provided in the source terminal obtained as a result of the search and the IP address of the destination terminal.

(SUPPLEMENTARY NOTE 9)

The control apparatus according to any one of supplementary notes

3 to 8,

wherein the network configuration information management means further stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal; and wherein the path control means searches for a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs from the list of the transfer apparatus.

(SUPPLEMENTARY NOTE 10)

A communication system comprising:

a terminal which belongs to a first virtual network identified by a first identifier; and

a control apparatus for controlling packet transfer between the terminals; wherein the control apparatus includes :

a network conf iguration information management means for holding configuration information on a second virtual network identif ied by a second identifier so that the term inals belong to the second virtual network; and

(SU PPLEMENTARY NOTE 1 1 )

The communication system according to supplementary note 1 0, wherein the network conf iguration information management means manages identification information on the terminal for each of the terminals by correlating an identifier of the terminal to the first identifier provided in the terminal .

(SU PPLEMENTARY NOTE 1 2)

The communication system according to supplementary note 1 0 or

1 1 ,

wherein the network conf iguration information management means manages configuration information on the second virtual network for each of the terminals by correlating identification information on the terminal to the second identif ier provided in the terminal .

(SUPPLEM ENTARY NOTE 1 3)

The communication system according to any one of supplementary notes 1 0 to 1 2 , further comprising :

a transfer apparatus for processing for a received packet based on a processing rule which correlates a header of the received packet and processing correspon ding to the packet, and inquiring to the control apparatus when the processing rule f or the received packet is unknown ; wherein the control apparatus further comprising a searching means for searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier from the network configuration information management means based on

information on the received packet when having received the inquiry, searching for the first identif ier of the destination terminal from the network conf iguration information management means when each of the source terminal and the destination term inal of the received packet has the identical second identif ier, discards the received packet when each of the source terminal and the destination terminal of the received packet has a different second identif ier; and

wherein the path control means calculates a transfer route between the source term inal and the destination term inal , and notifies of an order to set a processing rule including processing for the received packet to the transfer apparatus on the transfer route according to the detected f irst identif ier of the destination terminal .

(SUPPLEMENTARY NOTE 1 4)

The communication system according to supplementary note 1 3, wherein the searching means searches for the second identif ier provided in the source term inal f rom the network conf iguration information management means based on the first identif ier of the source terminal and an identifier of the source terminal , and searching for the first identif ier provided in the destination terminal from the network configuration information management means based on an identifier of the destination terminal and the second identifier provided in the source terminal obtained as a result of the search .

(SU PPLEM ENTARY NOTE 1 5)

The communication system according to supplementary note 1 3 or

1 4,

wherein the path control means sets a processing rule incl uding a process to update the f irst identif ier in a header of the received packet by the f irst identifier provided in the destination terminal , for a source transfer apparatus of the inquiry, and updates the f irst identifier of the header of the received packet in the processing rule corresponding to the received packet by the first identif ier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the transmission source transfer apparatus of the inquiry.

(SU PPLEMENTARY NOTE 1 6)

The communication system according to supplementary note 1 3 or

1 4,

wherein the path control means sets the processing rule including a process to update the second identifier in the header of the packet by the f irst identif ier provided in the destination terminal for the transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

(SU PPLEMENTARY NOTE 1 7)

The communication system according to any one of supplementary notes 1 2 to 1 6 ,

wherein the network conf iguration information management means f urther stores an I P address of a term inal as the second network configuration information ; and

wherein the searching means searches for the second identif ier provided in the source terminal from the network configuration information management means based on the f irst identifier provided in the source terminal , the identif ier of the source terminal and the I P address of the source terminal , and searches f or the f irst identif ier provided in the destination terminal from the network configuration information

management means based on the identif ier of the destination terminal , the second identif ier provided in the source terminal obtained as a result of the search and the I P address of the destination terminal .

(SUPPLEM ENTARY NOTE 1 8)

The communication system accord ing to any one of supplementary notes 12 to 17,

(SUPPLEMENTARY NOTE 19)

A communication method for controlling packet transfer between terminals belonging to a first virtual network identified by a first identifier, comprising:

controlling communication between the terminals so that the terminals belong to a second virtual network identified by a second identifier based on configuration information on the second virtual network which is held in a network configuration information management means. (SUPPLEMENTARY NOTE 20)

The communication method according to supplementary note 19, wherein the network configuration information management means manages identification information on the terminal for each of the terminals by correlating an identifier of the terminal to the first identifier provided in the terminal.

(SUPPLEMENTARY NOTE 21)

The communication method according to supplementary note 19 or 20,

wherein the network configuration information management means manages configuration information on the second virtual network for each of the terminals by correlating identification information on the terminal to the second identifier provided in the terminal.

(SUPPLEMENTARY NOTE 22) The communication method according to any one of supplementary notes 1 9 to 21 , further comprising :

searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier from the network conf iguration information management means based on

information on the received packet when having received an inquiry about the received packet of a transfer apparatus which sends a packet;

searching for the f irst identif ier of the destination terminal f rom the network configuration information management means when each of the source term inal and the destination terminal of the received packet has the identical second identifier;

discarding the received packet when each of the source term inal and the destination terminal of the received packet has a different second identif ier;

calculating a transfer route between the source terminal and the destination terminal ; and

notifying of an order to set a processing rule including a process for the received packet to the transfer apparatus on the transfer route according to the detected f irst identif ier of the destination terminal .

(SUPPLEMENTARY NOTE 23)

The communication method according to supplementary note 22 , further comprising :

searching for the second identifier provided in the source terminal from the network conf iguration information management means based on the first identif ier of the source terminal and an identif ier of the source term inal ; and

searching for the f irst identif ier provided in the destination terminal from the network conf iguration information management means based on an identif ier of the destination terminal and the second identif ier provided in the source terminal obtained as a result of the searching . (SUPPLEM ENTARY NOTE 24)

The communication method according to supplementary note 22 or 23, further comprising :

setting a processing rule including a process to update the first identif ier in a header of the received packet by the f irst identifier provided in the destination terminal for a transmission source transfer apparatus of the inquiry; and

updating the f irst identif ier of the header of the received packet in the processing rule corresponding to the received packet by the f irst identifier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

(SUPPLEMENTARY NOTE 25)

The communication method according to supplementary note 22 or 23, further comprising:

setting the processing rule including a process to update the second identif ier in the header of the packet by the f irst identif ier provided in the destination term inal for the transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry. (SU PPLEMENTARY NOTE 26)

The communication method according to any one of supplementary notes 21 to 25 ,

wherein the network conf iguration information management means further stores an I P address of a terminal as the second network

conf iguration information ; and

wherein the commun ication method further comprising :

searching for the second identifier provided in the source term inal from the network conf iguration information management means based on the first identif ier provided in the source terminal , the identifier of the source terminal and the I P address of the source terminal ; and searching for the f irst identifier provided in the destination terminal from the network conf iguration information management means based on the identifier of the destination terminal , the second identif ier provided in the source term inal obtained as a result of the search and the I P address of the destination terminal .

(SU PPLEMENTARY NOTE 27)

The commun ication method according to any one of_^ supplementary notes 21 to 25 ,

wherein the network conf iguration information management means further stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal ; and wherein the communication method further comprising:

searching for a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs from the list of the transfer apparatus .

(SU PPLEM ENTARY NOTE 28)

A recording medium having recorded thereon a communication program for causing a computer to execute a process of controlling packet transfer between term inals belonging to a f irst virtual network identified by a f irst identif ier, comprising :

a path control process for controlling communication between the terminals so that the terminals belong to a second virtual network identif ied by a second identifier based on configuration information on the second virtual network which is held in a network conf iguration information management means .

(SUPPLEM ENTARY NOTE 29)

The recording medium according to supplementary note 28, wherein the network conf iguration information management means manages identification information on the terminal f or each of the terminals by correlating an identif ier of the terminal to the f irst identifier provided in the terminal .

(SU PPLEM ENTARY NOTE 30)

The recording medium according to supplementary note 28 or 29 , wherein the network conf iguration information management means manages configuration information on the second virtual network for each of the terminals by correlating identification information on the term inal to the second identif ier provided in the terminal .

(SU PPLEM ENTARY NOTE 31 )

The recording medium according to any one of supplementary notes 28 to 30 , further comprising :

a searching process f or searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier f rom the network conf iguration information management means based on information on the received packet when having received an inqu iry about the received packet of a transfer apparatus which sends a packet, searching for the f irst identifier of the destination term inal from the network configuration information management means when each of the source term inal and the destination terminal of the received packet has the identical second identifier, and discarding the received packet when each of the source term inal and the destination terminal of the received packet has a different second identif ier; and

wherein the path control process f urther includes calculating a transfer route between the source terminal and the destination terminal , and notifying of an order to set a processing rule including a process for the received packet to the transfer apparatus on the transfer route accord ing to the detected first identif ier of the destination terminal .

(SU PPLEM ENTARY NOTE 32)

The recording medium according to supplementary note 31 , wherein the searching process further includes searching for the second identif ier provided in the source terminal from the network configuration inf ormation management means based on the first identif ier of the source terminal and an identif ier of the source terminal , and searching f or the f irst identif ier provided in the destination terminal from the network configuration information management means based on an identif ier of the destination terminal and the second identif ier provided in the source terminal obtained as a result of the searching .

(SUPPLEM ENTARY NOTE 33)

The recording medium according to supplementary note 31 or 32, wherein the path control process f urther incl udes setting a processing rule including a process to update the first identif ier in a header of the received packet by the f irst identif ier provided in the destination terminal for a transmission source transfer apparatus of the inquiry, and updating the f irst identifier of the header of the received packet in the processing rule corresponding to the received packet by the f irst identifier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry. (SU PPLEM ENTARY NOTE 34)

The recording medium according to supplementary note 31 or 32 , wherein the path control process f urther includes setting the processing rule including a process to update the second identif ier in the header of the packet by the first identifier provided in the destination terminal for the transfer apparatus on the route of the received packet other than the transmission source transfer apparatus of the inquiry.

(SUPPLEM ENTARY NOTE 35)

The recording med ium according to any one of supplementary notes

30 to 34,

configuration information ; and

wherein the searching process further includes searching for the second identifier provided in the source terminal from the network configuration information management means based on the first identifier provided in the source terminal, the identifier of the source terminal and the IP address of the source terminal, and searching for the first identifier provided in the destination terminal from the network configuration information management means based on the identifier of the destination terminal, the second identifier provided in the source terminal obtained as a result of the search and the IP address of the destination terminal.

(SUPPLEMENTARY NOTE 36)

The recording medium according to any one of supplementary notes 30 to 34,

wherein the network configuration information management means further stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal; and wherein the path control process further includes searching for a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs from the list of the transfer apparatus.

Reference Signs List

1, 2 a network NW

100, 200 a controller

300 an OF controller

400 a control apparatus

101, 201, 301 a network configuration information table

401 a network configuration information management unit

101-1, 101-2, 101 -N, 201-1, 201-2, 201 -N, 301-1, 301-2, 301 -N, 401-1, 401-2, 401 -N a network configuration information entry 102, 202, 302 a search unit

103, 203, 303 a path control unit

110, 120, 210, 220 a switch

310, 320 an OF switch

111, 121, 211, 221, 311, 321 a packet transfer unit 112, 122, 212, 222 a forwarding table

112-1, 112-2, 112-M a forwarding table entry 312, 322 a flow table

312-1, 312-2, 312-M a flow table entry

130, 140, 230, 240, 330, 340 a terminal

Claims

[CLAI M 1 ]

A control apparatus for controlling packet transfer between terminals belonging to a first virtual network identif ied by a first identifier comprising :

a network conf iguration information management means for holding configuration information on a second virtual network identified by a second identif ier so that the terminals belong to the second virtual network; and

a path control means for controlling communication between the terminals based on the configuration information on the second virtual network.

[ CLAI M 2 ]

The control apparatus according to claim 1 ,

wherein the network conf iguration information management means manages identification information on the terminal for each of the terminals by correlating an identifier of the terminal to the f irst identifier provided in the terminal .

[CLAI M 3 ]

The control apparatus according to claim 1 or 2 ,

wherein the network conf iguration information management means manages configuration information on the second virtual network for each of the terminals by correlating identif ication information on the terminal to the second identif ier provided in the terminal .

[CLAI M 4]

The control apparatus according to any one of claims 1 to 3 , further comprising :

a searching means for searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier f rom the network conf iguration information management means based on information on the received packet, when an inquiry about a received packet of a transfer apparatus which sends a packet is received , searching for the f irst identif ier of the destination terminal from the network configuration information management means, when each of the source terminal and the destination term inal of the received packet has the identical second identif ier, and discards the received packet when each of the source terminal and the destination terminal of the received packet has a different second identifier; and

wherein the path control means calculates a transfer route between the source term inal and the destination term inal , and notif ies of an order to set a processing rule including a process for the received packet to the transfer apparatus on the transfer route based on the detected f irst identif ier of the destination terminal .

[CLAI M 5 ]

The control apparatus according to claim 4;

wherein the searching means searches for the second identifier provided in the source terminal f rom the network conf iguration information management means based on the first identif ier of the source terminal and an identifier of the source terminal , and for the first identif ier provided in the destination terminal from the network configuration information

management means based on an identif ier of the destination terminal and the second identif ier provided in the source terminal obtained as a result of the search .

[ CLAI M 6 ]

The control apparatus according to claim 4 or 5 ,

wherein the path control means sets a processing rule incl uding a process to update the f irst identif ier in a header of the received packet by the first identif ier provided in the destination terminal , for a source transfer apparatus of the inquiry, and updates the f irst identifier of the header of the received packet in the processing rule corresponding to the received packet by the first identif ier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

[CLAI M 7 ]

The control apparatus according to claim 4 or 5 ,

[CLAI M 8]

The control apparatus according to any one of claims 3 to 7, wherein the network conf iguration information management means further stores an I P address of a terminal as the second network conf iguration information ; and

wherein the searching means searches for the second identif ier provided in the source term inal f rom the network conf iguration information management means based on the f irst identifier provided in the source terminal , the identifier of the source terminal and the I P address of the source terminal , and searches for the f irst identif ier provided in the destination terminal from the network configuration information

management means based on the identifier of the destination terminal , the second identif ier provided in the source terminal obtained as a result of the search and the I P address of the destination terminal .

[CLAI M 9 ]

The control apparatus according to any one of claims 3 to 8 , wherein the network conf iguration information management means further stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal ; and wherein the path control means searches f or a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs from the list of the transfer apparatus.

[CLAIM 10]

A communication system comprising:

a control apparatus for controlling packet transfer between the terminals;

wherein the control apparatus includes:

a network configuration information management means for holding configuration information on a second virtual network identified by a second identifier so that the terminals belong to the second virtual network; and

[CLAIM 11 ]

The communication system according to claim 10,

wherein the network configuration information management means manages identification information on the terminal for each of the terminals by correlating an identifier of the terminal to the first identifier provided in the terminal.

[CLAIM 12]

The communication system according to claim 10 or 11,

[CLAIM 13] The communication system according to any one of claims 1 0 to 1 2 , further comprising :

a transfer apparatus for processing for a received packet based on a processing rule which correlates a header of the received packet and processing corresponding to the packet, and inquiring to the control apparatus when the processing rule for the received packet is unknown ; wherein the control apparatus further comprising a searching means for searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier from the network configuration information management means based on

information on the received packet when having received the inquiry, searching for the f irst identif ier of the destination terminal f rom the network conf iguration information management means when each of the source terminal and the destination terminal of the received packet has the identical second identifier, discards the received packet when each of the source terminal and the destination terminal of the received packet has a different second identif ier; and

wherein the path control means calculates a transfer route between the source terminal and the destination terminal , and notif ies of an order to set a processing rule including processing for the received packet to the transfer apparatus on the transfer route according to the detected first identifier of the destination term inal .

[CLAI M 1 4]

The commun ication system according to claim 1 3 ,

wherein the searching means searches for the second identif ier provided in the source term inal f rom the network conf iguration information management means based on the f irst identif ier of the source term inal and an identif ier of the source terminal , and search ing for the f irst identifier provided in the destination terminal from the network conf iguration information management means based on an identifier of the destination terminal and the second identif ier provided in the source terminal obtained as a result of the search .

[CLAI M 1 5 ]

The communication system according to claim 1 3 or 1 4,

wherein the path control means sets a processing rule including a process to update the f irst identif ier in a header of the received packet by the first identif ier provided in the destination terminal , for a source transfer apparatus of the inquiry , and updates the f irst identifier of the header of the received packet in the processing rule corresponding to the received packet by the first identif ier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the transmission source transfer apparatus of the inquiry.

[CLAI M 1 6 ]

The communication system according to claim 1 3 or 1 4,

wherein the path control means sets the processing rule including a process to update the second identif ier in the header of the packet by the first identifier provided in the destination terminal for the transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

[CLAI M 1 7 ]

The communication system according to any one of claims 1 2 to 1 6, wherein the network configuration information management means further stores an I P address of a terminal as the second network

conf iguration information ; and

wherein the searching means searches for the second identif ier provided in the source term inal f rom the network conf iguration information management means based on the first identifier provided in the source terminal , the identifier of the source terminal and the I P address of the source terminal , and searches for the f irst identifier provided in the destination terminal from the network configuration information management means based on the identif ier of the destination terminal , the second identifier provided in the source terminal obtained as a result of the search and the I P address of the destination term inal .

[CLAI M 1 8 ]

The communication system according to any one of claims 1 2 to 1 7 , wherein the network configuration information management means f urther stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal ; and wherein the path control means searches for a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs from the list of the transfer apparatus .

[CLAI M 1 9 ]

A communication method f or controlling packet transfer between terminals belonging to a f irst virtual network identif ied by a f irst identifier, comprising :

controlling communication between the terminals so that the terminals belong to a second virtual network identif ied by a second identifier based on configuration information on the second virtual network which is held in a network conf iguration information management means .

[CLAI M 20 ]

The communication method according to claim 1 9,

wherein the network configuration information management means manages identification information on the terminal for each of the terminals by correlating an identifier of the terminal to the f irst identifier provided in the terminal .

[CLAI M 21 ]

The communication method according to claim 1 9 or 20 ,

[CLAI M 22 ]

The communication method according to any one of claims 1 9 to 21 , further comprising :

searching for the f irst identif ier of the destination terminal from the network configuration information management means when each of the source terminal and the destination terminal of the received packet has the identical second identifier;

[CLAI M 23 ]

The communication method according to claim 22 , further comprising :

searching for the second identifier provided in the source terminal from the network conf iguration information management means based on the f irst identifier of the source terminal and an identif ier of the source terminal ; and

searching for the f irst identifier provided in the destination terminal from the network conf iguration information management means based on an identif ier of the destination terminal and the second identif ier provided in the source terminal obtained as a result of the searching .

[CLAI M 24]

The communication method according to claim 22 or 23 , f urther comprising :

setting a processing rule including a process to update the f irst identif ier in a header of the received packet by the f irst identifier provided in the destination term inal for a transmission source transfer apparatus of the inquiry; and

updating the f irst identif ier of the header of the received packet in the processing rule corresponding to the received packet by the f irst identif ier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

[CLAI M 25 ]

The communication method according to claim 22 or 23 , further comprising :

setting the processing rule including a process to update the second identifier in the header of the packet by the first identif ier provided in the destination terminal for the transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry.

[CLAI M 26 ]

The communication method according to any one of claims 21 to 25 , wherein the network conf iguration information management means further stores an I P address of a term inal as the second network conf iguration information ; and

wherein the commun ication method further comprising :

searching for the second identif ier provided in the source term inal from the network conf iguration information management means based on the f irst identif ier provided in the source terminal , the identif ier of the source terminal and the I P address of the source terminal ; and

searching for the f irst identif ier provided in the destination terminal from the network conf iguration information management means based on the identif ier of the destination term inal , the second identifier provided in the source term inal obtained as a result of the search and the I P address of the destination terminal .

[CLAI M 27 ]

The communication method according to any one of claims 21 to 25, wherein the network configuration information management means further stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal ; and wherein the communication method further comprising :

searching for a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs f rom the list of the transfer apparatus .

[CLAI M 28 ]

A recording medium having recorded thereon a commun ication program for causing a computer to execute a process of controlling packet transfer between terminals belonging to a first virtual network identif ied by a first identif ier, comprising :

a path control process for controlling communication between the terminals so that the terminals belong to a second virtual network identif ied by a second identifier based on conf iguration information on the second virtual network which is held in a network conf iguration information management means .

[ CLAI M 29 ]

The recording medium according to claim 28,

wherein the network conf iguration information management means manages identif ication information on the terminal for each of the terminals by correlating an identifier of the terminal to the f irst identifier provided in the terminal .

[CLAI M 30 ]

The recording medium according to claim 28 or 29,

wherein the network conf iguration information management means manages configuration information on the second virtual network for each of the term inals by correlating identification information on the terminal to the second identif ier provided in the terminal .

[CLAI M 31 ]

The recording medium according to any one of claims 28 to 30, further comprising :

a searching process for searching for whether each of a source terminal and a destination terminal of the received packet has an identical second identif ier f rom the network conf iguration information management means based on information on the received packet when having received an inquiry about the received packet of a transfer apparatus which sends a packet, searching for the first identif ier of the destination terminal f rom the network configuration information management means when each of the source terminal and the destination term inal of the received packet has the identical second identifier, and discarding the received packet when each of the source term inal and the destination terminal of the received packet has a different second identifier; and

wherein the path control process further includes calculating a transfer route between the source terminal and the destination terminal , and notifying of an order to set a processing rule including a process for the received packet to the transfer apparatus on the transfer route according to the detected f irst identif ier of the destination terminal .

[CLAI M 32 ]

The recording medium according to claim 31 ,

wherein the searching process further includes searching for the second identif ier provided in the source terminal f rom the network configuration information management means based on the first identifier of the source term inal and an identif ier of the source terminal , and searching for the f irst identifier provided in the destination terminal from the network configuration information management means based on an identif ier of the destination terminal and the second identif ier provided in the source terminal obtained as a result of the searching .

[CLAI M 33 ]

The recording medium according to claim 31 or 32,

wherein the path control process f urther includes setting a processing rule including a process to update the first identifier in a header of the received packet by the f irst identif ier provided in the destination terminal for a transm ission source transfer apparatus of the inquiry, and updating the f irst identif ier of the header of the received packet in the processing rule corresponding to the received packet by the f irst identifier provided in the destination terminal for a transfer apparatus on the route of the received packet other than the source transfer apparatus of the inquiry .

[CLAI M 34]

The recording medium according to claim 31 or 32 ,

wherein the path control process f urther includes setting the processing rule including a process to update the second identif ier in the header of the packet by the first identifier provided in the destination terminal for the transfer apparatus on the route of the received packet other than the transmission source transfer apparatus of the inquiry.

[CLAI M 35 ]

The recording medium according to any one of claims 30 to 34, wherein the network configuration information management means f urther stores an I P address of a term inal as the second network

configuration information ; and

wherein the searching process further includes searching for the second identif ier provided in the source terminal f rom the network configuration inf ormation management means based on the f irst identif ier provided in the source terminal , the identifier of the source terminal and the I P address of the source term inal , and search ing for the first identif ier provided in the destination terminal f rom the network configuration information management means based on the identif ier of the destination terminal , the second identifier provided in the source terminal obtained as a result of the search and the I P address of the destination terminal .

[CLAI M 36 ]

The recording medium according to any one of claims 30 to 34, wherein the network conf iguration information management means further stores a list of the transfer apparatus in the second virtual network to which the terminal belongs as identification information on the terminal ; and wherein the path control process f urther includes searching for a transfer apparatus which belongs to the same second virtual network to which the source terminal or the destination terminal belongs f rom the list of the transfer apparatus .