Path control system, control device, and path control method

• US 10,038,669 B2
• Filed: 02/01/2013
• Issued: 07/31/2018
• Est. Priority Date: 03/02/2012
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Kizu, Yoshiya, Kashima, Kenichi
• Primary Examiner(s): Abyaneh, Ali
• Application Number:
  US14/380,693
• Publication Number:
  US 20150047010A1
• Time in Patent Office: 2,006 Days
• CPC Class Codes: H04L 45/125 based on throughput or bandwidth
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 47/122 by diverting traffic away from congested entities
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

To provide a path control system, a control device and a path control method that can achieve reduction of the load on a gateway device, there are included a communication device, a communication device, a security device that provides a security feature to data transmitted and received between the communication device and the communication device, and a path control device that selects one of a first path through the security device and a second path not through the security device as a communication path of the data based on a path information table where an attribute of the data and a communication path between the communication device and the communication device are associated.

Claims

1. A path control system comprising:

a first communication device;

a second communication device;

a security device; and

a flow controller;

wherein the security device comprises;

at least one memory storing instructions, and

at least one processor configured to execute the instructions to;

provide a security feature to data transmitted and received between the first communication device and the second communication device;

wherein the flow controller comprises;

at least one memory storing instructions, and

at least one processor configured to execute the instructions to;

select one of a first path through the security device and a second path not through the security device as a communication path of the data based on a path information table where an attribute of the data and a communication path between the first communication device and the second communication device are associated,

when Transport Control Protocol (TCP) is determined to be used for data transmission, select the first path as a communication path from the first communication device to the second communication device before a TCP connection between the first communication device and the second communication device is established and the second path as a communication path from the first communication device to the second communication device after the TCP connection between the first communication device and the second communication device is established; and

when User Datagram Protocol (UDP) is determined to be used for data transmission, select the first path as a communication path from the first communication device to the second communication device and the second path as a communication path from the second communication device return to the first communication device.

2. The path control system according to claim 1, wherein

the first communication device, the second communication device and the security device update a flow information management table when receiving a control instruction signal for the communication path of the data selected in the flow controller.

3. The path control system according to claim 1, wherein

the at least one processor of the flow controller is further configured to execute the instructions to collect load information from the first and second communication devices and the security device and select a communication path of the data based on the load information.

4. The path control system according to claim 1 wherein the security feature includes at least one of a firewall feature, an antivirus feature, an Universal Resource Locator (URL) filtering feature and an Intrusion Prevention System (IPS) feature.

5. The path control system according to claim 1, wherein

the attribute of the data includes at least one of source identification information set to the data and protocol information.

6. The path control system according to claim 1, wherein

the at least one processor of the flow controller is further configured to execute the instructions to select a third path different from the first and second paths as a communication path of the data when determining that at least one of the first communication device, the second communication device and the security device is in a high load state.

7. The path control system according to claim 1, wherein the first communication device, the second communication device and the security device update a flow information management table when receiving a control instruction signal for the communication path of the data selected in the flow controller, and

wherein the flow controller collects load information from the first and second communication devices and the security device and selects a communication path of the data based on the load information.

8. The path control system according to claim 1, when UDP is used for data transmission, different paths are selected for an outward path and a return path, and when TCP is used for data transmission, different paths are selected before and after the TCP connection.

9. A control device comprising:

at least one memory storing instructions, and

at least one processor configured to execute the instructions to;

select one of a first path through a security device that provides a security feature to data transmitted and received between a first communication device and a second communication device and a second path not through the security device as a communication path of the data based on a path information table where an attribute of the data transmitted and received between the first communication device and the second communication device and a communication path between the first communication device and the second communication device are associated,

when Transport Control Protocol (TCP) is determined to be used for data transmission, select the first path as a communication path from the first communication device to the second communication device before a TCP connection between the first communication device and the second communication device is established and the second path as a communication path from the first communication device to the second communication device after the TCP connection between the first communication device and the second communication device is established, and

when User Datagram Protocol (UDP) is determined to be used for data transmission, select the first path as a communication path from the first communication device to the second communication device and the second path as a communication path from the second communication device return to the first communication device.

10. The control device according to claim 9,

wherein the first communication device, the second communication device and the security device update a flow information management table when receiving a control instruction signal for the communication path of the data selected.

11. The control device according to claim 9, wherein the at least one processor is configured to execute the instructions to:

collect load information from the first and second communication devices and the security device and selects a communication path of the data based on the load information.

12. A path control method comprising:

selecting one of a first path through a security device that provides a security feature to data transmitted and received between a first communication device and a second communication device and a second path not through the security device as a communication path of the data based on a path information table where an attribute of the data transmitted and received between the first communication device and the second communication device and a communication path between the first communication device and the second communication device are associated;

when Transport Control Protocol (TCP) is determined to be used for data transmission, selecting the first path as a communication path from the first communication device to the second communication device before a TCP connection between the first communication device and the second communication device is established and the second path as a communication path from the first communication device to the second communication device after the TCP connection between the first communication device and the second communication device is established, and

when User Datagram Protocol (UDP) is determined to be used for data transmission, selecting the first path as a communication path from the first communication device to the second communication device and the second path as a communication path from the second communication device return to the first communication device.

13. The path control method according to claim 12,

wherein the first communication device, the second communication device and the security device update a flow information management table when receiving a control instruction signal for the communication path of the data selected.

14. The path control method according to claim 12, further comprising of collecting load information from the first and second communication devices and the security device and selecting a communication path of the data based on the load information.

15. The path control method according to claim 12, further comprising of selecting a third path different from the first and second paths as a communication path of the data when determining that at least one of the first communication device, the second communication device and the security device is in a high load state.