Patent Description:
In recent years, an OpenFlow technology has been disclosed. <NPL>], <NPL>, Tokukai <CIT>, and Tokukai <CIT> A describe the OpenFlow. In the OpenFlow, a communication method between an OpenFlow Switch (hereinafter referred to as OFS) function and an OpenFlow Controller (hereinafter referred to as OFC), which is a control device thereof, is defined. The OFS and the OFC are connected with each other through a control path which is called a secure channel. The OFS is controlled by a single OFC.

The OFS includes a flow table therein. In the flow table, at least a set of a header field for identifying a packet flow and processing of the packet is registered as an entry. The header field for identifying a packet flow is called a matching rule. The header field is composed of a plurality of tuples, each of which can designate a wildcard. If the wild card is designated, a range of the flow can be represented as a group. For example, suppose that a transmission source IP (Internet Protocol) address of a header field of a certain entry is designated, and the other tuples are set to wildcards. At the time, the set entry represents a group of all flows transmitted from the designated IP address. All packets transmitted from the designated IP address corresponds to the set entry regardless of the address.

The processing of the packet is called an action. The action includes at least transfer to the designated port, transfer to the OFC, turnover transfer to an input port, abandonment, and the like. The transfer to the designated port is used for packet transfer to the next switch. The transfer to the OFC is mainly used for inquiry of a processing method of the packet.

Receiving the packet, the OFS searches the flow table. If an entry which matches the received packet exists, packet processing is performed in accordance with the action of the matched entry. Priority can be set in the entry. If the packet matches a plurality of entries, the action of the entry with the highest priority is employed.

If no entry which matches the received packet exists in the flow table, the OFS inquires of the OFC how to perform processing of the received packet. At this time, the OFS transfers a part of or all of the packets to the OFC through secure channel. The OFC receiving the inquiry about the processing adds the entry to the flow table, if necessary, and informs the OFS of the processing method.

Tokukai <CIT> and Tokukai <CIT>disclose the network architecture having a control device with a control function and a switch with a transfer function which is controlled by the control device.

The OpenFlow disclosed in the OpenFlow: Enabling Innovation in Campus Networks, OpenFlow Switch Specification, Tokukai <CIT>, and Tokukai <CIT>, and the architecture disclosed in Tokukai <CIT> and Tokukai <CIT> are network systems which are based on the premise that a switch operation is finely controlled by a single controller.

The paper entitled "<NPL>et al, explores a method of virtualising a network, and describes a system called FlowVisor which uses OpenFlow as a hardware abstraction to sit logically between control and forwarding paths on a network device. FlowVisor is deployed to slice a production network, such that there is strong isolation between each slice.

The paper entitled "FlowChecker: Configuration Analysis and Verification of Federated OpenFlow Infrastructures" by Ehab Al-Shaer and Saeed Al-Haj of the Univerity of North Carolina, discusses a tool called FlowChecker which identifies intra-switch misconfiguration within a single FlowTable. The paper also describes inter-switch or inter-federated inconsistencies in a path of OpenFlow switches across the same or different OpenFlow infrastructures.

Another example of the prior art can be found in <NPL>.

In the documents above, when a plurality of controllers are arranged, it is impossible to control the switch by the plurality of controllers.

We have appreciated it would be desirable to provide a communication terminal, a communication method, and a program, which can solve the problem described above.

According to the invention, even though a plurality of controllers or control devices controlling a switch or a communication terminal are arranged, the plurality of controllers or the plurality of control devices can control the switch or the communication terminal.

Exemplary embodiments of the present invention is described in detail with reference to the drawings.

<FIG> illustrates a configuration example of a communication device <NUM> of a first exemplary embodiment of the invention. In <FIG>, the communication device <NUM> includes a storage means <NUM>, a searching means <NUM>, and an inquiry means <NUM>. The communication device <NUM> connects with a control device, which is not illustrated. The communication device <NUM> is controlled by the control device.

The storage means <NUM> associates information for identifying a packet with processing of the packet and stores it therein.

When receiving the packet, the searching means <NUM> searches the processing corresponding to the received packet in the storage means <NUM>.

If the processing searched by the searching means <NUM> is an inquiry to the control device, the inquiry means <NUM> performs the following operations. The inquiry means <NUM> initially determines the control device to be inquired on the basis of an entry of the storage means <NUM> corresponding to the received packet. Next, the inquiry means <NUM> performs the inquiry addressed to the determined control device.

Operations of the first exemplary embodiment are described below using a flow chart in <FIG>.

The searching means <NUM> searches the processing corresponding to the received packet in the storage means <NUM> (S1001).

If the processing searched by the searching means <NUM> is the inquiry to the control device, the inquiry means <NUM> determines the control device to be inquired on the basis of the entry of the storage means <NUM> (S <NUM>).

Next, the inquiry means <NUM> performs the inquiry addressed to the control device determined in S1002 (S1003).

As described above, in the first exemplary embodiment, the communication device <NUM> includes the storage means <NUM>, the searching means <NUM>, and the inquiry means <NUM>. However, each of these means may be included not only in the communication device, but a communication terminal or other communication apparatus.

As described above, according to the first exemplary embodiment, the communication device determines the control device which is a processing inquiry destination of the received packet and inquires thereof. As a result, the control device which receives the inquiry can determine the processing of the received packet. Therefore, according to the first exemplary embodiment, since one control device to control the received packet can be determined even though a plurality of control devices to control the communication device are arranged, the communication device can be controlled by the plurality of control devices.

<FIG> is a diagram illustrating a configuration example of a communication system of a second exemplary embodiment. A communication system <NUM> includes a plurality of controllers <NUM> connected with a network, which is not illustrated, and a plurality of switches <NUM>. In an example of <FIG>, a controller <NUM>-A, a controller <NUM>-B, a controller <NUM>-C, and a controller <NUM>-D are arranged as the controller <NUM>. Hereinafter, the four controllers are described as the controller <NUM> if it is not necessary to be distinguished.

The switch <NUM> is connected with the plurality of controllers <NUM> through a control path. The controller <NUM> connects with the switch <NUM> to be controlled by the controller <NUM> and transmits/receives a control message to/from the switch <NUM>.

In the example of <FIG>, two switches <NUM> are arranged and one switch connects with the controller <NUM>-A, and the other switch connects with the controller <NUM>-B. In two sections, a section from the controller <NUM>-C to the controller <NUM>-A, and a section from the controller <NUM>-D to the controller <NUM>-B, dashed lines with arrows are depicted to show connection relations. This means that a controller may restrict a communication range controlled by the other controller.

<FIG> illustrates a configuration example of the switch <NUM>. According to <FIG>, the switch <NUM> includes control communication means <NUM>, flow table management means <NUM>, flow identification means <NUM>, data processing means <NUM>, and a flow table <NUM>.

The control communication means <NUM> connects with the controller <NUM>, the flow table management means <NUM>, and the flow identification means <NUM>. When receiving the control message from the controller <NUM>, the control communication means <NUM> sends a control instruction to the flow table management means <NUM>. When the flow table management means <NUM> feeds back a control result, the control communication means <NUM> sends the control message to the controller <NUM>, when necessary.

<FIG> is a diagram illustrating a configuration example of the control communication means <NUM>. According to <FIG>, the control communication means <NUM> includes controller designation processing inquiry means <NUM>.

The controller designation processing inquiry means <NUM> receives an inquiry as to contents of processing of a packet and designation of the controller, and inquires of the controller the processing.

The flow table management means <NUM> manages information described in the flow table. The flow table management means <NUM> is described below in detail.

The flow identification means <NUM> identifies a flow including the packet which reaches the data processing means <NUM>. The flow identification means <NUM> connects with the flow table <NUM>. The flow identification means <NUM> searches the processing of the identified flow in the flow table <NUM>.

The flow table <NUM> stores contents of flow processing. A configuration of the flow table <NUM> is illustrated in <FIG>, as an example. Entries of the flow table <NUM> include at least priority, a matching rule, and an action. The priority, a, k, n, and m are natural numbers. The magnitude relation thereof is k < n < m < a. Therefore, in the example of <FIG>, the entries are arranged in descending order of priority. The matching rule stores tuples, like an IP address, and a MAC (Media Access Control) address, as described in the background art. A way how to process a packet suitable to the matching rule is described in the action.

In the second exemplary embodiment, an action to inquire as to processing by designating the controller may be registered to a packet suitable to the matching rule. For example, with respect to a packet belonging to the flow A, an inquiry as to processing to the controller A is performed, and with respect to a packet belonging to the flow C, an inquiry as to processing to the controller B is performed. Thereby, for example, since an inquiry as to processing to the controller A is performed when the switch <NUM> receives a packet belonging to the flow A, the controller A obtains the operation authority for the flow A. The processing described in the background art may be registered as the action. For example, with respect to a packet belonging to the flow B, processing of transferring to the designated port is performed.

The data processing means <NUM> receives a packet from other switch connected with the switch <NUM>. When receiving the packet, the data processing means <NUM> transmits a part of the packet, the whole packet, or a copy of the packet to the flow identification means <NUM>. The flow identification means <NUM> performs matching with the entry of the flow table <NUM> to identify the flow, and outputs the action. The data processing means <NUM> receives the action and performs packet processing.

A method of setting the operation authority in the entry of the flow table <NUM> in the switch <NUM> by the controller <NUM> is described below. The controller <NUM> describes operation authority information as addition information of the control message for instructing the switch <NUM> to operate the entry of the flow table <NUM>. Besides the control message, the controller <NUM> may transmit a special message designating the operation authority to the switch <NUM>.

<FIG> illustrates an example of an entry edit command transmitted from the controller <NUM> to the switch <NUM>. The entry of <FIG> defines inquiring of the controller A processing as an action with respect to the packet with the priority of a and the matching rule of the flow A. The controller <NUM> transmits the entry of <FIG> to the switch <NUM> and sets the entry of <FIG> in the flow table <NUM> of the switch <NUM>.

The item "Others : ReadOnly" shows the operation authority of the entry of <FIG>. The target of the operation authority may be discretely designated by the controller A, the controller B, or the like, or may be designated by a group of the controllers. By a macro using the relation between the controller designating the authority and the other controller, it may be designated. In the example of <FIG>, it is designated that a controller other than the controller designating the authority is allowed to only read. The entry edit command in <FIG> gives the controller A the authority thereof. "Others : ReadOnly" shows that a controller other than the controller A is allowed to only read.

Next, the flow table management means <NUM> is described. As illustrated in <FIG>, the flow table management means <NUM> includes authority management/determination means <NUM>, entry addition information storage means <NUM>, and flow table operation means <NUM>.

The authority management/determination means <NUM> includes entry operation authority management/determination means <NUM> and flow range determination means <NUM>. The entry operation authority management/determination means <NUM> connects with the control communication means <NUM>, the entry operation authority management/determination means <NUM>, the entry addition information storage means <NUM> and the flow table operation means <NUM>. The flow range determination means <NUM> connects with the flow table operation means <NUM>. The entry addition information storage means <NUM> connects with the flow table operation means <NUM>. The flow table operation means <NUM> connects with the flow table <NUM>.

The authority management/determination means <NUM> determines the authority in response to a request for the operation of the entry from the controller <NUM> as shown in <FIG>, and performs processing according to the determination result.

The entry addition information storage means <NUM> stores authority information corresponding to the entry of the flow table <NUM>. The authority information includes permission which is uniquely decided for each controller, and owner information.

The entry operation authority management/determination means <NUM> manages the operation authority of the entry and determines whether or not to operate in response to the request for the operation of the entry from the controller <NUM>. When the operation authority is set from entry operation authority instruction means <NUM> to the entry of the flow table <NUM> through the control communication means <NUM>, the entry operation authority management/determination means <NUM> stores information of the operation authority in the entry addition information storage means <NUM>. When the controller <NUM> refers to and edits the entry through the control communication means <NUM>, the entry operation authority management/determination means <NUM> refers to the operation authority information of the entry addition information storage means <NUM>. Furthermore, the entry operation authority management/determination means <NUM> inquires of the flow range determination means <NUM> if the edit of the entry includes change of the matching rule, and determines whether or not to allow the operation in view of the returned determination result.

When the controller <NUM> registers the entry, the flow range determination means <NUM> determines whether or not to perform the control by the controller <NUM>. Specifically, it is determined whether or not the range in which the controller <NUM> requests the control falls within the flow range in which the control is allowed. The flow range to be allowed may be, for example, a union of the matching rules of the entry with the action for inquiring of the controller. The invalidated flow range may be the matching rule, having the action for inquiring of the other controller, which has higher priority than that of the entry which is grounds for the allowed range.

<FIG> illustrates an example of the entry addition information stored corresponding to the entry of the flow table <NUM> and the entry addition information storage means <NUM>. An example of determination which is performed in the flow range determination means <NUM> is explained using <FIG>. In the flow table, the first column shows priority, the second column shows the matching rules, and the third column shows the actions. In the entry addition information, the first column shows operation authorities of the corresponding entry in the flow table <NUM>, and the second column shows owners of the corresponding entry. In the example in <FIG>, the entries are arranged in descending order of priority, like <FIG>. In the example in <FIG>, the controller A limits the range of the flow where the controller B controls. "Controller: A" in the column of the actions means that when receiving a packet which matches the flow A, the switch <NUM> inquires of the controller A about processing. In this case, there are two conditions that the controller B can register the entry with the matching rule which is the flow B. One of the conditions is that the range of the flow shown by the flow B is included in the range of the flow shown by the flow C which is the matching rule of the entry of the controller A having the action for inquiring of the controller B. The other is that the magnitude relationship of priority of the entry is a-n < a-k < a.

<FIG> are flowcharts illustrating an operation of the communication system <NUM> of the second exemplary embodiment. The operation of the second exemplary embodiment is described using the flowcharts.

<FIG> is the flowchart illustrating the operation which is performed when the switch <NUM> receives a packet in the second exemplary embodiment.

The data processing means <NUM> receives a packet from different communication device in a network which is not shown (S11). Next, the flow identification means <NUM> determines whether or not the received packet matches the matching rule of the entry of the flow table <NUM> (S12).

If the entry of the flow table <NUM> which matches the received packet exists, the flow identification means <NUM> determines whether or not the action of the matched entry is an inquiry as to processing designating a controller (S13).

If it is determined the action of the matched entry is the inquiry as to the processing designating the controller, the controller designation processing inquiry means <NUM> performs the inquiry as to processing to the designated controller (S14).

If it is determined the action of the matched entry is not the inquiry as to the processing designating the controller, the data processing means <NUM> performs packet processing according to the action of the matched entry (step S16). The data processing means <NUM>, for example, transfers the received packet to other communication device, or abandons the received packet.

If it is determined that the packet does not match the matching rule of the entry of the flow table in S12, the control communication means <NUM> inquires of the controller which is set as default about the processing (S15).

<FIG> and <FIG> are flowcharts illustrating operations which are performed when the switch <NUM> receives the entry edit command from the controller <NUM>.

Initially, the control communication means <NUM> receives the entry edit command from the controller <NUM> (S21).

Next, the flow table management means <NUM> determines whether or not the received command is the command for adding the entry to the flow table <NUM> (S22).

If it is determined that the received command is not the command for adding the entry to the flow table in S22, an operation of S23 is performed. The entry operation authority management/determination means <NUM> refers to the authority information stored in the entry addition information storage means <NUM> (S23). After that, the entry operation authority management/determination means <NUM> determines whether or not the controller which sends the command is allowed to perform a request operation for the entry which is the edit target (S24).

If it is determined that the entry edit command is the command for adding the entry to the flow table in S22, processing of S26 is performed. The processing of S26 is described below.

If it is determined that the request operation for the entry which is the edit target is allowed in S24, the authority management/determination means <NUM> performs processing of S25. The authority management/determination means <NUM> determines whether or not the entry edit command is the command which changes priority of the entry or the matching rule (S25).

If the controller which sends the entry edit command is not allowed to perform the request operation for the entry which is the edit target in S24, an operation command is rejected (step S30).

If it is determined that the entry edit command is the command which changes priority of the entry or the matching rule in S25, the flow range determination means <NUM> performs processing of S26. The flow range determination means <NUM> determines whether or not the priority of the entry or the matching rule after change which is requested by the entry edit command falls within the range which is allowable for the request source controller (S26).

If it is determined that the priority of the entry or the matching rule after change which is requested by the entry edit command falls within the range which is allowed for the controller in S26, the entry operation authority management/determination means <NUM> performs processing of S27. The entry operation authority management/determination means <NUM> determines whether or not new addition is included in entry operation authority designation, or whether or not change is included therein and whether neither new addition nor change is included (S27).

If it is determined that new addition or change is included in entry operation authority designation in S27, the entry operation authority management/determination means <NUM> performs processing of S28. In the entry operation authority management/determination means <NUM>, the entry operation authority of the entry addition information storage means <NUM> is edited (step S28). After that, the flow table operation means <NUM> performs the operation command (step S29). If it is determined that neither new addition nor change is included in entry operation authority designation in S27, processing of S28 is skipped and processing of S29 is performed.

The controller <NUM> may transmit a command for referring to the flow table to the switch <NUM> in order to manage the switch <NUM>. Hereinafter, the command is called a flow table reference command. <FIG> is a flowchart illustrating an operation which is performed when the switch <NUM> receives the flow table reference command from the controller <NUM>.

First, the switch <NUM> receives the flow table reference command from the controller <NUM> through the control communication means <NUM> (S31).

Next, the entry operation authority management/determination means <NUM> refers to the authority information stored in the entry addition information storage means <NUM> (S32).

After S32, the entry operation authority management/determination means <NUM> extracts the entry, whose reference authority is owned by the controller which is the command transmission source (S33).

The flow table operation means <NUM> obtains, from the flow table <NUM>, the entry extracted in S33 (S34).

In the entry operation authority management/determination means <NUM>, the entry addition information corresponding to the entry extracted in step S32 is obtained from the entry addition information storage means <NUM> (S35).

Next, the entry operation authority management/determination means <NUM> duplicates the entry addition information obtained in S35 (S36).

In addition, the entry operation authority management/determination means <NUM> converts the authority information in the entry addition information duplicated in S36 into authority which the controller requesting reference has (S37).

Finally, the control communication means <NUM> transmits the entry obtained in S34 and the entry addition information converted in S37 to the controller <NUM> requesting reference (S38).

As described above, the communication system of the second exemplary embodiment uses the action designating any one of the controllers <NUM> as the action for the entry of the flow table <NUM>. Thereby, it becomes possible to separate the controllers of which the processing of the packet is inquired, for each flow range. As a result, for example, the control, in which one controller is determined for a specific flow, is possible.

The switch <NUM> holds the authority information of the controller <NUM> for each entry and restricts the operation for the entry of the flow table <NUM>. Thereby the flow range which the controller <NUM> can control is restricted. Therefore, it is possible to prevent a different controller from unintentionally overwriting a control policy.

On the basis of the above operations, it becomes possible to directly control the switch <NUM> by a plurality of controllers <NUM> while determining a control range and an authority range. Consequently, according to the second exemplary embodiment, even though a plurality of controllers <NUM> to control the switch <NUM> are arranged, one controller <NUM> to control the received packet can be determined. It is therefore possible to control the switch <NUM> by the plurality of controllers <NUM>.

A third exemplary embodiment of the invention is described below. In the third exemplary embodiment, the flow table management means <NUM> of the switch <NUM> and a flow table <NUM> are different from those of the second exemplary embodiment. Items which are different from the flow table management means <NUM> are focused and described below. Descriptions of the configuration and the operation similar to those of the second exemplary embodiment are omitted.

<FIG> is a block diagram illustrating flow table management means <NUM> of the third exemplary embodiment. In <FIG>, the flow table management means <NUM> includes authority management/determination means <NUM> and the flow table operation means <NUM>. The authority management/determination means <NUM> includes entry operation authority management/determination means <NUM> and flow range determination means <NUM>. The entry operation authority management/determination means <NUM> connects with the control communication means <NUM>, the flow range determination means <NUM> and the flow table operation means <NUM>.

The entry addition information storage means <NUM> is not included compared with the flow table management means <NUM> of the second exemplary embodiment. In the third exemplary embodiment, the flow table <NUM> stores information which the entry addition information storage means <NUM> of the second exemplary embodiment stores. <FIG> illustrates an example of the flow table <NUM> of the third exemplary embodiment. In <FIG>, the flow table <NUM> stores the authority information in addition to the information which the flow table <NUM> of the second exemplary embodiment stores.

In the switch <NUM> of the third exemplary embodiment, when it is necessary to refer to or edit the entry addition information in the operation which is performed when the entry edit command is received from the controller <NUM>, the flow table <NUM> is referred to or edited.

<FIG> is a flowchart illustrating operations which are performed when the switch <NUM> of the third exemplary embodiment receives the flow table reference command. The operation illustrated in <FIG> differs in the operations at and after S34 from the operation of the second exemplary embodiment. The other operations similar to those of the second exemplary embodiment have the same reference numerals as those of <FIG>, and detailed descriptions thereon are omitted.

The entry operation authority management/determination means <NUM> duplicates the entry obtained in S33 and S34 (S236).

Next, the entry operation authority management/determination means <NUM> converts the authority information, which the entry duplicated in S236 includes, into the authority which the controller requesting the reference includes (S237).

Finally, the control communication means <NUM> informs the controller <NUM> requesting the reference, of the entry converted in S237(S238).

The communication system <NUM> of the third exemplary embodiment has the same effect as the second exemplary embodiment. That is, the action designating any one of the controllers <NUM> is used as the action for the entry of the flow table <NUM> of the third exemplary embodiment. Thereby, it becomes possible to separate the controllers of which the processing of the packet is inquired, for each flow range. As a result, for example, the control, in which one controller which controls for a specific flow is determined, is possible.

The switch <NUM> holds the authority information of the controller <NUM> for each entry and restricts the operation for the entry of the flow table <NUM>. Thereby the flow range which the controller <NUM> can control is restricted. Therefore, it is possible to prevent a different controller from unintentionally overwriting the control policy.

On the basis of the above operations, it becomes possible to directly control the switch <NUM> by a plurality of controllers <NUM> while determining a control range and an authority range. Consequently, according to the third exemplary embodiment, even though a plurality of controllers <NUM> to control the switch <NUM> exist, one controller <NUM> to control the received packet can be determined. It is, therefore, possible to control the switch <NUM> by the plurality of controllers <NUM>.

<FIG> illustrates a switch <NUM> of a fourth exemplary embodiment of the invention. As shown in <FIG>, the switch <NUM> of the fourth exemplary embodiment differs from that of the second exemplary embodiment in control communication means <NUM>, flow table management means <NUM> and a flow table <NUM>. The other elements are similar to those of the second and third exemplary embodiments. The other elements similar to those of the second exemplary embodiment have the same reference numerals as <FIG>, <FIG>, and <FIG>, and detailed descriptions thereon are omitted.

In the fourth exemplary embodiment, an inquiry as to processing designating the controller may not be registered in the flow table <NUM> as the action. The case, in which that an inquiry as to processing designating the controller is not registered in the action of the flow table <NUM>, is described below.

In the fourth exemplary embodiment, the control communication means <NUM> includes the controller designation processing inquiry means <NUM>, processing inquiry destination allocation means <NUM>, and a controller flow table <NUM>. In the fourth exemplary embodiment, processing inquiry destination management means <NUM> is added to the flow table management means <NUM> of the second exemplary embodiment.

The newly added elements in the fourth exemplary embodiment are described. First, the processing inquiry destination allocation means <NUM> chooses a controller to be inquired, in response to the inquiry to the controller <NUM> as to contents of processing of the packet. The processing inquiry destination allocation means <NUM> converts a processing inquiry instruction without designating the controller into a processing inquiry instruction designating the controller.

<FIG> illustrates an example of the controller flow table <NUM>. In <FIG>, the controller flow table <NUM> includes, as the entry, at least the priority, the matching rule and an identifier of the destination controller. The identifier of the controller may be any one which is uniquely decided for the controller.

The processing inquiry destination management means <NUM> manages an allocation standard of a processing inquiry destination, and converts an action part of the entry.

<FIG> and <FIG> are flowcharts illustrating operations of the switch <NUM> of the fourth exemplary embodiment of the invention. The operations similar to that of the second exemplary embodiment have the same reference numerals as <FIG> and descriptions thereof are omitted.

<FIG> is the flowchart illustrating operations which are performed when the switch <NUM> receives a packet. First, the switch <NUM> receives a packet and determines whether or not the packet matches the matching rule of the entry in the flow table (S11, S12).

In S12, if it is determined that the received packet matches the matching rule of the entry in the flow table, the flow identification means <NUM> determines whether or not the action of the entry in the matched matching rule is an inquiry as to processing to a controller (S13).

In S13, if it is determined that the action of the matched entry is the inquiry as to processing to the controller, the processing of S317 is performed. The processing inquiry destination allocation means <NUM> searches the controller of which processing of the received packet is inquired, with reference to the controller flow table <NUM> (S317). Specifically, the processing inquiry destination allocation means <NUM> searches the entry having the matching rule of the controller flow table <NUM> corresponding to the matching rule which the received packet matches. The processing inquiry destination allocation means <NUM> obtains the destination controller of the searched entry as the inquiry destination.

Next, the processing inquiry destination allocation means <NUM> converts a processing inquiry to the controller without designating a destination into a processing inquiry addressed to the searched controller (S318).

After that, the controller designation processing inquiry means <NUM> inquires of the designated controller about the processing (S14).

<FIG> is a flowchart illustrating operations which are performed when the controller <NUM> instructs the switch <NUM> to register the entry designating the processing inquiry destination. In the second and the third exemplary embodiments, if the instruction to register the entry is received, it is directly registered in the flow table. In the fourth exemplary embodiment, the registration in the controller flow table <NUM> is further required.

The control communication means <NUM> receives the instruction to register the entry designating the processing inquiry destination, from the controller <NUM> (S341).

Next, the authority management/determination means <NUM> performs authority determination of the entry, like the second exemplary embodiment (S342).

Next, the processing inquiry destination management means <NUM> registers the entry which takes the matching rule as key and takes the identifier of the controller as value on controller flow table <NUM>, and gives priority to the entry (S343).

The processing inquiry destination management means <NUM> replaces the action for instructing the entry registration into the processing inquiry without designating a controller (S344).

Finally, the flow table operation means <NUM> registers the entry in the flow table <NUM> (S345).

The communication system <NUM> in the fourth exemplary embodiment includes the same effect as the communication system <NUM> of the second and the third exemplary embodiment. That is, with respect to the action of the processing inquiry to the controller in the entry of the flow table <NUM> of the fourth exemplary embodiment, the switch <NUM> stores the controller to be the inquiry destination, in the controller flow table <NUM>. Thereby the controllers of which the packet processing is inquired can be separated for each flow range. As a result, for example, the control, in which one controller which controls for a specific flow is determined, is possible.

The switch <NUM> holds the authority information of the controller <NUM> for each entry, and restricts operations with respect to the entry in the flow table <NUM>. Thereby, the controller11 restricts the controllable flow range. Therefore, it is possible to prevent a different controller from unintentionally overwriting the control policy.

On the basis of the above operations, it becomes possible to directly control the switch <NUM> by a plurality of controllers <NUM> while determining the control range and the authority range. Consequently, according to the third exemplary embodiment, even though a plurality of controllers <NUM> to control the switch <NUM> are arranged, one controller <NUM> to control the received packet can be determined. It is therefore possible to control the switch <NUM> by the plurality of controllers <NUM>.

The switch of each exemplary embodiment is optionally applicable to a communication terminal, other communication apparatus, and the like, and not limited to the switch.

In the exemplary embodiments, the network to which the OpenFlow is applied is explained, but the present embodiment is not limited thereto. The present embodiment is applicable to the network in which a control server centrally controls the switch, other than the OpenFlow.

Claim 1:
A switch (<NUM>, <NUM>) configured to process a packet, comprising:
a flow table (<NUM>) configured to store the contents of flow processing as control information, wherein entries of the flow table include a matching rule for identifying a flow of the packet, and an action for processing the packet;
an entry addition information storage means (<NUM>) configured to store authority information corresponding to the entries of the flow table (<NUM>);
a memory (<NUM>) storing program instructions;
and
a processor (<NUM>, <NUM>) configured to execute the program instructions to:
receive a request for controlling the switch (<NUM>) from one of a plurality of controllers (<NUM>) configured to control the switch (<NUM>, <NUM>);
access control information (<NUM>, <NUM>) corresponding to the request, based on authority information corresponding to each of the plurality of controllers,
wherein the authority information represents an authority to edit the control information and an authority for accessing the control information, wherein the authority for editing the control information and the authority for accessing the control information correspond to each of the plurality of controllers.