KR20190107524A - Devices and method for building group networks in Software Definition Data Center - Google Patents

Abstract

The present invention relates to a device for constructing a group network in a software-defined data center (SDDC), which is capable of suggesting an empirical business model, and a method thereof. According to the present invention, the device for constructing a group network in an SDDC comprises: a virtual data center design unit allowing a user, who receives a virtual data center user right, to configure a component of a virtual data center and a plurality of networks; a service design unit allowing a WEB/WAS/DB server of a logical network configuration, which performs communications through a corresponding VLAN, to be configured in the networks configured by the virtual data center design unit; and a group network design unit allowing the networks configured by the virtual data center design unit to be interworked by a physical L2 network switch.

Description

Devices and method for building group networks in Software Definition Data Center

The present invention relates to an apparatus and method for building a group network in a software definition center.

The concept of software definition, which emerged as SDN, quickly spread beyond the software-defined network to software-defined storage, software-defined data centers, and software application services, and expanded to the concept of Software Defined Anything / Everything.

The concept defined for realizing a flexible infrastructure through software has been gradually expanded to include infrastructure management and policy as well as areas beyond infrastructure such as security, and business and services.

At this point, it is important to be able to increase flexibility through 'software definition' and to be able to secure programmability according to standards that are not dependent on a specific vendor.

Agility and interoperability are two important philosophies of SDx. In the former case, the specific methods are different in each field such as network and storage.

On the other hand, in the latter case, related companies are showing various movements such as pushing SDx initiatives to strengthen the standard in the market.

The software-defined data center SDDC (Sofware-defined data center) is a system that aggregates and serves various infrastructures through such software definition.

The key to SDDC is integration. Servers, storage, and network equipment all operate on a software-defined basis for efficient management and management. Both storage and network functions are implemented on the server infrastructure with open software.

SDDC means 'breaking down the barriers' of software-defined entire data centers. In the past, the equipment was tied to functionality, so you had to approach it by machine. However, in the SDDC environment, there is no need for separate access for each device for data center management. Through the integrated management system that binds each function to SW, it is managed as a whole.

Such SDDCs naturally entered the SDx realm as the main elements of the data center from storage to the network became available as SW. SDDC can be flexibly responded to SW without adding physical storage and network. There is a need for concrete utilization of various business models.

As such, SDDC refers to the implementation of deployment, operation and management by automating various data sensor components with software through API (application programming interface).

However, due to the broad scope of data centers, there is a difficulty in sustainable development without a business model that includes a concrete structure and how to implement related new technologies.

Domestic Publication No. 10-2017-65166 Domestic registration number 10-1535502

The present invention has been made to solve the above problems, and provides an apparatus and method for building a group network in a software definition center that can define an advanced target structure and present an empirical business model through application of related technologies. There is.

The apparatus of the present invention includes: a virtual data center (vDC) design unit for allowing a user to be granted virtual data center user rights to configure a plurality of networks with components of a virtual data center; A service design unit configured to configure a server for WEB / WAS / DB use in a logical network configuration communicating with a VLAN corresponding to a plurality of networks configured in the virtual data center design unit; And a group network design unit configured to interwork a plurality of networks configured by the virtual data center design unit by a physical L2 network switch.

In addition, the virtual data center design unit of the device of the present invention provides a component composed of an icon and a canvas so that a user to whom a virtual data center user authority is granted can configure a component and a network of the virtual data center.

In addition, the virtual data center design unit of the device of the present invention configures a basic private network (L2) as a network in a "Region" of the components of the canvas by a user who is granted the user rights of the virtual data center. In addition, when creating a separate network, a private network icon is added so that an additional private network (L2) can be configured in the area.

In addition, the virtual data center design unit of the device of the present invention may add a "Public" component to a basic private network or an additional private network that requires the user of the virtual data center to be connected to the Internet for customer service. It assigns a public IP from the defined pool.

In addition, the virtual data center design unit of the device of the present invention includes a public network, a plurality of firewalls (FW), a web application firewall (WAF), and a load balancer for the basic private network and the additional private network. (LB: Load Balancer) and Virtualized L2 Switch (Open Vswitch, OVS).

In addition, the virtual data center design unit of the apparatus of the present invention performs the installation of the external network component between the basic private network and the additional private network and the installation of the internal network component in the additional private network.

In addition, the service design unit of the apparatus of the present invention configures the WEB server in the external network component, and configures the WAS server and DB server in the internal network component.

In addition, the service design unit of the device of the present invention uses a component composed of an image normalized to a template.

On the other hand, the method of the present invention comprises the steps of (A) the virtual data center design unit to allow a user to be granted a virtual data center user authority to configure a plurality of networks with components of the virtual data center; (B) allowing the service design unit to configure a server for WEB / WAS / DB in a logical network configuration that communicates with a corresponding VLAN in a plurality of networks configured in the virtual data center design unit; And (C) causing the group network design unit to interwork a plurality of networks configured by the virtual data center design unit by a physical L2 network switch.

In addition, in the step (A) of the method of the present invention, the virtual data center design unit provides a component and a canvas composed of icons so that a user to whom a virtual data center user authority is granted can check the components and network of the virtual data center. Make it configurable.

In addition, the step (A) of the method of the present invention (A-1) the virtual data center design unit is a private private network (Private) to the network in the "area" of the components of the canvas, the user authorized the user of the virtual data center Network L2); And (A-2) the virtual data center design unit additionally configures an additional private network (L2) in the area by adding a private network icon when configuring a separate network.

In addition, in the step (A) of the method of the present invention, the (A-3) the virtual data center design unit may be configured to include a basic private network or an additional private network that requires a user who is authorized to access the virtual data center to need Internet connection for customer service. Public) "component can be added and further includes the step of assigning a public IP from a defined pool.

In addition, the virtual data center design unit of the method of the present invention includes a public network, a plurality of firewalls (FW), a web application firewall (WAF), and a load balancer for the basic private network and the additional private network. (LB: Load Balancer) and Virtual L2 Switch (Open Vswitch, OVS).

In addition, the step (A) of the method of the present invention includes (A-4) performing the installation of the external network component between the basic private network and the additional private network and the installation of the internal network component in the additional private network. It includes more.

Further, in the step (B) of the method of the present invention, the service design unit configures the WEB server in the external network component, and configures the WAS server and the DB server in the internal network component.

Further, in the step (B) of the method of the present invention, the service design unit uses a component composed of images normalized to a template.

The present invention can preempt the Technical Architecture by presenting an SDDC empirical business model.

By presenting the convergence structure of next-generation technologies (SDN, NFV, Cloud) scattered and holding related business models, you can take the lead in the coming SDx market.

In particular, it is possible to preempt the technology structure compared to operators with common goals by applying it to the group network network (Private LTE, etc.) business considering the large-scale data center operation experience, technical maturity as the largest cloud provider in Korea, and long-term technology development direction.

In addition, the present invention enables to improve productivity / speed and reduce costs when building a group network through the SDDC.

In addition, in the present invention, the group network construction through the SDDC is separated into a virtual network through a virtual network / security device in a standard POD structure, and all resources of the entire SDDC are controlled and managed by a resource pool.

Compared to the average utilization rate of 15% of existing Legacy data centers, SDDC can use 100% of resources through virtualization, enabling the minimum physical device configuration. Initial investment savings are realized from the perspective of usage-based expansion investments from existing projected customer-based infrastructure investments.

In addition, all infrastructure configuration and network control are automated with APIs, reducing leaf-time.

1 is a block diagram of a software definition center to which the present invention is applied.
2 is an exemplary view showing a canvas provided by the SDDC integrated management system when configuring the vDC and network topology.
3 is a block diagram of a group network building apparatus in a software definition center according to an embodiment of the present invention.
4 is a flowchart of a method for establishing a group network in a software definition center according to an embodiment of the present invention.
FIG. 5 is a diagram illustrating a construction of external / internal network separation performed by the virtual data center design unit of FIG. 3.
6 is an exemplary diagram illustrating a service design process of an external network and an internal network performed by the service design unit of FIG. 3.
FIG. 7 is an exemplary view illustrating a group network design process performed by the group network design unit of FIG. 3.

As the inventive concept allows for various changes and numerous embodiments, particular embodiments will be described in detail with reference to the accompanying drawings.

The following examples are provided to assist in a comprehensive understanding of the methods, devices, and / or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification. The terminology used in the description is for the purpose of describing particular embodiments only and should not be limiting. Unless expressly used otherwise, the singular forms “a,” “an,” and “the” include plural forms of meaning. In this description, expressions such as "comprises" or "equipment" are intended to indicate certain features, numbers, steps, actions, elements, portions or combinations thereof, and one or more than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, actions, elements, portions or combinations thereof.

In addition, terms such as first and second may be used to describe various components, but the components are not limited by the terms, and the terms are used to distinguish one component from another component. Only used as

DETAILED DESCRIPTION Hereinafter, embodiments illustrating a group network building apparatus in a software definition center according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a group network building apparatus in a software definition center according to an embodiment of the present invention.

Referring to FIG. 1, in the software defined center according to an embodiment of the present invention, the apparatus for establishing a group network may include a software-defined data center (SDDC) integrated management system 100, a switching network 110, a private network 120, and an authorized network. (130), management network 140, Network Functions Virtualization (NFV) Orchestrator (200), Virtual Network Function (VNF: Virtual Network Function (VNF) (210-1 ~ 210-n), cloud orchestrator ( Cloud Orchestrator (300), Virtualization Server (310), Virtualization Storage (320), Virtualization Switch (330), Virtual Infrastructure Manager (VIM) 400, Virtualization Network Function Infrastructure (NFVI) Virtualization infrastructure 500).

In such a configuration, the switching network 110, the private network 120, the authorized network 130, and the management network 140 form a physical network infrastructure 600, and a virtualization network function unit 210-1 to ˜. 210-n), virtualization server 310, virtualization storage 320, virtualization switch 330, virtualization infrastructure manager 400, and virtualization network function infrastructure 500 may be referred to as a virtual network infrastructure 700. ).

The SDDC integrated management system 100 integrates the respective functions of the server, the storage, and the switch into software to operate and manage the software.

As such, the SDDC integrated management system 100 allows the servers, storage, and switches to be operated and managed on a software-defined basis to be efficient, and to be implemented on the server infrastructure with open software, whether server function, storage function, or switchable. do.

The SDDC integrated management system 100 integrates and manages information of each orchestrator (200, 300) (Orchestrator) and the physical / virtual network infrastructure (600, 700) so that the user can easily control the SDDC. As a system, it can be operated and managed through UI & UX.

In addition, since the SDDC integrated management system 100 provides a canvas when constructing a vDC and a network topology as shown in FIG. 2, the SDDC integrated management system 100 ensures an intuitive and flexible configuration, deviating from the concept of API / CLI-based construction and operation.

In addition, the NFV orchestrator 200 manages and deploys a virtual network / security device (VNF) of the data center.

The NFV orchestrator 200 virtualizes the physical network to configure the virtual network environment of the vDC, and creates and controls the configuration of the L2, L3, and L4 layer devices and the related network topology above the service level.

In addition, the NFV orchestrator 200 enables vDC network configuration (vXLAN) in place of SDN technology, and flexibly configures and assigns various predefined physical network networks to the vDC through the SDDC integrated management system 100. Let's do it.

On the other hand, the virtual network functions (210-1 ~ 210-n) (Virtual Network Function) includes a EMS for performing a conventional self-management system as a network set for supporting various applications.

The virtual network function unit 210-1 to 210-n provides a virtualized network function based on the virtualization network function infrastructure 500 of general-purpose server hardware 500 (x86-based hardware) rather than expensive dedicated equipment. .

One virtual network function unit 210-1 to 210-n is a unit that performs a specific network function (for example, includes a firewall, DPI, EPC system, etc.) to operate in an NFV environment as follows. The procedure should go on.

(1) VNF on-broading phase: VNF is officially registered in a catalog through NFVO, and corresponds to a stage in which a VM is created by a virtual infrastructure manager (VIM) 400.

(2) VNF Instantation step: Creates an instance that can execute the registered VNF. It checks whether the requestor has the right to create and allocates necessary resources from the VIM.

(3) Updating VNF Instant: This step replaces an existing VNF instance with a new on-broading state. Updates are required in situations where required resources or QoS translations occur or errors occur.

(4) Terminating VNF instance: This is the step of terminating network connection with all resources used to terminate the running instance.

Next, the Virtual Infrastructure Manager (VIM) 500 manages and controls computing, storage, and network resources used by the VNFs 210-1 through 210-n.

Here, resource management manages and distributes virtual / physical resources, manages and virtualizes the NFVI 500, and collects defect status and resource status information from the NFVI 500.

Openstack was used as the VIM 500.

The NFVI 500 is a physical hardware resource that supports computing, storage, and network functions. The NFVI 500 supports virtualization and execution of VNFs 210-1 to 210-n.

The NFVI 500 includes all hardware and software for deploying, managing, and executing the VNFs 210-1 to 210-n.

The NFVI 500 is a single entity that provides virtualized resources for both physical and virtual resources in view of the VNFs 210-1 to 210-n.

Here, the hardware resource refers to a physical resource including computing, storage, and network provided to the VNFs 210-1 through 210-n through the virtualization layer.

The virtualized resources abstract the physical resources through the virtualization layer and separate the software from the hardware.

Meanwhile, the cloud orchestrator 300 manages and manages all customer service resources (computing, storage, and network) of the virtual data center (vDC). In addition, a service network topology is generated and controlled using a virtualization switch / router 330 between the resources.

1 illustrates a virtualization server 310 and a virtualization storage 320 as a corresponding customer service resource, and illustrates the creation and control of a service network topology using the virtualization switch 330.

3 is a block diagram of a group network building apparatus in a software definition center according to an embodiment of the present invention.

Referring to FIG. 3, a group network building apparatus in a software definition center according to an embodiment of the present invention includes a virtual data center design unit 10, a service design unit 20, and a group network design unit 30. .

4 is a flowchart of a method for establishing a group network in a software definition center according to an embodiment of the present invention.

Referring to FIG. 4, the group network construction method in the software definition center according to an embodiment of the present invention includes a virtual data center design step S10, a service design step S20, and a group network design step S30. .

First, in the virtual data center design step (S10), the virtual data center design unit 10 allows a user to whom a virtual data center user authority is granted to configure a component and a network of the virtual data center through the corresponding function.

In this case, the virtual data center is a logical concept. A user who is granted the user authority of the virtual data center through the SDDC integrated administrator can configure the network and the components of the virtual data center through the corresponding function. Major users can be organized as shown in the table below.

user role Remarks Integrated Manager SDDC integrated management menu definition / VDC usage approval VDC user VDC network definition and configuration / service use approval Service user Service Definition and Configuration Integrated user VDC / Service Authority Default user VDC / Service Application

The virtual data center design unit 10 provides a component and a canvas composed of icons in order to increase flexibility of logical configuration and user accessibility.

The user who has been granted the user right of the virtual data center has a network of "Region 1" 11 of the components of the canvas provided by the virtual data center design unit 10 as shown in FIG. It configures a basic private network (L2) 12, and adds a private network icon when configuring a separate network to create an additional private network (L2) 13 in the region 1 (Region1). Configure.

The basic private network 12 and the additional private network 13 basically consist of a closed network without any interworking with the outside, and in case of physical / logical network interworking such as a wireless network or an internal network, a separate dedicated line or an overlay network is used. Interlock through.

The virtual data center design unit 10 is a "public network" component to a basic private network 12 or an additional private network 13 for which a user authorized to access a virtual data center needs internet connection for customer service. It allows you to add and assign a public IP from the defined pool.

As shown in FIG. 5, the virtual data center design unit 10 allows the external network component 14 to be located between the basic private network 12 to which the authorized network is assigned and the additional private network 13, and the additional private network. At 13, the internal network component 15 is located.

The installation of the external network component 14 between this basic private network 12 and the additional private network 13 and the installation of the internal network component 15 in the additional private network 13 are inputs of users authorized to the user in the virtual data center. It can be run by or run automatically.

The basic private network 12 includes a public network, a plurality of firewalls (FW), a web application firewall (WAF), a load balancer (LB), and a virtual L2 switch (LB). (Open Vswitch, OVS).

The additional private network 13 also includes a number of firewalls (FW) and virtual L2 switches. Although not shown here, the additional private network 13 may further include a web firewall (WAF) and a load balancer (LB).

Meanwhile, in the service design step (S20), the service design unit 20 uses a WEB / WAS / DB of a logical network configuration in which a user communicates with a VLAN corresponding to a network of the switch L2 configured in the virtual data center design unit 10. Configure the server, which is the same as the Cloud IaaS configuration.

In this regard, the service design unit 20 configures a WEB server in the external network component 14 and a WAS server and a DB server in the internal network component 16 as shown in FIG. 6.

This service design step (S20) is similar to the server farm design hierarchy in the concept of legacy data center.

In the L2 networks 12 and 13 configured in the virtual data center design step S10, a server for WEB / WAS / DB for a logical network configuration communicating with a corresponding VLAN is configured, which is the same as the Cloud IaaS configuration.

In this way, the user configures the server by selecting from the created L2 networks 12 and 13 with the authority of the server configuration.

Components that can be selected in the service design consist of images standardized as templates (CentOS, Ubuntu, etc.).

Here, the WEB server handles static content such as HTML documents (documents that can be read through the HTTP protocol), and the WAS server reads and processes development languages such as asp, php and jsp to handle dynamic content and web application services. will be.

 WAS server is a server that can perform various roles by implementing various functions in container by combining WEB server and web container. When a client requests, it is the web container that generates the results through the internal program and passes them back to the client.

As such, a web server is a server that processes static data. Servers that provide resources such as images and simple html files are faster and more reliable than using WAS through a web server. WAS server is a server that processes dynamic data. WAS should be used when connecting with DB server to exchange data or manipulating data with program.

Meanwhile, legacy legacy data centers needed physical network / security interworking in a group network for only one server linkage.

In vDC in SDDC, it is possible to build a virtualized group network in the concept of region, which can contribute to the integrated management and the initial investment cost reduction.

To this end, in the group network design step (S30), the group network design unit 30 allows the authorized network, the switching network, and the private network configured through the above steps to be interlocked by the TOR (physical L2 network) switch.

As described above, it is a starting point of constructing a group network to configure various physical network interworkings through VLAN separation in the TOR (physical L2 network) switch 31 among the SDDC physical infrastructures.

As shown in FIG. 7, when bands of various network networks of the corresponding L2 switch are set, group networking is possible through a virtual router in a region concept in a vDC.

As described above, the present invention enables preemption of Technical Architecture by presenting an SDDC empirical business model.

By presenting the convergence structure of next-generation technologies (SDN, NFV, Cloud) scattered and holding related business models, you can take the lead in the coming SDx market.

In particular, it is possible to preempt the technology structure compared to operators with common goals by applying it to the group network network (Private LTE, etc.) business considering the large-scale data center operation experience, technical maturity as the largest cloud provider in Korea, and long-term technology development direction.

In addition, the present invention enables to improve productivity / speed and reduce costs when building a group network through the SDDC.

In addition, in the present invention, the group network construction through the SDDC is separated into a virtual network through a virtual network / security device in a standard POD structure, and all resources of the entire SDDC are controlled and managed by a resource pool.

Compared to the average utilization rate of 15% of existing Legacy data centers, SDDC can use 100% of resources through virtualization, enabling the minimum physical device configuration. In addition, all infrastructure configuration and network control are automated with APIs, reducing leaf-time.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments described in the present invention are not intended to limit the technical idea of the present invention but to explain, and the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

10: Virtual Data Center Design Department
20: Service Design Department
30: Group Network Design Department
100: SDDC (Sofware-defined data center) integrated management system
110: switching network
120: private network
130: authorized network
140: management network
200: NFV Orchestrator
210-1 ~ 210-n: With virtualization network function
300: Cloud Orchestrator
310: virtualization server
320: virtualized storage
330: Virtualization Switch
400: virtualization infrastructure manager
500: virtualized network function infrastructure
600: Physical Network Infrastructure
700: virtual network infrastructure

Claims (16)

A virtual data center design unit for allowing a user to which a virtual data center user authority is granted to configure a plurality of networks with components of the virtual data center;
A service design unit configured to configure a server for WEB / WAS / DB use in a logical network configuration communicating with a VLAN corresponding to a plurality of networks configured in the virtual data center design unit; And
And a group network design unit configured to network-connect the plurality of networks configured by the virtual data center design unit by a physical L2 network switch. The method according to claim 1,
The virtual data center design unit provides a component composed of an icon and a canvas, so that a group network building device in a software defined center allows a user to whom a virtual data center user is authorized to configure a network and a component of the virtual data center. . The method according to claim 2,
The virtual data center design unit configures a basic private network (L2) as a network in the "area" of the components of the canvas by a user who has been granted the user right of the virtual data center, and in a separate network configuration, the private network ( private network) A group network building device in the Software Definition Center that allows you to configure additional Private Networks (L2) within a zone by adding an icon. The method according to claim 3,
The virtual data center design unit allows a user who is authorized to access a virtual data center to add a "public network" component to a basic private network or an additional private network requiring Internet interworking for customer service. Group network deployment device in the Software Definition Center that grants public IP in the pool. The method according to claim 4,
The virtual data center design unit includes a public network, a plurality of firewalls (FW), a web application firewall (WAF), a load balancer (LB) for the basic private network and the additional private network. Group network building device in a software defined center that includes an L2 switch. The method according to claim 3,
And the virtual data center design unit installs an external network component between a basic private network and an additional private network and installs an internal network component in an additional private network. The method according to claim 6,
The service design unit is configured to configure the WEB server in the external network component, WAS server and DB server in the internal network component group network building device in the software definition center. The method according to claim 6,
The service design unit is a group network building device in a software definition center using a component consisting of images standardized as a template. (A) allowing the virtual data center design unit to configure a plurality of networks with the components of the virtual data center by a user to whom the virtual data center user authority is granted;
(B) allowing the service design unit to configure a server for WEB / WAS / DB in a logical network configuration that communicates with a corresponding VLAN in a plurality of networks configured in the virtual data center design unit; And
(C) a group network designing method, wherein the group network designing step comprises a plurality of networks configured by the virtual data center designing unit to be interworked by a physical L2 network switch. The method of claim 9,
In the step (A), the virtual data center design unit provides a component composed of an icon and a canvas so that a user who has been granted the virtual data center user authority can configure the network and the components of the virtual data center. How to build a group network in the center. The method of claim 10,
Step (A) is
(A-1) wherein the virtual data center design unit configures a basic private network (L2) as a network in a “area” of the components of the canvas by a user who is granted a user right of the virtual data center; And
(A-2) The virtual data center design unit adds a private network icon to configure a separate network to form an additional private network (L2) in the area when the separate network is configured. How to build. The method according to claim 11,
Step (A) is
(A-3) The virtual data center design unit may allow a user authorized to access a virtual data center to add a "public" component to a basic private network or an additional private network requiring internet connection for customer service. And assigning a public IP in a defined pool. The method according to claim 11,
The virtual data center design unit includes a public network, a plurality of firewalls (FW), a web application firewall (WAF), a load balancer (LB) for the basic private network and the additional private network. How to build a group network in a software definition center that includes a virtual L2 switch. The method according to claim 11,
Step (A) is
(A-4) The virtual data center design unit further comprises the step of installing the external network component between the basic private network and the additional private network and the installation of the internal network component in the additional private network. The method according to claim 11,
In the step (B), the service design unit configures the WEB server in the external network component, and the WAS server and DB server in the internal network component group network construction method. The method of claim 9,
In step (B), the service design unit is a group network establishment method in a software definition center using a component consisting of a standardized image as a template.

Images