WO2020165466A1

WO2020165466A1 - Method and system for controlling traffic access to services on a software defined network (sdn)

Info

Publication number: WO2020165466A1
Application number: PCT/ES2019/070074
Authority: WO
Inventors: Daniel VELASCO BENITO; María Luisa García Osma
Original assignee: Telefónica Digital España, S.L.U
Priority date: 2019-02-12
Filing date: 2019-02-12
Publication date: 2020-08-20

Abstract

The invention relates to a method and system for controlling traffic access to services on a software defined network (SDN). The method comprises (a) receiving, by a virtual machine in a data centre, a data packet from a node for a particular service on the SDN network; (b) checking, by an SDN controller or by a switch operationally connected to the SDN controller, whether one or more bits of a bit string of a new MAC mask of said received data packet have a specific value, wherein the bit string establishes rules for accessing one or more services of the SDN network; and c) allowing, by the SDN controller or by the switch, access to said particular service only if the value of said one or more bits of the bit string matches a predetermined MAC mask for said particular service.

Description

System v method to control traffic access to services on a software-defined network (SDN)

Technical field

The present invention relates generally to the field of software defined networks (SDN). In particular, the invention concerns a method and a system to control the access of traffic from physical devices, virtual machines or containers to certain services of an SDN network.

Background of the invention

From patent application US 20130272305 A1 a method is known to rewrite the destination MAC address in the data packets to send them to the chosen destination node or to implement services such as transparent proxy. On the contrary, the solution proposed in the present invention does not rewrite the destination (or source) address of the data packets, but uses it to perform access control functions. The present invention, unlike this US patent application, provides a screening / policing service that can be efficiently implemented in switches to manage access to different services in an SDN network.

Patent application US 20130329734 A1 describes the use of different fields in the header of IP packets (both for IPv4 and IPv6) to redirect traffic to the most suitable service. It is also proposed to use the MAC source address for this same purpose. The two main differences of this US patent application with the present invention are: (1) The source MAC address is not used to redirect traffic, but to determine if a data packet has access to a certain service (access control ) and (2) does not use specific MAC addresses, but rather proposes the use of MAC prefixes or masks (MAC address segments) to add multiple MAC addresses instead of individual MAC addresses. The objective pursued when using MAC prefixes is to avoid having to introduce a rule in the switches for each node and service to be managed, so that the number of rules in the TCAM table is reduced and the use of these is optimized. , avoiding the scalability problems of other solutions present.

The international patent application WO 2017180098 A1 suggests the use of portions of the source MAC address to encode the services to which the data packets must be sent, in a similar way to that discussed on service chaining. On the contrary, the present invention uses the MAC address to control access to services, not to carry out forwarding of data packets, which is done based on the destination IP address, which is translated into a MAC corresponding destination.

US patent 9742589 B2 provides a method to implement service chaining by rewriting the source and destination MACs of data packets. In contrast, the present invention does not rewrite MACs, but rather uses portions of them to give access to certain services.

The previous solutions of the state of the art implement routing functionalities that allow the data packets to pass transparently through intermediate services (usually this functionality is known as "service chaining" or orchestration). Likewise, the solutions of the state of the art This technique does not allow the optimization of the access control function, it is to ensure that the data packets can only reach their destination if they are authorized, without this implying computing capacity or delay.

Therefore, new methods and / or systems are required, scalable and simplifying the rules for controlling access of traffic, coming from physical devices or virtual machines, to certain services of an SDN network.

Presentation of the invention

Exemplary embodiments of the present invention provide, according to a first aspect, a method for controlling traffic access to services in an SDN network. The method comprises receiving, by a virtual machine in a data center, a data packet from a node for a given service on the SDN network; check, by an SDN controller or by a switch operatively connected to the SDN controller, whether one or more bits of a series of bits of the data packet address have a specific value and allow, by the SDN controller or by the switch, access to said determined service only if the value of said one or more bits of the series of bits coincides with a preset MAC mask for said determined service.

In an exemplary embodiment, and in response to the receipt of the data packet, said virtual machine replaces a source or destination MAC mask of said data packet with said new MAC mask. Therefore, for a packet coming from outside the data center, a switch controlled by the SDN controller, for example, is It will take care of rewriting the original MAC address of the packet when the data packet enters the data center. Said rewriting will compose the new MAC address with the bits or bitmask that appropriately encodes the permissions for that data packet. It is important to note that this MAC rewriting already occurs every time a packet crosses a switch, only in this case, it is used to reflect the access permissions of said data packet, as it is an environment (the data center) under the SDN controller driver. Once the data packet enters the data center, the internal switches will use this new MAC address to determine access to the destination resource.

Alternatively, in the proposed method, there is also the possibility that the virtual machine does not replace the MAC mask and that it is the one that originates the traffic. This would be the case of having machines in a data center with databases and machines that have to access the databases and where you want them to be able to communicate with each other and with no other machine. In this case, the MAC should not be replaced, just check that they all have the appropriate masks to talk to each other.

In a particular embodiment, the replacement of the source or destination MAC mask by the new MAC mask is performed after receiving an indication from a cloud controller. The cloud controller in this case receives an indication of the new MAC mask to be replaced from a provisioner computing device operatively connected to it.

According to the proposed method, said node can be a physical device, a virtual machine or a container.

In an exemplary embodiment, each one of said one or more bits of said series of bits allows access to a different service. Alternatively, said one or more bits allow access to different combinations of services.

Exemplary embodiments of the present invention also provide, according to a second aspect, a system for controlling traffic access to services in an SDN network. The elements / devices / modules that are part of the proposed system are configured to implement the steps of the method of the first aspect of the invention.

The proposed mechanism allows controlling the access of traffic from physical devices or virtual machines to certain services or destinations within a network, using the MAC address of the source or destination device or virtual machine to determine if the communication is allowed. The difference of the proposed method with current implementations lies in the use of segments of the MAC address as a prefix or mask, so that instead of requiring an SDN rule for each device / MAC address, masks or prefixes are used that add multiple nodes, which will have been assigned a MAC address according to the services or networks they can access. In this way, the use of SDN for access control becomes a scalable solution, by eliminating problems related to the size of the TCAM (Ternary Contained Addressable Memory) table, which limits the solution to a few hundred devices / rules.

With this solution, access control rules are considerably simplified, since it is not necessary to install one rule for each client and service (NxM) in the switching nodes, but only one rule per service (M). This is possible because it is proposed to use the source MAC of the data packets to encode the permissions of the source node, and therefore the switching layer no longer has to check the full source address of each data packet to verify if there is a specific rule that indicates if it has permission to reach the destination, but only if the source MAC contains the value of the bits (or bits) corresponding to that service, so the same rule allows access to all nodes that can access a service.

The present invention can be applied to fixed, mobile and company networks, in which the SDN technology is to be deployed.

Brief description of the drawings

The above and other characteristics and advantages will be more fully understood from the following detailed description of some exemplary embodiments, merely illustrative and not limiting, with reference to the accompanying drawings, in which:

Fig. 1 is a flow chart illustrating an exemplary embodiment of a method for controlling traffic access to services in an SDN network.

Fig. 2 is a flow chart illustrating another embodiment of the proposed method.

Fig. 3 is a flow diagram that illustrates how a switch gives access or not to a certain service, according to an embodiment of the present invention.

Figs. 4 and 5 show different examples of MAC addresses that can be replaced to give access to certain services on the SDN network. Detailed description of the invention and some embodiments

Fig. 1 shows an exemplary embodiment of a method for controlling traffic access to services of a network defined by SDN. According to this exemplary embodiment, in step 1001, a virtual machine 121 in a data center receives a data packet from a node (eg a physical device or a virtual machine) for a given service 200 on the SDN network. In step 1002, an SDN controller 130 or a switch 131 operatively connected to the SDN controller 130, checks whether one or more bits of a series of bits of a new MAC mask of the received data packet has a specific value. Finally, in step 1003, said SDN controller 130 or switch 131 allows access to said determined service only if the value of said one or more bits of the series of bits coincides with a preset MAC mask for said determined service.

Therefore, the proposed method proposes a new way of implementing access control in SDN networks, which increases scalability and improves performance. The use of SDN, that is, the switching layer itself to perform access control is a technique used in various environments, but it presents scalability problems, since the number of necessary rules means that it can only be applied to a limited number of services and devices.

Therefore, with the establishment of rules with masks or prefixes, that is, using part of the source or destination MAC address, the proposed method allows the access of a data packet to a specific service, network or destination. Therefore, the complete source or destination address is not checked, but if one or more bits of the series of bits of these have a specific value, which allows setting a single rule for multiple machines or devices. In this way, in a virtualized infrastructure, virtual machines or containers can be created and assigned MAC addresses that contain the bits that correspond to the access rules that will be installed on the switching nodes. Thus, access can be given, in a simple and scalable way, to the services or networks deemed appropriate. Additionally, if you want a series of instances to stop having access to certain sites, you can change the MAC address of the virtualized device, without having to change the rules installed in the switching nodes, which will allow additional functionalities.

Referring now to Fig. 2, another embodiment of the proposed method is shown. In this case, an orchestrator 100 of the solution requests a Provisioner computing device 110 that deploys a virtual machine 121 (or alternatively a device) that can connect to a specific service 200. To do this, the provisioner computing device 110 identifies the MAC mask that gives access to that service 200 and requests the cloud 120 that deploys a virtual machine 121 whose MAC address includes the new mask (that is, the combination of bits) that gives access to service 200. The SDN controller 130 is configured so that only data packets that have the correct MAC mask can access the 200 service, so it will only allow communication to those machines that have been configured to access the 200 service.

In Fig. 2 it has been assumed that the SDN controller 130 is configured in reactive mode, so all new flows will arrive at the SDN controller 130. However, it is possible that the flows are predefined in the switches 131, that is, that the SDN controller 130 program / configure the switches 131 to accept or reject the data packets based on certain rules. In this way, the SDN controller 130 will indicate to the switches 131 the new MAC mask that the data packets that go to certain services must have and will only allow access to those data packets that come from machines authorized to access the services. , which you will identify by their MAC mask. In Fig. 3 it can be seen how only the data packets that have the segment of their MAC corresponding to the A 200 service will be able to access and those that do not have it will not be able to access the 200 service.

If it is desired that a node ceases to have access to service 200, the orchestrator 100 could request the provisioning computing device 110 to modify the MAC address of said node so that it does not contain the mask that gives access to service 200.

Fig. 4 shows an example of the new replaced MAC mask in which 3 specific bits of the MAC address of a device are used to give access to three different services, in this case video, games and storage. Alternatively, a combination of bits could have been chosen (eg b7b6b5b4 = 1111) to give access to a specific service. For example, a customer with b7b6 = 11 might be able to access video and game services. Another option would be to encode the access to a set of bits, for example, b7b6b5b4 = 1001 to access the video service. Another additional option is that a series of bits give access to a series of services, for example b3b2b1 = 110 gives access to services for companies, such as storage and remote desktop. The proposed method allows the creation of complex rules in virtualized environments, which allow access to various services in a simple way, since it is enough to properly set the MAC addresses of the virtual machines 121, 122 in which the services 200 are deployed.

Additionally, this mechanism can be used to route or allow access to networks of devices considered reliable after being identified by their MAC, since the proposed method could filter by manufacturer or type of device if the corresponding MAC identifies it.

The present invention has great flexibility and it is possible to choose whether specific bits give access to certain services / networks or combinations of bits of the MAC address allow access to combinations of services, as can be seen in Fig. 5.

The methodology could be extended to use level 3 (IP) addresses for Access Control. However, this option would provide less security, since it is much easier to change the IP address than the MAC address. A limitation of this procedure is the possibility of using MAC Spoofing (change or spoofing of the MAC address), so its use is limited to those environments in which this possibility is not feasible or when mechanisms are available to detect it.

The present invention solves the scalability problem presented by solutions based on level 2 (source / destination MAC) for access control and provides a very flexible and efficient way to do it. Additionally, access control policies are executed in a more efficient and flexible way, since instead of needing a firewall or an access / security management mechanism, it is implemented in the switching layer itself and using the same SDN mechanisms used to define routing policies.

A possible application of the proposed solution could be in multitenant cloud environments, where as an additional security layer different masks would be assigned to the virtualized instances of the different clients, which would be used to prevent access by the traffic of some clients' machines to those of others.

The proposed invention can be implemented in hardware, software, firmware or any combination thereof. If implemented in software, the functions can be stored in or encoded as one or more instructions or code on a computer-readable medium. Computer-readable medium includes computer storage medium. The storage medium can be any available medium that can be accessed by a computer. By way of example, and not limitation, such computer-readable medium may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Disk (disk) and disk (disc), as used herein, include compact discs (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disc, and Blu-ray disc where the discs ( disks) normally reproduce data magnetically, whereas discs (dises) reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable medium. Any processor and storage medium can reside in an ASIC. The ASIC can reside in a user terminal. Alternatively, the processor and storage medium can reside as discrete components in a user terminal.

As used herein, computer program products comprising computer-readable media include all forms of computer-readable medium except, to the extent that such medium is considered to be non-established transient propagation signals.

The scope of the present invention is defined in the appended claims.

Claims

1. Method to control traffic access to services of a software-defined network (SDN), includes:

a) receive, by a virtual machine in a data center, a data packet from a node for a given service on the SDN network;

b) check, by an SDN controller or by a switch operatively connected to the SDN controller, if one or more bits of a series of bits of a new MAC mask of said received data packet has a specific value, where the series of bits establishes access rules to one or more services of the SDN network; and

c) allow, by the SDN controller or by the switch, access to said determined service only if the value of said one or more bits of the series of bits coincides with a preset MAC mask for said determined service.

2. Method according to claim 1, wherein prior to said step b), in response to receiving the data packet, the virtual machine replaces a source or destination MAC mask of said data packet with said new MAC mask.

3. Method according to claim 2, wherein said replacement of the source or destination MAC mask with the new MAC mask is performed after receiving an indication from a cloud controller, and wherein an operationally connected provisioner computing device with the cloud controller indicates the new MAC mask to replace the cloud controller.

4. Method according to claim 1, wherein said node comprises a physical device.

Method according to claim 1, wherein the node comprises a virtual machine.

Method according to the preceding claims, wherein each one of said one or more bits of the series of bits allows access to a different service.

7. Method according to previous claims 1 to 5, wherein said one or more bits of the series of bits allow access to different combinations of services.

8. System to control traffic access to services of a software-defined network (SDN), comprising:

at least one node; at least one virtual machine (121, 122) of a data center, configured to receive a data packet from said node for a determined service (200) of the SDN network; and

an SDN controller (130) or a switch (131) operatively connected to the SDN controller (130), configured to check if one or more bits of a series of bits of a new MAC mask of said received data packet has a specific value , where the series of bits establishes rules for access to one or more services of the SDN network, and to allow access to said determined service (200) only if the value of said one or more bits of the series of bits matches a preset MAC mask for said particular service (200).

System according to claim 8, wherein said virtual machine (121, 122) is configured to, in response to the receipt of the data packet, replace a source or destination MAC mask of said data packet with said new MAC mask.

10. System according to claim 9, comprising:

a provisioner computing device (110); and

a cloud controller (120),

where the provisioning computing device (110) is configured to indicate the new MAC mask to replace the cloud controller (120), and

wherein the cloud controller (120) is configured to deploy said virtual machine (121, 122), which is at least one, to perform the replacement of the source or destination MAC mask with the new MAC mask.

System according to preceding claims 7 or 8, wherein said node comprises a physical device.

12. System according to preceding claims 7 or 8, wherein said node comprises a virtual machine.