JP2019033475A - Virtual private network service provision system with diversified end-to-end isolation support - Google Patents

Abstract

To propose a virtual private network service provision system with diversified end-to-end network isolation support, in which end-to-end safety of an inter-enterprise virtual private network is effectively improved by utilizing virtualization of a network function and flexible provision of software-defined networking and the construction cost of the virtual private network is reduced.SOLUTION: In the present invention, by flexibly arranging a plurality of virtual routers mainly in one server, different types of traffics of an enterprise network or different local area network devices are isolated, and, even if one device or one system is hacked, other systems in an enterprise can be prevented from being hacked. In addition, the flexibility of network change and safety can be achieved by simplifying network management and control mechanism of a network access time by using a software-defined networking.SELECTED DRAWING: Figure 2

Description

TECHNICAL FIELD The present invention relates to a virtual private network, and more particularly to a virtual private network service implementation system that can support various architectures.

Background Art A virtual private network (VPN) is a secure private network built on the public Internet, mainly using tunneling technology and security technology such as encryption / decryption. Compared to the conventional private network, the virtual private network does not require the use of a dedicated line, and can obtain the safety of the dedicated line on the Internet at a low cost by using a communication protocol technique. Virtual private networks also have better scalability and flexible applicability than traditional private networks, allowing you to conveniently and easily expand connection points and increase connection bandwidth as needed. Since the existing connection technology can be used without adjusting the existing architecture, it has the advantage that the investment cost of the equipment can be reduced and management and maintenance can be performed more easily.

  Current virtual private networks include Internet security protocol (IPSEC), Multiprotocol Label Switching (MPLS), Generic Routing Encapsulation (GRE), and Dynamic Multipoint Virtual Private Network Various technologies such as (DMVPN: Dynamic Multipoint VPN) can be used to achieve point-to-point or point-to-multipoint virtual private network connectivity. However, the current virtual private network is mainly constructed by building a private network dedicated to the company on the Internet, so that the internal network (intranet), the network between upstream and downstream companies or affiliated companies (extranet), the border Has achieved no remote access.

  Chinese Patent CN106411735 published on February 15, 2017 describes "Router Installation Method and Device". The router installation method and apparatus described in the patent are applied to a control provided in a software-defined network (SDN). In the method, the router attributes (RT) attribute of the tenant VPN instance and the routing policy of the external VPN instance are configured via the controller, whereby the RT attribute is assigned to the gateway device and the router of a different external device according to the routing policy. Is set, the RT attribute of the router is matched with the RT attribute of the tenant VPN instance, and the matched router is added to the tenant VPN instance, so that the traffic of the tenant is induced and transferred to the external network. Using the present invention, the router on the gateway device can be dynamically updated.

  However, the current virtual private network has the following problems, specifically, the first problem, that is, the virtual private network is widely used for a wide area network (WAN). To achieve multipoint-to-multipoint end-to-end network isolation when extending from the end to the enterprise internal local area network (LAN) and data center, the second challenge: all user traffic Are mixed in the same circuit, so that different types of traffic are segregated from each other, and the third challenge, dynamic and flexible implementation based on time management, access and control mechanism has not yet been solved . Therefore, for practical applications, the prior art still has to solve the above problems.

Accordingly, it is an object of the present invention to provide a virtual private network (VPN) service implementation system that supports a variety of end-to-end network isolation. The system of the present invention extends the current virtual private network from a wide area network to an enterprise internal local area network by using network function virtualization and software-defined networks to flexibly adjust network placement.

  The highly secure end-to-end network isolation service implementation provided by the present invention directs traffic according to different types of traffic so that all traffic within the current enterprise internal local area network is mixed on the same line. Resolves issues with forwarding and safety issues when sharing routing tables. This prevents one system from being hacked in the enterprise from affecting other systems in the enterprise. The present invention further enhances the security of enterprise virtual private networks and reduces the cost of construction, operation and maintenance of virtual private networks by proposing network access control mechanisms based on time management policies and fraud prevention .

In order to achieve the above object, a VPN service implementation system that supports various end-to-end network isolation of the present invention has the following architecture: a virtualization management platform provided in a server, a virtual network control module, a virtual It consists of routers and network controllers, and physical switches or virtual switches. The virtual router performs traffic proxy processing based on the virtualization technology of the network function. The network controller dynamically assigns the operation of the virtual router based on the software-defined network technology, and the correspondence relationship between a plurality of virtual private networks and a plurality of local area networks, and a plurality of virtual local area network (Vlan) tags. Establish. The virtualization management platform places virtual router hardware and network resources. The physical switch or the virtual switch receives a command from the network controller, and determines the traffic forwarding according to the flow entry information input to the physical switch or the virtual switch. According to this correspondence, the virtual router directs different traffic from different local area networks to the corresponding virtual private network via the physical switch or the virtual switch.

Benefits This allows different types of traffic isolation to be achieved by deploying multiple virtual routers for different types of traffic and establishing end-to-end virtual network isolation through the virtualization management platform. it can. In addition, the network controller provides efficient and secure network access control by controlling physical or virtual switches, determining traffic forwarding policies, and providing a time-based dynamic and flexible implementation management mechanism. . Finally, the physical or virtual switch forwards the traffic packet and determines the router to forward the traffic according to the destination Internet Protocol (IP) address and the virtual local area network tag of the traffic, thereby determining the end-to-end virtual Realize secure network isolation and reduce the cost of building, operating and maintaining virtual private networks.

It is a figure which shows the architecture of the conventional virtual private network. 1 illustrates a virtual private network service implementation system that supports various end-to-end isolation according to an embodiment of the present invention. FIG. FIG. 2 illustrates an implementation architecture applied to a mixed end-to-end isolated virtual private network according to one embodiment of the present invention. FIG. 3 illustrates an implementation architecture applied to a unified end-to-end isolated virtual private network, in accordance with one embodiment of the present invention. FIG. 2 illustrates an implementation architecture that supports a coordinated end-to-end isolated virtual private network in accordance with one embodiment of the present invention. 1 is a schematic diagram illustrating end-to-end virtual private network isolation according to an embodiment of the present invention. FIG.

DETAILED DESCRIPTION The present invention is a VPN service implementation system that supports a variety of end-to-end network isolation. The present invention is cost-effective, directs traffic based on virtualization of network functions and flexible implementation of software-defined networks, and supports secure isolation of multi-architecture end-to-end networks. Improve end-to-end security of virtual private networks between area networks, wide area networks and data centers, and reduce the cost of construction, operation and maintenance of virtual private networks.

  FIG. 1 shows a conventional virtual private network architecture. The local area network 18 includes a user device A14, a user device B15, a user device C16, and a user device D17. Different user equipments generate different types of traffic. These user apparatuses are interconnected via the layer 2 switch 13. In addition, user devices in the local area network 18 are connected to user devices in other subsites of the company via the virtual private network 19 via the physical router 11 including the gateway Z12. That is, all user devices are connected to a remote site of a company via a virtual private network. In this architecture, systems of different types of traffic can communicate with each other within the same local area network, all traffic is mixed and forwarded to the same circuit, and shares the same router routing table, There may be safety issues. If one host or system in the enterprise is hacked, there is no end-to-end isolation in the enterprise network, so other systems may also be hacked, leading to important information systems in the enterprise being hacked .

  FIG. 2 is a diagram illustrating a virtual private network service implementation system that supports various end-to-end isolation according to an embodiment of the present invention. The virtual private network service implementation system includes a server 27, a physical or virtual switch 26, a layer 2 switch 13, and a user device 28 (for example, a mobile phone, a desktop computer, a laptop, etc.).

  The physical server 27 includes a virtual router 21, a network controller 22, a time management module 23, a virtual network control module 24, and a virtualization management platform 25. The server 27 can execute these virtual elements, platforms and software modules via a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a programmable controller, and the like.

  The virtual router 21 is an open source network operating system and is implemented in a physical server (ie, server 27) or a virtual machine. In the present embodiment, a plurality of virtual machines can be mounted on one server 27, and the virtual router 21 can be arranged in each virtual machine. The virtual router 21 mainly performs traffic proxy processing based on network function virtualization technology on a general-purpose x86 platform, so that the network function of the physical router, for example, routing function, network address translation, firewall, and virtual private A network function can be provided.

  The network controller 22 is a network controller that supports various open source controllers or commercial controllers. In an embodiment of the invention, the network controller 22 can be installed on a physical server (ie, server 27) or a virtual machine. The network controller 22 controls the physical or virtual switch 26 on the network mainly through a plurality of communication protocols, and also manages terminal devices (for example, user devices 28) and groups, network topology management, and network access policies. Management, traffic content management, traffic volume statistics and log management, and dynamically assigning the operation of the virtual router 21 based on software-defined network technology, as well as multiple virtual private networks and multiple local area networks and multiple The correspondence relationship with the virtual local area network (Vlan) tag is established. This correspondence means that each virtual private network and each local area network has a corresponding virtual local area network tag.

  The virtual network control module 24 can be widely applied to various virtualization management platforms 25 and mainly functions to establish connections between virtual machines and physical networks and interconnections between virtual machines. The time management module 23 receives the time management setting of the virtual network control module 24, manages the legitimate network connection time of each user device, and plays a role of blocking the transmission / reception traffic of the user device 28 at the time of illegal Internet connection. The virtualization management platform 25 is mainly provided on a general-purpose x86 server, and configures hardware and network resources of the virtual router 22 by managing resource calculation, network resource and storage resource virtualization, and resource allocation. To function.

  A physical switch or virtual switch 26 (virtual switch 26 may be located on a server 27 or other server and may be operated by a virtual machine) receives instructions from the network controller 22 and receives the physical or virtual switch It plays a role of determining the forwarding of traffic according to the flow entry information (Flow Entries) input to 26. Traffic forwarding operations are described in subsequent embodiments.

  In order to easily understand the operational steps of an embodiment of the present invention, the traffic routing architecture of an embodiment of the present invention will be described in detail using the following examples. In the following, description will be made with each component and module of FIG. Each step of the embodiment of the present invention can be adjusted according to implementation requirements, and is not limited to this.

  FIG. 3 is a diagram illustrating an implementation architecture applied to a mixed end-to-end isolated virtual private network according to one embodiment of the present invention. The purpose is to have a physical router 11 and to flexibly implement different virtual routers (for example, virtual router X33 and virtual router Y34) according to the design of the enterprise internal virtual network and the demand for isolating different types of traffic. It is. The virtual router X33 and the virtual router Y34 can be installed in a virtual machine, and their functions are mainly for different traffic transmitted from user devices (user device A14, user device B15, user device C16 and user device D17). End-to-end virtual network isolation is achieved by isolating different types of traffic and guiding them to the virtual private network 19 according to the Vlan tag. The virtual router X33, virtual router Y34, network controller 22, time management module 23, virtual network control module 24, and virtualization management platform 25 described above are arranged in one server 27.

  Depending on the different types of system applications and traffic, the enterprise internal network may be divided into multiple virtual local area networks (ie, local area network A35, local area network B36 and local area network C37) to provide different types of traffic. Can be isolated from each other. For example, the user device A14 belongs to the local area network A35, the user device B15 and the user device C16 belong to the local area network B36, and the user device D17 belongs to the local area network C37. The connection between the user device and the virtual private network can be flexibly configured to use the existing physical router 11 or the virtual routers X33 and Y34. The layer 2 switch 13 attaches a different Vlan tag according to the local area network to which the traffic content of the user device belongs (for example, in the case of the traffic content of the user device A14, attaches Vlan A. The same applies hereinafter), and the physical or virtual switch 26 Send to. The physical or virtual switch 26 inspects traffic information (for example, source IP address (IP1 to IP4) and source media access control (MAC) address (MAC1 to MAC4)) according to the setting of the time management module 23. By doing so, it is determined whether or not the corresponding user terminal can access the network within a specific time range. When the network can be accessed, the physical or virtual switch 26 transmits the traffic to the corresponding gateway Z12, gateway X31, and gateway Y32 according to the Vlan tag of the traffic. The routing mechanism recorded in the routing table is illustrated in the following example.

  For example, the traffic of Vlan A transmitted from the user apparatus A14 is guided to the physical router 11 in which the gateway Z12 is arranged via the layer 2 switch 13 and the physical or virtual switch 26, and the physical router 11 Route to physical or virtual switch 26. The physical or virtual switch 26 transmits the traffic of Vlan A to the virtual private network 19 using Vlan D according to the Vlan tag of the received traffic. The traffic of Vlan B transmitted from the user device B15 and the user device C16 is guided to the virtual router X33 in which the virtual gateway X31 is arranged via the layer 2 switch 13 and the physical or virtual switch 26, and the virtual router X33 is , Route traffic to physical or virtual switch 26. The physical or virtual switch 26 transmits Vlan B traffic to the virtual private network 19 using Vlan E according to the received traffic Vlan tag. Similarly, the traffic of Vlan C transmitted from the user apparatus D17 is guided to the virtual router Y34 in which the virtual gateway Y32 is arranged via the layer 2 switch 13 and the physical or virtual switch 26, and the virtual router Y34 Route traffic to physical or virtual switch 26. The physical or virtual switch 26 transmits the traffic of Vlan C to the virtual private network 19 using Vlan F according to the Vlan tag of the received traffic.

  Similarly, traffic transmitted from the virtual private network 19 to the user apparatus A 14 is guided to the physical router 11 via the physical or virtual switch 26, and the physical router 11 routes the traffic to the physical or virtual switch 26. The physical or virtual switch 26 transmits traffic to the user apparatus A14 via the layer 2 switch 13 according to the traffic destination IP address. The traffic transmitted from the virtual private network 19 to the user device B15 or the user device C16 is guided to the virtual router X33 via the physical or virtual switch 26, and the virtual router X33 routes the traffic to the physical or virtual switch 26. The physical or virtual switch 26 transmits the traffic to the user device B15 or the user device C16 via the layer 2 switch 13 according to the destination IP address of the traffic. Traffic transmitted from the virtual private network 19 to the user device D17 is routed by the virtual router Y34. As mentioned above, physical isolation of the routing table and end-to-end virtual network isolation can be achieved by using different physical or virtual routers and different routing tables for different Vlan traffic.

  FIG. 4 is a diagram illustrating an implementation architecture applied to a unified end-to-end isolated virtual private network in accordance with one embodiment of the present invention. Unlike FIG. 3, the present embodiment is that the virtual router Z41 is used to replace the physical router 11 of FIG. The virtual router Z41 provides an architecture for seamlessly converting a physical router into a virtual router by setting the same gateway Z12 as the gateway of the user device A14, thereby eliminating the need for the user device A14 to change the IP address of the gateway. The cost of purchasing and maintaining physical routers can be effectively reduced. This architecture determines the traffic routing path by replacing the physical router 11 with the virtual router Z41 and inspecting the virtual local area network tag of the traffic packet with the physical or virtual switch 26. For example, the traffic of Vlan A is guided to the virtual router Z41, the traffic of Vlan B is guided to the virtual router X33, and the traffic of Vlan C is guided to the virtual router Y34. In addition, an end-to-end network isolation virtual private network service can be achieved by arranging different virtual routers in different virtual machines in one or a plurality of servers 27 and providing different routing tables for different traffic.

  As shown in FIG. 5, the present invention may also provide an implementation architecture that supports a matched end-to-end isolated virtual private network to simplify deployment modes. Unlike FIG. 4, in this embodiment, the physical or virtual switch 26 is accommodated in the server 27. By applying the embodiment of the present invention to a small and medium-sized software-defined network, an end-to-end isolated virtual private network can be provided. For conventional architectures, one or more physical or virtual switches need to be additionally placed. This consumes a lot of hardware resources and increases the packet transmission delay time. Embodiments of the present invention simplify the network architecture by placing physical or virtual switch 26, network controller 22, and virtual routers 33, 34 and 41 on a single server 27. This possesses a design that isolates different network segments of the internal network, while significantly reducing the cost of introducing network elements, bandwidth consumption and network latency between the traditional physical or virtual switch 26 and server 27. Reduce time and improve service implementation flexibility and portability. Compared to the conventional architecture, the system according to the embodiment of the present invention can significantly reduce the use of hardware resources, and reduce capital expenditure (CAPEX) and operation and maintenance costs (OPEX). When the network configuration is changed, the present invention can be flexibly managed and implemented via the network controller, thereby increasing the implementation flexibility.

  Referring to the schematic diagram illustrating the isolation of an end-to-end virtual private network in FIG. 6, the three types of flexibly configurable end-to-end network isolation virtual private network architecture provided by the present invention are different for different sites (eg, The actual isolation operation between the office 1 site and the office 2 site or the entire end-to-end virtual private network of the data center can be better understood. A company can connect two sites to the company's external network using a high-quality and high-security MPLS VPN, and can also connect to a line via inexpensive Internet broadband. By running multiple virtual routers on a single physical server provided by an embodiment of the present invention, each virtual private network is provided with an independent routing table and a quick and flexible implementation change of the network controller 22 By using the functions, the isolation method originally used for wide area network VPN can be extended between the enterprise internal local area network and the data center, and a complete end-to-end isolated virtual private network service implementation system Is realized.

Features and Effects The VPN service implementation system that supports various end-to-end network isolation according to the embodiment of the present invention has the following advantages compared to the prior art.

  A VPN service implementation system supporting various end-to-end network isolation according to an embodiment of the present invention is a cost-effective and flexible implementation service system based on end-to-end virtual private network isolation. Provides end-to-end isolation by providing different types of traffic to the network, external network and data center. By employing a network usage management mechanism to provide enterprise network access time management and fraud block, embodiments of the present invention provide a variety of architectures, flexibly responding to different demands, and dynamically Since management and flexible mounting can be performed, CAPEX and OPEX can be greatly reduced.

  Compared with the conventional architecture, the system of the embodiment of the present invention can extend the virtual private network to the corporate LAN and data center from the conventional WAN side, improving the end-to-end isolation security of the virtual private network Let

  The system of the embodiment of the present invention supports the flexible placement of a plurality of virtual routers on one server, and achieves safe traffic isolation by providing separate routing tables for different types of traffic. To do.

  When the network configuration changes, embodiments of the present invention can be flexibly managed and implemented via a network controller, which makes the system of the present invention more portable than implementations of conventional architectures. Increases sexuality and flexibility.

  The VPN service implementation system supporting various end-to-end network isolation proposed by the present invention flexibly reduces physical network element placement and resource usage, and reduces CAPEX and OPEX according to enterprise network application demand. be able to.

  Although the present invention has been disclosed using the above embodiments, these embodiments are not intended to limit the present invention. Those having ordinary skill in the art can make various modifications and variations without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention is defined by the appended patent scope.

Industrial Applicability A virtual private network service implementation system that supports various architectures can be applied to user management by the telecommunications industry.

  DESCRIPTION OF SYMBOLS 11 Physical router, 12 Gateway Z, 13 Layer 2 switch, 14 User apparatus A, 15 User apparatus B, 16 User apparatus C, 17 User apparatus D, 18 Local area network, 19 Virtual private network, 21 Virtual router, 22 Network controller , 23 Time management module, 24 Virtual network control module, 25 Virtualization management platform, 26 Physical or virtual switch, 27 Server, 28 User device, 31 Gateway X, 32 Gateway Y, 33 Virtual router X, 34 Virtual router Y, 35 Local area network A, 36 Local area network B, 37 Local area network C, 41 Virtual router Z.

Claims (9)

Virtual private network service implementation system that supports various end-to-end isolation,
With a server,
The server
At least one virtual router configured to proxy traffic based on network function virtualization technology;
Based on software-defined network technology, the operation of the virtual router is dynamically allocated, and a correspondence relationship between a plurality of virtual private networks and a plurality of local area networks and a plurality of virtual local area network tags is established. Network controller
A virtualization management platform configured to locate hardware and network resources of the virtual router;
With physical or virtual switches,
The physical switch or the virtual switch receives an instruction from the network controller, determines traffic forwarding according to the flow entry information input to the physical switch or the virtual switch,
The virtual router supports various end-to-end isolations that direct different traffic from different local area networks to the corresponding virtual private network via the physical switch or the virtual switch according to the correspondence. Virtual private network service implementation system.   The virtual corresponding to various end-to-end isolation according to claim 1, wherein the correspondence relationship means that each virtual private network and each local area network has a corresponding virtual local area network tag. Private network service implementation system.   The various virtual end-to-end of claim 1, wherein the virtual router transmits the traffic to a user equipment in the corresponding local area network according to the virtual local area network tag corresponding to a destination internet protocol address of a different traffic. Virtual private network service implementation system that supports end isolation.   The virtual switch supporting various end-to-end isolation according to claim 1, wherein the physical switch or the virtual switch inspects a virtual local area network tag of the traffic and directs the traffic to the corresponding virtual router. Private network service implementation system.   The virtual private network service implementation system supporting various end-to-end isolation according to claim 1, wherein the physical switch or the virtual switch is arranged in the server. A plurality of virtual machines are mounted on the server,
The virtual private network service implementation system for supporting various end-to-end isolation according to claim 4, wherein the virtual router is arranged in each virtual machine.   The virtual router performs end-to-end virtual network isolation by isolating different types of traffic according to virtual local area network tags of different traffic transmitted from a plurality of user devices and directing them to the corresponding virtual private network. A virtual private network service implementation system that supports various end-to-end isolations according to claim 1, realized.   By replacing the physical router by using the virtual router and setting the same gateway by the virtual router, there is no need for a plurality of user devices to change the Internet protocol address of the gateway, and the different virtual router is changed to the server. 5. A virtual supporting multi-end-to-end isolation as claimed in claim 4, wherein a virtual private network service of end-to-end isolation is realized by placing different virtual machines in a different virtual machine and providing different routing tables for different traffic. Private network service implementation system. The server further includes a virtual network control module, and the virtual network control module functions to establish a connection between the plurality of virtual machines and a physical network and an interconnection between the virtual machines, and the virtual router includes , Located in each of the virtual machines,
A time management module, the time management module receives time management settings of the virtual network control module, manages legal network connection times of a plurality of user devices, and transmits / receives traffic of the user devices when an illegal Internet connection is established Configured to block
The physical switch or the virtual switch determines whether the user apparatus can access the network within a time range by inspecting traffic information according to the setting of the time management module, and sets the traffic inspection information The virtual private network service implementation system supporting various end-to-end isolations according to claim 1, wherein the system is based on the time management setting.

Images