KR101867880B1 - Method, apparatus and computer program for service fuction chainnig - Google Patents

Abstract

A method for operating a service function chain using network function virtualization according to an embodiment of the present invention includes: providing a first type of virtual network function (VNF) included in the service function chain, And a second type in which only a specific packet among the packets flowing into the corresponding VNF is processed as a packet; A step B for searching an end point from an arbitrary end side to another end side of the service function chain; And designing a filter for tracing traffic to the service function chain using information of the VNF set in the end point.

Description

METHOD, APPARATUS AND COMPUTER PROGRAM FOR SERVICE FUCTION CHAINNIG,

The present invention relates to a method of operating a service function chain (SFC) in network function virtualization (NFV). More particularly, the present invention relates to a method of designing a filter for tracing traffic in a service function chain using a type of a virtual network function (VNF), which is a component of the service function chain.

Recently, network function virtualization technology is making new changes throughout the network architecture, which is hardware-oriented. Network function Virtualization, or NFV, is a concept that is implemented on a virtual machine (VM) server, hardware with a general-purpose processor, and a cloud computer, by separating the hardware and software components of the network and virtualizing the functions of the physical network equipment .

According to this, various network devices such as routers, load balancers, firewalls, intrusion prevention, and virtual private networks can be implemented as software on general servers, thereby avoiding the vendor dependency of the network configuration. Expensive dedicated equipment can be replaced by general-purpose hardware and dedicated software. Furthermore, it has the advantage of being able to quickly cope with traffic change as well as equipment operation cost reduction.

On the other hand, software-defined networking, or SDN technology, separates the complexity of the control plane from the data plane. According to this, the complicated functions of the control plane are processed by software, and the data plane performs only a simple function indicated by the control plane, such as transferring, ignoring, and changing network packets.

Applying these technologies allows software to develop new network functions without complex hardware constraints, while at the same time making various attempts not possible with previous network architectures.

The NFV and the SDN are separate technologies, but can complement each other. This is because various network functions implemented by software by NFV can be efficiently controlled using SDN.

It is an object of the present invention to provide a method for efficiently designing a filter in a service function chain.

A method of operating a service function chain using network function virtualization according to an embodiment of the present invention includes the steps of: a) processing each VNF (Virtual Network Function) included in the service function chain, Dividing the first type into a first type and a second type that processes all packets entering the VNF; b) setting the VNF of the first type that is searched first in the process of searching from the first end to the second end of the service function chain as a first end point, and setting the VNF of the second end as a second end point ; And c) designing a filter for tracing traffic to the service functional chain by considering MAC addresses of a virtual machine implementing a VNF set to the first endpoint, without considering a VNF set to the second end point And a control unit.

Further, a network function virtualization system for operating a service function chain according to an embodiment of the present invention includes: a network function virtualization apparatus that implements a service function chain including at least one VNF (Virtual Network Function); And a second type in which each of the VNFs processes only a specific packet among packets flowing into the VNF and a second type in which packets flowing into the corresponding VNF are all processed. The VNF of the first type that is searched for the first end is set as the first end point, the VNF that forms the second end is set as the second end point, and the VNF set to the second end point is not considered And management and orchestration (MANO) for designating a filter for tracing traffic to the service function chain by merging MAC addresses of virtual machines implementing the VNF set to the first end point.

Further, in a server according to an embodiment of the present invention, a computer program stored in a computer-readable recording medium for performing a function of operating a service function chain to which network function virtualization is applied includes a virtual network function (VNF) ) Into a first type for processing only a specific packet among the packets flowing into the corresponding VNF and a second type for processing both packets entering the corresponding VNF, Setting the VNF of the first type to the first end point and setting the VNF of the second end side to the second end point; And designing a filter for tracing traffic to the service function chain by considering MAC addresses of virtual machines that implement the VNF set to the first endpoint without considering the VNF set to the second end point .

According to the present invention, a filter for an arbitrary service function chain can be generated by using configuration information of a corresponding service function chain, and the service function chain can be operated quickly and efficiently.

1 is a view for explaining a filter of service function chaining;
2 is a block diagram for explaining a configuration of a framework for providing service function chaining according to an embodiment of the present invention
3 is a flowchart illustrating a method of operating a service function chain according to an embodiment of the present invention
4 is a view for explaining a specific example of generating a filter for a service function chain according to an embodiment of the present invention;
5 is a view for explaining another example of generating a filter for a service function chain according to an embodiment of the present invention;
6 is a diagram for explaining another example of generating a filter for a service function chain according to an embodiment of the present invention;

It is to be understood that the present invention is not limited to the description of the embodiments described below, and that various modifications may be made without departing from the technical scope of the present invention. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

In the drawings, the same components are denoted by the same reference numerals. And in the accompanying drawings, some of the elements may be exaggerated, omitted or schematically illustrated. It is intended to clearly illustrate the gist of the present invention by omitting unnecessary explanations not related to the gist of the present invention. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining a filter of a service function chaining.

Conceptually, the NFV device can provide a service chain by controlling traffic passing through the network to pass through one or more VNFs 144, 145, and 146. In the example of FIG. 1, traffic passing through the NFV device is received through the input port 112 and passes through the virtual switch 142 and through the service chain connecting the plurality of VNFs 144, 145, 113). ≪ / RTI >

On the other hand, in the service function chaining, when traffic is introduced into the network, a service function chain to be applied to the traffic is determined through a traffic classification operation according to a predetermined policy, and the traffic is sequentially assigned to the virtual network functions in a predetermined order in the service function chain Forwarded and executed, and then forwarded to the destination.

Therefore, the service function chain requires not only the service chain modeling but also the traffic processing function. That is, it is necessary to have a function of classifying the traffic and tracing to the corresponding service function chain. In the service function chain, this function can be performed by the filters 120 and 130.

The simplest way to create the filter is through the user's direct input. However, such a process is troublesome and there is a problem that the possibility of a user mistake can not be excluded.

The present invention has been made in order to solve the above problems. According to an embodiment of the present invention, a filter for tracing traffic to a service function chain can be generated using information of a VNF constituting a corresponding service function chain.

More specifically, according to an embodiment of the present invention, when a service function chain is designed, it is possible to distinguish types of VNFs constituting the service function chain and to design filters using information of a specific type of VNF.

According to the embodiment of the present invention, the VNF can be distinguished into a target type for processing only specific traffic and a non-target type for processing all traffic. It is not necessary to consider traffic filtering because non-target type VNF such as firewall and IDS processes all incoming traffic. On the other hand, since the target type such as load balancer, WAF, and proxy handles only specific traffic, the filter for the corresponding service function chain suffices only for the target type VNF.

Further, according to the embodiment of the present invention, a filter for the service function chain can be generated using the virtual machine information of the target type VNF.

Traffic to the NFV device can be classified using the virtual port assigned to the virtual machine implementing the VNF. Therefore, it is possible to create a filter in the corresponding service function chain by creating a flow rule in which the destination address is the MAC address of the virtual port allocated to the virtual machine implementing the target type VNF.

Meanwhile, the VNFs 144, 145, and 146 constituting the service function chain may be implemented as a virtual machine or as a flow rule using SDN. The example of the present specification assumes that the VNF is implemented in the form of a virtual machine and that the software switch 142 draws traffic using the virtual port of the virtual machine, but the present invention is not limited thereto.

That is, according to the embodiment of the present invention, a filter for a service function chain including a VNF implemented in a flow rule format can also be generated using match field information of a flow rule implementing the target type VNF.

Further, FIG. 1 illustrates a backward filter 130 coupled to a forward filter 120 and an outport coupled to the Inport of the NFV device, but this is merely exemplary and the present invention is not so limited.

More specifically, an NFV device according to an embodiment of the present invention can divide a physical port into at least one or more virtual ports. In this case, the NFV device may include two or more virtual ports, and the port is not distinguished from the out port.

The filter design method of the service function chain implemented in the NFV apparatus having no distinction between the in-port and the out-port will be described later in more detail with reference to FIG.

2 is a block diagram for explaining a configuration of a framework for operating a service function chain in an NFV according to an embodiment of the present invention.

The NFV system according to an embodiment of the present invention includes an NFV device 260 including a VNF module 295, a software switch 244, a communication section 246 and a control section 242, And a MANO (Management and Orchestration) module 210 that performs an orchestration function.

In the NFV system, the VNF module 295 is a collection of virtualization objects (e.g., Firewall, DPI, EPC systems, etc.) that provide specific network functionality. The VNF module 295 may include an EM (Element Management) 21, and the EM may perform a VNF-related setting and monitoring function and may have a log thereon.

Although not shown separately in FIG. 2, the MANO 210 may include a VNF manager for managing the VNF, a service orchestrator for controlling the NFV at the service level by the operator, and a resource manager for managing the virtual infrastructure.

In particular, the MANO 240 according to an embodiment of the present invention can create a filter for creating an arbitrary service function chain and tracing traffic to the corresponding service function chain.

For example, the MANO 240 may create a service function chain including at least one VNF, and may generate a filter for tracing traffic to the corresponding service function chain. Further, the MANO 240 may display the contents of the first-order filter, transmit the signal through the communication unit 246 to correct the filter content through user input, and apply it to the software switch 244. [ The control unit 242 of the NFV device 260 can set the software switch 244 under the control of the MANO.

3 is a flowchart illustrating an example of operating a service function chain according to an embodiment of the present invention.

In step 310 of FIG. 3, the MANO may design a service function chain that provides at least one VNF.

Thereafter, in order to generate a filter for the service function chain, the type of the VNF constituting the corresponding service function chain can be identified. (Step 320)

According to the embodiment of the present invention, the VNF can be distinguished into a target type for processing only specific traffic and a non-target type for processing all traffic. It is not necessary to consider traffic filtering because non-target type VNF such as Tap, Firewall, and IDS processes all incoming traffic. On the other hand, since the target type VNF such as the load balancer, the WAF, the router, and the proxy only processes specific traffic, the filter of the corresponding service function chain suffices only for filtering the target type VNF.

If all of the VNFs constituting the service function chain are classified into the target type and the non-target type, the MANO can search from any end to the other end of the service function chain and search for endpoints at step 330. (Step 330)

More specifically, the MANO searches for all the VNFs constituting the service function chain, sets the target type VNF that is searched first in the process of searching from the first end to the second end of the service function chain as an end point, If the target type VNF does not exist, the VNF forming the second end can be set as the end point.

Assuming that the endpoint set to the target type VNF is the first type and the other endpoints are the second type, what the filter will consider is the VNF set to the first type endpoint. That is, the second type end point may be processed as Do not care.

More specifically, if a first type endpoint exists (step 340), the MANO may record the MAC address of the virtual machine implementing the endpoint VNF at the destination MAC address of the filter. (Step 350)

For example, in a service function chain implemented in an NFV device with an InPort and an OutPort specified, MANO will assign the forward filter the same content as the MAC address assigned to the virtual in- put of the virtual machine that implements the endpoint VNF, Can be recorded and generated. Further, in the case of the backward filter, the MANO can generate the same contents as the MAC address assigned to the virtual MAC address of the virtual machine which implements the end point VNF at the destination MAC address of the filter.

On the other hand, if all of the VNFs constituting the corresponding service function chain are searched and the first type end point does not exist and only the second type end point exists (step 340), the MANO may not separately design the contents of the filter. (Step 345)

The MANO can then create a filter by merging the MAC addresses of multiple virtual machines implementing the endpoint VNF. (Step 360)

The MANO can then correct the contents of the created filter. (Step 370)

For example, MANO can display the contents of the created filter on the display and receive user input to calibrate the filter. This may be provided in the form of user configuration parameters for the service function chain.

On the other hand, if the target type VNF does not exist in the service function chain and there is no content of the created filter (step 345), the MANO can display it and receive the user input to create the filter. This can be applied to both the forward filter and the backward filter.

However, in the case of the backward filter, the MANO can generate the backward filter by referring to the contents of the forward filter if the target type VNF is not detected in the backward filter creation process. If the target type VNF is not present in the service function chain, a forward filter will also not be created, but a forward filter can be created via user input, and since the backward filter is dependent on the forward filter, Because a filter can be created.

More specifically, a service function chain implemented in an NFV device with specified in- port and out-port will be considered as a forward filter connected to the in- port and a back-word filter associated with the out-port.

The backward filter is a filter for tracing the traffic corresponding to the reply packet to the service function chain because a reply packet for the packet also has to go through the corresponding service function chain when an arbitrary packet has passed through a specific service function chain . Therefore, the backward filter is dependent on the forward filter and can be generated with reference to the contents of the forward filter.

The backward filter will be generated using the MAC address assigned to the virtual outport of the virtual machine that implements the VNF configured as the endpoint, searching for the VNFs that make up the service function chain from one end to the other end connected to the outport . At this time, if the end point VNF is not found, that is, if the target type VNF does not exist, the MANO will not separately design the contents of the backward filter.

However, if a forward filter is present (for example, a forward filter is created via user input), the MANO writes the contents of the source and destination fields of the forward filter to the destination field and the source field of the backward filter, respectively A backward filter can be generated.

Furthermore, when there is a content of a field having no directionality such as a protocol in the forward filter, the MANO can record the non-directional field as it is to generate a backward filter.

The MANO can then display the contents of the backward filter created on the display, and receive and correct user input.

A method of generating a filter according to an embodiment of the present invention will be described in more detail with reference to FIGS.

For example, in the service function chain shown in FIG. 4, the firewalls 480 and 420, the tapes 490 and 495 and the IDSs 410 and 440 are non-target type VNFs, and only the load balancer 470 is the target type VNF . Further, the firewall 480, the IDS 410, the IDS 440, and the TAP 495 form a single side of the corresponding service function chain.

In the example of FIG. 4, if the firewall 480 is connected to the Inport and the Tap 495 is connected to the Out port, the MANO searches from the firewall 480 to generate a forward filter, In which case the endpoint will be set to IDS 410 and load balancer 470.

The IDS 410 determines that the target NFV is not present in the search process, and the NFV that is the one-side NFV does not exist in the end Point. (Second type end point)

The MANO will then generate a forward filter with the destination MAC address assigned to the virtual inport of the virtual machine implementing the loader verifier 470, the first type endpoint.

On the other hand, in order to generate the forward filter, the MANO will search from the Tap 495 connected to the out port and search the target NFV to all the end sides. In this case, the end point is set to the IDS 440 and the load verifier 470 Will be.

The load verulcer 470 is set as the first target type NFV that is searched in the search process (first type end point), and the IDS 440 determines that the target NFV does not exist in the search process, Point. (Second type end point)

The MANO will then create a back-end filter with the destination MAC address assigned to the virtual out-port of the virtual machine implementing the load-verulner 470, the first type endpoint.

On the other hand, a service function chain as shown in FIG. 5A can be considered. 5A illustrates a service function chain implemented in an NFV device in which an in-port 505 and an out-port 507 are specified.

5A, the firewall 520, the tap 530, the IDS 510, the IPS 560, and the merge 580 are non-target type VNFs, and the WAF 540, the router 550, , The load balancer 570 corresponds to the target type VNF. Further, the Tap 530, the IDS 510, the IPS 560, and the load balancer 570 form one side of the service function chain.

FIG. 5B shows an end point retrieved from the Inport in the service function chain as shown in FIG. 5A.

The MANO is connected to the inft 505 to search for all the other ends 510 to 560 starting the service chain from 530 to create the forward filter and sends the IDS 510 and the router 550 to the endpoint .

More specifically, < A > in FIG. 5B is a result of searching for endpoints 530 to 510. Since the target type VNF is not searched while searching from 530 to 510, the IDS 510 constituting the other end side will be set as the end point. This will be treated as Do not care in creating a filter with a second type endpoint. And MANO will not record the contents of the forward filter.

5B is a result of searching the endpoints 530 to 560 and 530 to 570 in FIG. 5B. 5A, 530 to 560, 530 to 570, the first target type VNF to be searched is the router 550, and the MANO will set the router 550 as the end point.

This is the first type end point, and the MANO will write the MAC address assigned to the virtual inport P1 of 550 to the destination beer of the filter to generate the contents of the forward filter.

The MANO will then merge the recorded contents of A and B in 5b and finally create a forward filter that will make the destination address of P1 the MAC address of P1. The forward filter may then be displayed on the display and the filter input modified to receive user input thereto.

5A, in order to generate a backward filter, the MANO searches for an endpoint from 560 to 570, 530, and 510, which are connected to the out port 507 to terminate the service chain, The endpoints can be searched from 570 to 560, 530, and 510, which are connected to the other end, which terminates the service chain.

5C shows an end point retrieved from an outport in the service function chain as shown in FIG. 5A.

5A is a result of searching for the endpoints 560 to 530, 560 to 510, and 560 to 570 in FIG. 5A. At this time, the first target type VNF to be searched is the WAF 540 and the MANO will set the WAF 540 as the end point. The MAC address assigned to the virtual out port P5 of the endpoint 540 will be recorded as the destination beer of the filter to generate the content of the backward filter.

5C is a result of searching for endpoints 570 through 530, 570 through 530, and 570 through 560 in FIG. 5A. The first target type VNF searched at this time is the load balancer 570 and the MANO will set 507 as the end point. The MAC address assigned to the virtual outport P7 of the endpoint 507 will be recorded as the destination beer of the filter to generate the content of the backward filter.

The MANO will then merge the contents of A and B in FIG. 5C and finally generate a backward filter with the destination MAC address of P5 or P7 as the destination beer. The back-word filter may then be displayed on the display and the filter input modified to receive user input thereto.

FIG. 6 illustrates a service function chain implemented in an NFV device including two or more ports for which an inport and an out port are not specified. In the example of FIG. 6, the traffic may flow into one of the ports of PP1 605, PP2 607, or PP3 609, and may pass through the service chain and then to another port.

6, the firewall 620, the tap 630, the IDS 610, the IPS 660, and the merge 680 are non-target type VNFs, and the WAF 640, the router 650, , And the load balancer 670 corresponds to the target type VNF. Further, the Tap 630, the IDS 610, the IPS 660, and the load balancer 670 form one side of the service function chain.

The MANO may create a first filter for introducing traffic to the PP1 605 port into the service function chain.

More specifically, the MANO is connected to the PP1 605 to search for all the other end sides 610, 660, 670 starting from 630 starting the service chain, and setting the end point.

In the example of FIG. 6, the endpoint for PP1 is the IDS 640 and the router 650, the IDS 640 is treated as Do not care, and the MANO assigns the MAC address assigned to the virtual port P1 of 650 to the Destination brewery to generate the content of the first filter connected to PP1.

Next, the MANO can create a second filter for introducing traffic to the PP2 607 port into the service function chain.

More specifically, the MANO is connected to PP2 607 to search for all the other ends 610, 630, 670 starting from 660 starting the service chain, and will set the target VNF to be searched first as the end point. In the example of FIG. 6, the endpoint for PP2 is WAF 640 and the MANO will write the MAC address assigned to virtual port P5 of 640 to the destination beer of the filter to generate the contents of the second filter connected to PP2.

Finally, the MANO may create a third filter for introducing traffic to the PP3 609 port into the service function chain.

More specifically, the MANO is connected to the PP3 609 to search for all the other end sides 610, 630, and 660 starting from 670 starting the service chain, and will set the first target VNF to be searched as the end point. In the example of FIG. 6, the endpoint for PP3 is the load balancer 670 and the MANO will write the MAC address assigned to virtual port P7 of 670 to the destination beer of the filter to generate the contents of the third filter connected to PP3 .

The MANO may then display the contents of the first filter, the second filter, and the third filter on the display and receive user input thereto to modify the filter.

The embodiments of the present invention disclosed in the present specification and drawings are intended to be illustrative only and not intended to limit the scope of the present invention. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

Claims (8)

In a method for operating a service function chain to which network function virtualization is applied,
a) dividing the VNF (Virtual Network Function) included in the service function chain into a first type for processing only a specific packet among the packets flowing into the VNF and a second type for processing all packets entering the VNF step;
b) setting the VNF of the first type that is searched first in the process of searching from the first end to the second end of the service function chain as a first end point, and setting the VNF of the second end as a second end point ; And
c) designing a filter for tracing traffic to the service function chain by merging MAC addresses of a virtual machine implementing a VNF set to the first endpoint, without considering a VNF set to the second end point Wherein the service function chain management method comprises the steps of: delete The method according to claim 1,
And if the first endpoint can not be set because the first type of VNF is not found in step b), the filter is designed to receive the user input in step c). The method according to claim 1,
Step c)
A forward filter of the service function chain is retrieved from a first end connected to an in port of the service function chain using a MAC address allocated to a virtual inport of a virtual machine implementing a VNF set to the first end point, ; And
Searching a second end connected to an out port of the service function chain and searching for a backward filter of the service function chain using a MAC address allocated to a virtual out port of a virtual machine implementing a VNF set to the first end point, And generating the service function chain. 5. The method of claim 4,
If the second type endpoint does not exist and the contents of the forward filter exist in the generation of the backward filter, the contents of the source field and the destination field of the forward filter are compared with the destination field and the source field of the backward filter And generating the backward filter by writing the backward filter in the service function chain. The method according to claim 1,
Step c)
If the service function chain is connected to at least two ports that are not specified with an in-port and an out-port, searching from a first end connected to a first port of the service function chain, Generating a first filter for the first port using the first filter; And
And searching for a second end connected to a second port of the service function chain and generating a second filter for the second port using the information of the VNF set to the first endpoint Service function chain operating method. A network function virtualization system for operating a service function chain,
A network function virtualization device that implements a service function chain including at least one virtual network function (VNF); And
A first type in which only a specific packet among the packets flowing into the corresponding VNF is processed and a second type in which packets flowing into the corresponding VNF are all processed are divided into a first type and a second type Sets the VNF of the first type that is first searched for as the first end point, sets the VNF of the second end as the second end point, and does not consider the VNF set to the second end point And management and orchestration (MANO) for designating a filter for tracing traffic to the service function chain by merging MAC addresses of virtual machines implementing a VNF set as a first end point. A computer program stored in a computer-readable recording medium for performing, in a server, a function of operating a service function chain to which network function virtualization is applied,
A function for dividing each VNF (Virtual Network Function) included in the service function chain into a first type for processing only a specific packet among the packets flowing into the corresponding VNF and a second type for processing all packets flowing into the VNF;
The VNF of the first type which is searched for from the first end to the second end of the service function chain and is searched first is set as a first end point and the VNF constituting the second end is set as a second end point function; And
A function of designing a filter for tracing traffic to the service function chain by merging the MAC addresses of the virtual machines implementing the VNF set to the first end point without considering the VNF set to the second end point Lt; / RTI &gt;

Images