KR101969209B1 - Access control method and apparatus in SFC - Google Patents

Abstract

Disclosed are a method and apparatus for access control in service function chaining (SFC). An apparatus for performing access control in service function chaining (SFC) includes: a storage unit which stores a rule for an access permission policy for each service function module; Receiving unit for receiving a packet; And a packet processing unit for analyzing the packet and applying a specific action to the packet according to a rule corresponding to a service function module to which the packet is to be delivered.

Description

Access control method and apparatus in service function chaining (SFC)

The present invention relates to a method and apparatus for access control in service function chaining (SFC).

Network Functions Virtualization (NFV) system is a technology that controls and manages network functions by software virtualization. In particular, Service Function Chaining (SFC), which orders and connects and executes these virtual network functions, is drawing attention as the next research issue of NFV in that it enables automation and customization of major network services. Service function chaining technology is being developed under the name of VNF forwarding graph in ETSI NFV ISG and standardization of detailed function structure and protocol in IETF SFC WG.

Service function chaining allows network operators to dynamically create new service functions (SFs) in a virtualized environment and reduce the complexity of setting up service functions. Service function chaining is an ordered set of service functions, and service functions are classified into stateful SFs and stateless SFs. Here, stateful SF refers to SF that operates only with state information, and stateless SF refers to SF that can operate without state information.

Such an SFC may add and encapsulate information related to the SFC operation in the NSH header. However, NSH header, there is a problem that the information that the infection or leakage of important information by including so-infected SF or unverified 3 ^rd service provider functions associated with the user.

The present invention is to provide a method and apparatus for access control in service function chaining (SFC).

Another object of the present invention is to provide a method and apparatus for controlling access in service function chaining (SFC), in which SFs belonging to an SFC can access information according to a predetermined policy.

According to an aspect of the present invention, an apparatus for controlling access according to service function chaining in service function chaining (SFC) is provided.

According to an embodiment of the present invention, a network device on an SFC, comprising: a storage unit which stores a rule for an access permission policy for each service function module; Receiving unit for receiving a packet; And a packet processing unit for analyzing the packet and applying a specific action to the packet according to a rule corresponding to a service function module to which the packet is to be delivered.

The specific action may be an operation of deleting some information of the packet according to the rule.

The packet processor may analyze the packet and store flow information to a service function module to which the packet is to be delivered, and the flow information may be transmitted to another network device through an SFC controller.

The apparatus may further include a transmitter configured to transmit the packet to which the specific action is applied based on the flow information to the service function module.

According to another embodiment of the present invention, a network device on an SFC, comprising: a receiving unit for receiving a packet from a service function module (SF); And a packet processor configured to perform a recovery action on the packet by referring to the flow information when the packet matches the stored flow information.

The restoration action may be an operation of restoring deleted information according to an access permission policy corresponding to the packet.

The processor may discard the packet if the packet does not match the flow information.

According to another aspect of the present invention, an access control method in service function chaining (SFC) is provided.

According to an embodiment of the present invention, an SFC access control method includes: receiving a packet; And when the next hop of the packet is a specific service function module, applying a specific action to the packet according to a rule corresponding to the specific service function module.

According to another aspect of the present invention, an access control method of an SFC, the method comprising: receiving a packet; And when the packet is matched with the stored flow information, performing a recovery action on the packet with reference to the flow information.

By providing a method and an apparatus for controlling access in service function chaining (SFC) according to an embodiment of the present invention, SFs belonging to the SFC can be accessed to the information according to a predetermined policy.

Through this, the present invention has the advantage of preventing the infection or leakage of important information by the function of infected SF or unidentified service provider.

1 schematically illustrates a network system according to an embodiment of the invention.
2 is a diagram illustrating a hierarchical structure for an access permission policy according to an embodiment of the present invention.
3 is a flowchart illustrating a packet processing method in an SFC according to an embodiment of the present invention.
4 is a block diagram schematically illustrating an internal configuration of an SFF apparatus according to an embodiment of the present invention.
5 is a diagram illustrating a method of performing a specific operation corresponding to a packet according to a forwarding rule according to an embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

In describing the present invention, when it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, numerals (eg, first, second, etc.) used in the description process of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, in the present specification, when one component is referred to as "connected" or "connected" with another component, the one component may be directly connected or directly connected to the other component, but in particular It is to be understood that, unless there is an opposite substrate, it may be connected or connected via another component in the middle.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram schematically illustrating a network system according to an embodiment of the present invention, and FIG. 2 is a diagram illustrating a hierarchical structure for an access permission policy according to an embodiment of the present invention.

Service function chaining (SFC) is a concept that allows traffic of a network user to selectively pass only functions required by the user among network services such as NAT, firewall, and IPS. Here, the services may operate on a physical server or on a virtual machine.

In the SFC according to an embodiment of the present invention, the virtual service functions are installed on the cloud, and a path may be generated such that only functions required by the user are selectively passed through.

For ease of understanding and explanation, we will briefly summarize the concepts for implementing SFC.

Service function (SF) is a component function that composes a network service and processes a single packet or traffic. The component only refers to a logical entity for each function, and an instance for actual operation is executed by being installed on a network resource or physical dedicated device that is shared by software, and one or more instances exist for a single service function. Can be.

A service function chain (SFC) is a logical path that indicates in which order a service function processes received packets or traffic. The service function chain is defined according to the network service policy, and each chain is selected according to the traffic classification function.

The service function forwarder (SFF) performs a function of delivering the received packet to the SF module. The SFF may deliver traffic or packets to at least one SF according to information transmitted in SFC encapsulation. In addition, the SFF may perform a function of delivering a packet to another SFF. The service function delivery device is a network device, which will be collectively described as an SFF device.

Referring to FIG. 1, an SFC according to an embodiment of the present invention may include an SFC controller 110, at least one service function forwarder (SFF) 120, and at least one service. It is configured to include a function module (SF: service function, hereinafter referred to as SF module) (130). Here, the SFC controller 110 is located in the control plane on the SFC, at least one SFF device 120 and at least one SF module 130 are each located in the SPC data plane.

The SFC controller 110 performs a function of controlling SFs belonging to the SFC to access information according to a predetermined policy.

The SFC controller 110 may receive an access permission policy for all or part of the service function chaining from the outside and convert the SFC controller to a forwarding rule and transfer the same to the SFF devices.

As shown in FIG. 1, the SFC controller 110 includes a policy API unit 101, a permission control enforcer (PCE) 102, a policy assurance module (PA) 103, and a driver. Module 104.

The policy API unit 101 is a means for storing / managing general APIs used when allocating a policy.

The admission control transfer module 102 takes the SPC information from the SPC database repository, interprets the access permission policy using the SPC information, and converts the access permission policy into a forwarding rule. Although not separately illustrated in FIG. 1, the admission control transfer module 102 may also exist on the SPC data plane and performs a function of transferring the forwarding rule configuration.

The policy assurance module 103 collects monitoring information from the data plane and checks the accuracy of the application of the permission policy. That is, the policy assurance module 103 analyzes the monitoring information to detect policy violations of the SF. In addition, the analysis result may be passed to the admission control transfer module 102 for the forwarding rule configuration.

The driver module 104 analyzes the forwarding rules provided from the admission control transfer module 102 and transfers them to the data plane.

For example, the driver module 104 may forward the forwarding rule for the access permission policy from the permission control delivery module 102 to the SFF device 120.

Although the driver module 104 transmits the forwarding rule to the data plane on the SFC in FIG. 1, the driver module 104 may also serve as a contact point with various data planes.

In summary, the SFC controller 110 may transmit a rule on an access permission policy for the service function chain to each SFF device 120. Here, the access permission policy may be hierarchically designated, and may be applied in whole or in part to the service function chain.

The SFF device 120 performs a function of delivering a packet to a plurality of SF modules along a path specified in the packet. In addition, the SFF device 120 receives and stores a rule about an access permission policy for the service function chain from the SFC controller 110, and uses the same to perform a specific action or a restoration action on a packet transmitted to each SF module. Can be applied to process packets. This will be described in more detail with reference to the accompanying drawings below.

The SF module 130 configures service function chaining, and performs specific processing on network packets. The SF module 130 may process a single packet or traffic as a component function of configuring a network service.

On the SFC, some SF modules may only have read permission on information, some SF modules may have both read and write permission, and some SF modules may not have any permission. Although these permissions are defined in the SF module, the SF module can change packets regardless of the permissions. However, when the SF module performs a specific unauthorized action (packet change), the SFF device 120 may check this to restore the packet.

2 is a diagram illustrating a hierarchical structure for an access permission policy.

Assume that the packet is encapsulated as shown in FIG. As shown in FIG. 2, rights according to an access permission policy for a service function chain may be hierarchically set.

3 is a flowchart illustrating a packet processing method in an SFC according to an embodiment of the present invention.

In operation 310, the SFF device 120 receives a packet.

Here, the packet is SFC encapsulated as shown in FIG. 2, and access rights policies may be set for some data of the packet.

In step 315 SFF device 120 analyzes the received packet to determine the next hop of the packet.

For example, the SFF device 120 may analyze the packet header to determine the next hop of the packet. The SFF device 120 then sets the appropriate VXLAN address for the arrival point.

In operation 320, the SFF device 120 determines whether a packet is received from the SF module 130.

If the packet is not received from the SF module 130, the SFF device 120 stores the packet flow information in step 325. For example, the SFF device 120 may store packet flow information in FLOWSTATE_IN_TABLE.

In step 330, if there is a forwarding rule matching the packet flow information, the SFF device 120 performs a specific action on the packet. Here, the specific action may be an operation of deleting (or hidden) some of the packets according to the forwarding rule.

For example, when the forwarding rule corresponding to the SF module 130 to which the packet is to be transmitted corresponds to the packet flow information, the SFF apparatus 120 may delete some information from the packet according to the forwarding rule. have.

The forwarding rule is an authority according to an access permission policy for a service function chain, and may be individually set for each SF module or may be set for the entire service function chain.

Each SF module can define access rights to NSH of a packet at two levels according to an access permission policy. Here, two levels may be "read-only" and "write".

When a specific SF module has access authority set to "read-only", the SF module can only have read permission on a packet (or information), and can obtain information on a specific location. In this case, when an access right is set to "read-only" by a specific SF module, the SF module may read only specific information from a packet. However, even if the SF module is set to "read-only" access rights, it is natural that some contents of the packet can be modified. However, if a certain SF module with access permission set to "read-only" has modified some contents of the packet (that is, if some contents of the packet have been modified without modification authority), some contents of the modified packet by the SFF device are not original. Can be restored as it is.

When a specific SF module has access authority set to "write", it means that the SF module has both read and write authority for the packet (information), and has authority to get and modify information on a specific location.

The two rights of the above-described SF module are just examples for convenience of explanation and explanation, but are not necessarily limited thereto.

If the SF module to which the packet is to be forwarded does not have any authority, the SFF device 120 may delete the important information from the packet and then forward the packet to the SF module.

Basically, each SF module can have "write" permission. However, the unauthorized SF module on the SFC may not be set any rights.

In this way, the authority for the information in the NSH header of each packet can be designated through the right for the access permission of each SF module. Authorization rights for access to information may be assigned hierarchically and may be applied in whole or in part to the service chain.

Accordingly, the SFF device 120 may perform a specific action on the packet based on a forwarding rule corresponding to the SF module to which the packet is to be delivered. That is, when there is a forwarding rule matching the packet flow, the SFF apparatus 120 may delete some of the packets according to the forwarding rule.

In operation 335, the SFF device 120 transmits the packet on which the specific action is performed to the corresponding SF module.

In more detail, the flow-state ID is stored in the packet after a specific action is performed on the packet corresponding to the authority according to the access permission of the SF module. Here, the flow-state ID may be stored in metadata in the NSH after being granted from the SFC controller.

When the packet is a new packet, the packet may be delivered to the SFC controller 110 through a PACKET_IN message defined in OpenFlow.

As a result of the determination in step 320, if the packet is received from the SF module, in step 340, the SFF device 120 performs a recovery action on the packet based on a forwarding rule corresponding to the packet. That is, the SFF device 120 may restore information deleted from the packet based on a rule (forwarding rule regarding an access permission policy) corresponding to the SF module in which the packet is received.

The flow-state ID for the flow-state is stored in the NSH header of the packet. For this reason, the SFF device 120 may store flow information corresponding to the packet so as to be suitable for each field of FLOWSTATE_OUT_TABLE. FLOWSTATE_OUT_TABLE may include a MATCHES field and an ACTION field.

The MATCHES field may store a flow-state ID for a flow-state of a packet. For this reason, the SFF apparatus 120 extracts the flow-state ID from the NSH header of the packet received from the SF module and then checks whether the corresponding flow-state ID is stored in the MATCHES field (that is, the flow-state ID of the received packet). Can be determined whether or not the flow matching the is stored in FLOWSTATE_OUT_TABLE).

If there is no flow information matched to the packet in FLOWSTATE_OUT_TABLE, the SFF device 120 may discard the packet.

In step 345, the SFF device 120 transmits the restored packet to another SFF device according to service chaining.

4 is a block diagram schematically illustrating an internal configuration of an SFF apparatus according to an embodiment of the present invention, and FIG. 5 is a method of performing a specific operation corresponding to a packet according to a forwarding rule according to an embodiment of the present invention. It is a figure shown for demonstrating.

Referring to FIG. 4, the SFF apparatus 120 according to an embodiment of the present invention includes a receiver 410, a transmitter 415, a packet processor 420, a memory 425, and a processor 430. .

The SFF device 120 according to an embodiment of the present invention may be operated as an ingress SFF device or may be operated as an egress SFF device.

An ingress SFF device refers to a device that receives a packet and delivers it to an SF module, and an egress SFF device refers to a device that receives a packet from an SF module and delivers the packet to another SFF device.

Of course, one SFF device 120 may be operated as an ingress SFF device and an egress SFF device, and may be operated as either.

The receiver 410 is a means for receiving a packet.

The transmitter 415 is a means for transmitting a packet to a destination under the control of the packet processor 420.

In the present specification, the receiver 410 and the transmitter 415 are described in separate configurations for the purpose of convenience of understanding and explanation. However, it is obvious that the receiver 410 and the transmitter 415 may be included as one communication module. .

The packet processor 420 is a means for processing a packet such that SF modules belonging to the SFC access information according to a predetermined policy.

For example, the packet processor 420 analyzes the packet to generate flow information, and then applies a specific action to the packet according to a forwarding rule (ie, an access permission policy) corresponding to the service function module to which the packet is to be transmitted. The packet can be delivered to the service function module. Here, the specific action is an operation of deleting some information according to the forwarding rule according to the access permission policy for the service function module as described above.

In addition, the packet processor 420 may transfer flow information about the packet to another network device SFF through the SFC controller 110.

In addition, when a packet is received from the service function module, the packet processor 420 performs a restoration action according to a forwarding rule (ie, an access permission policy) corresponding to the packet, and then transmits the packet to another network device (ie, a service). Function delivery device). Here, the restoration action is an operation of restoring the dropped packet when the packet is delivered to the service function module.

For example, if an SF module with "read-only" access rights modifies a packet, the packet may be restored as it is (i.e., before the packet is sent to the SF module). Also, some contents of the discarded packet may be restored to prevent (hide) the exposure in the SF module before being delivered to the SF module.

As such, the SFF device 120 deletes some information from the packet according to an access permission policy according to the service function module to which the packet is delivered, and delivers the information to the corresponding service function module. It can be restored to form and delivered.

Through this, the SFF device 120 may not only prevent the important information from being transmitted to the service function module but also prevent the important information of the user from leaking to the outside by the unvalidated service function module. There is this. In addition, as described above, the contents changed by the SF module having no authority may be restored.

In addition, the packet processor 420 may control to restore the packet to its original state according to a rule corresponding to the packet received from the SF module, and then transmit the packet to another SFF device. Since this is the same as already described above, redundant description will be omitted.

In addition, when the received packet is a new packet, the packet processor 420 may transmit the packet to the SFC controller 110 to register the flow and then control the packet to be processed according to the service function chaining.

A method of performing a specific operation corresponding to a packet according to a forwarding rule according to an embodiment of the present invention will be described with reference to FIG. 5.

As shown in FIG. 5, it is assumed that one packet includes A, B, C, D, and E. It is assumed that the first SFF device 120 stores the first forwarding rule for the first SF module.

The first SFF device analyzes the first packet and determines the next hop of the packet as the first packet is received. For example, assume that the next hop of the first packet is the first SF module. Since the first hop of the first packet is the first SF module, the first SFF device hides C and D from the first packet according to the first forwarding rule and transmits the C and D to the first SF module.

In this case, since the next hop of the first packet is the first SF module, the first SFF apparatus may generate and store flow information about the first hop module. Subsequently, the first SFF device may transmit the flow information to another SFF device (hereinafter referred to as a second SFF device for convenience) through the SFC controller 110.

Accordingly, when the first SFF device or the second SFF device receives the first packet from the first SF module, the first SFF device or the second SFF device may restore the first packet by restoring C and D according to the first forwarding rule with reference to the stored flow information. have.

Subsequently, the first SFF device or the second SFF device may analyze the first packet and transmit the first packet to another SFF device or another SF module.

In the SFC according to an embodiment of the present invention, various algorithms, applications, and various information derived from a corresponding process required for performing a method in which SFs can access information according to a predetermined policy are stored.

In addition, the memory 425 may store forwarding rules according to an access permission policy for each service function module.

The processor 430 is an internal component of the SFF device 120 according to an embodiment of the present invention (for example, the receiver 410, the transmitter 415, the packet processor 420, the memory 425, etc.) Means for controlling.

The method according to the present invention described above can be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording media having data stored thereon that can be decrypted by a computer system. For example, there may be a read only memory (ROM), a random access memory (RAM), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, and the like. The computer readable recording medium can also be distributed over computer systems connected over a computer network, stored and executed as readable code in a distributed fashion.

Although the above has been described with reference to embodiments of the present invention, those skilled in the art may variously modify the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. And can be changed easily.

110: SFC controller
120: SFF device
130: SF module

Claims (11)

In the network device on the SFC,
A storage unit which stores forwarding rules for each service function module, respectively;
Receiving unit for receiving a packet; And
A packet processor configured to analyze the packet and apply a specific action to the packet according to a forwarding rule corresponding to a target service function module to which the packet is to be delivered;
The specific action may include deleting some information of the packet so that only selected information is accessible according to a forwarding rule of an access permission policy of the target service function module.
The packet processing unit,
And restoring the deleted partial information based on the forwarding rule when transmitting the packet from which the partial information has been deleted to another network.
delete According to claim 1,
The packet processing unit,
Analyze the packet and store flow information to a service function module to which the packet is to be delivered;
The flow information is transmitted to the other network device via the SFC controller.
The method of claim 3, wherein
And a transmitter configured to transmit the packet to which the specific action is applied based on the flow information to the service function module.
In the network device on the SFC,
A receiver for receiving a packet from a service function module (SF); And
When the packet is matched with the stored flow information, the packet processing unit for performing a recovery action for the packet with reference to the flow information,
And the restoring action restores some deleted information according to an access permission policy corresponding to the packet.
delete The method of claim 5,
The packet processing unit discards the packet if the packet does not match the flow information.
The method of claim 5,
The packet processing unit,
And when the partial content of the received packet has been modified by the service function module without permission, restoring the modified partial content to before it is delivered to the service function module.
In the access control method of the SFC,
Receiving a packet; And
If the next hop of the packet is a specific service function module, applying a specific action to the packet according to a forwarding rule corresponding to the specific service function module,
The specific action may include deleting some information of the packet so that only selected information is accessible according to a forwarding rule of an access permission policy of a target service function module.
After applying the specific action,
And transmitting the deleted part information to another network based on the forwarding rule.
In the access control method of the SFC,
Receiving a packet; And
If the packet is matched with the stored flow information, performing a recovery action for the packet with reference to the flow information,
And the restoring action restores some deleted information according to an access permission policy corresponding to the packet.
A computer readable recording medium product having recorded thereon a program code for carrying out the method of claim 9.

Images