KR102180038B1 - Wan node apparatus in tactical mesh network environment - Google Patents

Abstract

According to the present invention, a wide area network (WAN) node device for controlling traffic through networking with a control tower in a tactical mesh network environment comprises a tactical mesh WAN node performing real-time monitoring that collects packets and flows of traffic in real time and provides them to the control tower. The tactical mesh WAN node may include: an agent for managing the life cycle of a virtual entity constituting the interior of the tactical mesh WAN node; and a proxy for collecting the traffic transmitted and received through the tactical mesh WAN node, transmitting the traffic to the control tower, and performing conditioning to control traffic tagging and traffic distribution for monitoring individual packets targeting a virtual switch according to a quality of service (QoS) control message of the control tower.

Description

WAN node device in a tactical mesh network environment {WAN NODE APPARATUS IN TACTICAL MESH NETWORK ENVIRONMENT}

The present invention relates to a WAN (Wide Area Network) node device, and more particularly, a tactical mesh network environment capable of tuning the quality of service (QoS) of tactical mesh traffic through monitoring of traffic packets and flows. It relates to a WAN node device in the.

As is known, with the development of information and communication technology, the transition to an All-IP-based future tactical network in which application services are integrated based on Internet Protocol (IP) is continuously in progress.

In order to guarantee the quality of service (QoS) of application services in a future tactical mesh network in which tactical WAN nodes are connected in a mesh structure, an attempt is made to introduce a tactical service mesh layer that exists between the infrastructure layer and the application service layer. have.

However, it is difficult to support dynamic QoS control for intelligent QoS coordination required by the tactical service mesh layer for closed networking boxes and static QoS control tools constituting the existing tactical network due to poor wireless environment in the tactical environment. Actually.

Korean Patent Publication No. 2019-0048595 (Publication date: 2019. 05. 09.)

The present invention is capable of configuring a tactical mesh wide area network (WAN) node by integrating hardware and software to include a SDN/NFV (Software Defined Network/network function virtualization)-based multi-access networking interface and a virtualized networking switch. It is intended to provide a WAN node device in a tactical mesh network environment.

The present invention provides a WAN node device in a tactical mesh network environment capable of realizing traffic monitoring supporting QoS coordination of tactical traffic by linking a traffic monitoring method based on eBPF (extended Berkeley Packet Filter) to a tactical mesh WAN node. I want to.

The problem to be solved by the present invention is not limited to the ones mentioned above, and another problem to be solved that is not mentioned can be clearly understood by those of ordinary skill in the art from the following descriptions. will be.

According to one aspect, the present invention is a WAN node device that controls traffic through networking with a control tower in a tactical mesh network environment, and provides real-time monitoring to the control tower by collecting packets and flows of the traffic in real time. Including a tactical mesh WAN node to perform, the tactical mesh WAN node, an agent managing the life cycle of a virtual entity constituting the interior of the tactical mesh WAN node, and collects traffic transmitted and received through the tactical mesh WAN node In a tactical mesh network environment including a proxy that transmits to the control tower and performs traffic tagging for monitoring individual traffic and conditioning for traffic distribution to a virtual switch according to the QoS control message of the control tower. WAN node devices can be provided.

The aforementioned mesh WAN node of the present invention may operate as a white box server switch.

The white box server switch of the present invention may execute networking functions including packet routing, firewall, and traffic monitoring as an application service.

The white box server switch of the present invention comprises a monitoring and control plane through which networking traffic between the control tower and the agent and the proxy is transmitted, and a data plane through which service traffic is transmitted and received, and the monitoring and control plane and the data The planes can be separated from each other through a multi-access networking interface.

The agent and the proxy of the present invention may be deployed in a trusted cell that is structurally isolated from other hardware resources in the tactical mesh WAN node to block access by unauthorized users.

The virtualization entity of the present invention may include the virtual switch, a virtual machine including an element function of networking slicing or application service, and the proxy.

The life cycle of the present invention may include creation, status check, update, removal, and restoration of the virtualized object.

The proxy of the present invention may be configured as a software module attached in the form of a sidecar in a networking box for application of the tactical service mesh.

The control tower of the present invention can manage the application service QoS of the entire tactical mesh network and the state of networking nodes through networking with the agent and the proxy.

The tactical mesh WAN node of the present invention may be a plurality, and the plurality of tactical mesh WAN nodes may be connected by the proxy included in each.

Monitoring information generated through the real-time monitoring of the present invention may be displayed through a monitor by collecting the control tower in the tactical mesh network environment, and may be displayed through a monitor provided in the tactical mesh WAN node.

According to an embodiment of the present invention, by including an SDN/NFV-based multi-access networking interface and a virtualized networking switch, a tactical mesh WAN node integrating hardware and software can be configured.

According to an embodiment of the present invention, it is possible to support QoS coordination of tactical traffic by linking the eBPF-based traffic monitoring method to the tactical mesh WAN node.

1 is a block diagram of a WAN node device in a tactical mesh network environment according to an embodiment of the present invention.
2 is a block diagram illustrating a TEE-based security of a tactical mesh WAN node according to an embodiment of the present invention.
3 is a view for explaining eBPF-based real-time monitoring for a tactical mesh WAN node according to an embodiment of the present invention.

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms, only these embodiments are intended to complete the disclosure of the present invention, and those of ordinary skill in the art to which the present invention pertains. It is provided to completely inform the scope of the invention, and the scope of the invention is only defined by the claims.

In describing the embodiments of the present invention, detailed descriptions of known functions or configurations will be omitted except when actually necessary in describing the embodiments of the present invention. In addition, terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to the intention or custom of users or operators. Therefore, the definition should be made based on the contents throughout this specification.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a WAN node device in a tactical mesh network environment according to an embodiment of the present invention.

Referring to FIG. 1, the WAN node device according to the present embodiment describes a control plane with the control tower 110 in a tactical mesh network environment. Specifically, it will provide a function (i.e., a gateway role for application service traffic) such as controlling traffic through networking (e.g., forwarding/routing networking control so that traffic is transmitted to the destination). For this purpose, it may include a tactical mesh WAN node 120 that collects packets and flows of traffic in real time and provides real-time monitoring to the control tower 110.

Here, only one tactical mesh WAN node 120 is illustrated for convenience of explanation and enhancement of understanding, but the present invention is not necessarily limited thereto, and the tactical mesh WAN node 120 may be configured in plural. , Each of the plurality of tactical mesh WAN nodes may be connected by a proxy included in each.

In addition, the control tower 110 may include a plurality of controllers each capable of performing functions such as providing a preset traffic control policy to each proxy corresponding to correspond to a plurality of tactical mesh WAN nodes. Through networking with the 121 and the proxy 122, functions such as managing the QoS of the application service of the entire tactical mesh network and the state of networking nodes may be provided.

In addition, the control tower 110 may provide an interface for efficient integrated control of the entire tactical mesh network, that is, provide services such as monitoring information visualization and API for each monitoring and control function.

Meanwhile, the mesh WAN node 120 may operate as, for example, a DANOS-based white box server switch, and the DANOS may execute networking functions including, for example, packet routing, firewall, and traffic monitoring as an application service.

Here, the white box server switch may be composed of, for example, a monitoring and control plane through which networking traffic is transmitted between the control tower 110 and the agent 121 and the proxy 122, and a data plane through which service traffic is transmitted and received. The monitoring and control plane and the data plane can be separated from each other through a multi-access networking interface.

In addition, the agent 121 in the tactical mesh WAN node 120 is a virtualization constituting the interior of the tactical mesh WAN node 120 so that the tactical mesh WAN node 120 can operate as a DANOS-based white box server switch. It can provide functions such as managing the life cycle of an object. From this point of view, the agent 121 may be defined as a node management agent.

Here, the virtualized object may include, for example, a virtual switch 123, a virtual machine (not shown) including element functions of networking slicing or application service, a proxy 122, and the like, and the life cycle of the virtualized object is For example, it may include creation of a virtualized object, status check, update, removal, recovery, etc.

The proxy 122 collects and transmits the traffic transmitted and received through the tactical mesh WAN node 120 to the control tower 110, and targets the virtual switch 123 according to the QoS control message provided from the control tower 110. Functions such as traffic tagging for monitoring individual packets and conditioning for controlling traffic distribution can be provided. Here, the proxy 122 may be defined as a TSM-adaptive proxy, and may be configured as a software module attached in the form of a sidecar in a networking box to apply the tactical service mesh.

Here, monitoring information generated through real-time monitoring may be collected through the control tower 110 in the tactical mesh network environment and displayed (can be checked) through the monitor, and the monitor provided in the tactical mesh WAN node 120 It can be expressed (can be confirmed) through.

In addition, the LAN port 124 may be a port for connecting between, for example, another node or device and the tactical mesh WAN node 120, and the WAN port 125 is, for example, a tactical mesh WAN node 120 and a control tower. It may be a port for connecting between (110) or connecting between tactical mesh WAN nodes.

2 is a block diagram illustrating a TEE-based security of a tactical mesh WAN node according to an embodiment of the present invention.

Referring to FIG. 2, in order to ensure normal operation of the tactical mesh WAN node 120, the proxy 122 for monitoring and conditioning traffic in the node and the agent 121 for managing virtualization entities (virtualization elements) It is very important that safe operation is premised.

To this end, the tactical mesh WAN node 120 uses the proxy 122 and the agent through a trusted execution environment (TEE) technology capable of allowing distribution of traffic verified step by step from a hardware security chip or a security module. 121 may be placed in a securely isolated environment (trusted cell) 210, and the remaining virtualized objects may be placed in an un-isolated environment (untrusted cell) 220.

That is, the agent 121 and the proxy 122 may be disposed in an environment structurally isolated from other hardware resources (virtualized entities) in the tactical mesh WAN node 120 to block access by unauthorized users.

Here, since TEE technology fundamentally blocks access from unauthorized users, it is possible to prevent failures occurring in virtual switches and LAN/WAN networking interfaces in general environments (i.e., non-isolated areas) through hardware resource level isolation. It will not be affected at all.

Therefore, even if a failure occurs in a general environment, the stability of the proxy 122 and the agent 121 is guaranteed, and further, by providing a function for the agent 121 to detect and recover from a failure, it is possible to guarantee a higher stability.

At the same time, for secure and reliable networking with the control tower 110, service traffic flows through the monitoring/control plane through which networking traffic is transmitted between the control tower 110 and the proxy 122 and the agent 121. By providing a separate multi-access networking interface for separating from the data plane, reliable networking with the control tower 110 can be performed.

At this time, the interfaces can be restricted to access and use only proxies and agents located in an isolated execution environment based on TEE. Through this, the proxy and agent are isolated from the outside to ensure safety from forgery or tampering attacks, and even if traffic congestion on the data plane, excessive load, or physical failure occurs, monitoring and control traffic transmitted and received with the control tower 110 Performance and stability can be guaranteed.

Here, the tactical mesh WAN node to which the TEE is applied can be configured by using the ACRN hypervisor or Jailhouse of the Linux Foundation, which is an open source TEE software.

3 is a view for explaining eBPF-based real-time monitoring for a tactical mesh WAN node according to an embodiment of the present invention.

Referring to FIG. 3, the tactical mesh WAN node 120 can cover the functions of typical control tools of the existing networking box through a unified method based on a Linux eBPF (extended Berkeley packet filter), and the control tower 110 It can support flexible control that can dynamically change the range and method of packet and flow monitoring and control according to request.

Here, Linux eBPF (extended Berkeley packet filter) is a technology that expands and improves BPF (Berkeley packet filter) developed for real-time packet collection for Unix servers in line with modern computer architecture.

In addition, Linux eBPF greatly expands the functions that were previously limited to packet filtering, such as monitoring, tracing, analysis, and targeting not only networking but also compute (eg, CPU, process, etc.) and storage (eg, disk, RAM, etc.). It can be applied to implementation such as security.

In addition, eBPF for Linux is a lightweight program that can utilize a small amount of CPU and RAM resources, and runs directly on a low-level kernel, enabling rapid monitoring and conditioning, so it can be used for networking or application services even in situations where a large amount of networking traffic occurs. Real-time monitoring without affecting is possible.

Referring back to FIG. 3, the proxy 122 operating in an isolated area (environment) through TEE holds eBPF programs in the form of a template, injects them into the kernel, and provides a physical networking interface, a virtual switch 123, etc. It can be attached to hooks such as sockets and tracepoints related to the resources of

Whenever packet transmission/reception events occur, the attached lightweight eBPF bytecode is executed at the low level of the kernel, and the raw data of the packet passed as a parameter is collected through byte operation to collect necessary header information in real time and map it. ) Can be delivered to the proxy 122.

Conversely, the proxy 122 transmits the collection metric and the sampling period through the map, so that it is possible to adjust the eBPF bytecode monitoring method in real time during execution.

In addition, in order to support dynamic QoS control, the tactical mesh WAN node 120 may perform eBPF-based traffic tagging and conditioning in a manner similar to monitoring. In this case, the eBPF bytecode is hooks that enable traffic tagging and conditioning of Linux. Is attached to

These hooks are used for XDP, which implements the high-performance data plane of the packet with eBPF, bpfilter, which performs packet filtering and forwarding, and TC (traffic control) that performs flow-level traffic conditioning, priority adjustment, and filtering. Yes.

The proxy 122 may transmit detailed rules for traffic tagging and conditioning through a map based on the QoS control message received from the control tower 110 to adjust the operation method of the byte code.

As described above, by configuring the tactical mesh WAN node 120 with the light weight of the program implemented based on eBPF, real-time monitoring and traffic conditioning can be performed, and the tactical mesh WAN through interaction with the control tower 110 It is also possible to provide real-time capability of adjusting monitoring and traffic conditioning methods according to the situation of the node 120.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications, and changes, etc., within the scope not departing from the essential characteristics of the present invention. It will be easy to see that this is possible. That is, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments.

Accordingly, the scope of protection of the present invention should be interpreted by the claims to be described later, and all technical thoughts within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

Claims (11)

As a WAN node device that controls traffic through networking with a control tower in a tactical mesh network environment,
A tactical mesh WAN node for performing real-time monitoring that collects the packets and flows of the traffic in real time and provides them to the control tower,
The tactical mesh WAN node,
An agent for managing the life cycle of a virtual entity constituting the interior of the tactical mesh WAN node,
Traffic tagging for monitoring individual packets and conditioning for traffic distribution are collected and transmitted to the control tower by collecting traffic transmitted and received through the tactical mesh WAN node, and according to the QoS control message of the control tower. Contains a proxy to perform,
The control tower,
Managing the application service QoS of the entire tactical mesh network and the state of networking nodes through networking with the agent and the proxy
WAN node device in a tactical mesh network environment. The method of claim 1,
The tactical mesh WAN node,
Whitebox server switch
WAN node device in a tactical mesh network environment. The method of claim 2,
The white box server switch,
Networking functions including packet routing, firewall, and traffic monitoring are implemented as application services.
WAN node device in a tactical mesh network environment. The method of claim 2,
The white box server switch,
A monitoring and control plane through which networking traffic between the control tower and the agent and the proxy is transmitted,
It is composed of a data plane through which service traffic is transmitted and received,
The monitoring and control plane and the data plane,
Separated from each other through a multi-access networking interface
WAN node device in a tactical mesh network environment. The method of claim 1,
The agent and the proxy,
In order to block access by unauthorized users, it is deployed in a structurally isolated environment (trusted cell) from other hardware resources in the tactical mesh WAN node.
WAN node device in a tactical mesh network environment. The method of claim 1,
The virtualization entity,
The virtual switch, the virtual machine including the element function of the networking slicing or application service, including the proxy
WAN node device in a tactical mesh network environment. The method of claim 1,
The life cycle is,
Including the creation, status check, update, removal, and recovery of the virtualized object
WAN node device in a tactical mesh network environment. The method of claim 1,
The proxy,
It is composed of software modules attached in the form of sidecars in the networking box for application of the tactical service mesh.
WAN node device in a tactical mesh network environment. delete The method of claim 1,
The tactical mesh WAN node is a plurality,
The plurality of tactical mesh WAN nodes are connected by the proxy included in each
WAN node device in a tactical mesh network environment. The method of claim 1
Monitoring information generated through the real-time monitoring,
In the tactical mesh network environment, it may be collected through the control tower and displayed through a monitor, and may be displayed through a monitor provided in the tactical mesh WAN node.
WAN node device in a tactical mesh network environment.

Images