KR102637615B1 - Management apparatus for edge platform, and control method thereof - Google Patents

Abstract

The present invention relates to client-specific services provided in a mobile-edge computing (MEC) environment, and is capable of supporting remote access between clients outside the edge platform and virtual machines (VMs) inside the edge platform. It relates to the edge platform management device and the operation method of the edge platform management device.

Description

Edge platform management device, and operating method of the edge platform management device {MANAGEMENT APPARATUS FOR EDGE PLATFORM, AND CONTROL METHOD THEREOF}

The present invention, in relation to client-specific services provided in a mobile-edge computing (MEC) environment, supports remote access between clients outside the edge platform and virtual machines (VMs) inside the edge platform. It is about a plan for this.

Serverless computing is a form of service in which all elements except the application are provided by the cloud provider. Except for the application, the cloud provider services physical infrastructure, virtual machines, containers, and integrated management areas, and users can manage the application. there is.

Among these, containers are a much lighter virtualization technology than virtual machines (VMs). They support building all related elements for application execution into one package, which can shorten the time to create and deploy containers. It also has the advantage of being quick to restart.

In this regard, the utilization of the aforementioned virtual resources is also required in the Mobile-Edge Computing (MEC) environment, which is a concept that seeks to provide various IT services and technologies provided in the existing cloud environment at the edge of the mobile network. It is becoming.

In response to these demands, in the mobile edge computing environment, virtual machines (VMs) composed of Kubernetes-based containers (PODs) can be deployed within the edge platform to provide client-specific services based on them.

Meanwhile, client-specific services implemented in this mobile edge computing environment require remote connection between the client and the virtual machine. In particular, it is necessary to support SSH (Secure SHell) connection between the client and the virtual machine for reasons such as service failure and inspection. .

However, since mobile edge computing is directly connected to the communication network and is very sensitive to security, the principle is to block SSH connections from outside the edge platform.

In the client-specific service implemented in the existing mobile edge computing environment, even if remote access from outside the edge platform is required to a virtual machine inside the edge platform for reasons such as service failure or maintenance, SSH access to support this is not possible. I have no choice but to have it.

The present invention was created in consideration of the above-mentioned circumstances, and the purpose to be achieved by the present invention is to connect clients outside the edge platform with respect to client-specific services provided in a mobile edge computing (MEC, Mobile-Edge Computing) environment. It supports remote access between virtual machines (VMs) within the edge platform.

The edge platform management device according to an embodiment of the present invention to achieve the above object is to control the edge platform for a service virtual machine (Virtual Machine) existing on the edge platform while access from outside the edge platform is blocked. a creation unit that creates a connection support virtual machine that processes internal connections, which are connections from the inside, on the edge platform; And setting access rights to the client to allow external access, which is a connection from outside the edge platform, to the connection support virtual machine, so that the connection support virtual machine confirms the external connection of the client for which the access rights are set. In this case, it is characterized by including a setting unit that processes the internal connection to the service virtual machine.

Specifically, the creation unit may select a network in which the service virtual machine is installed within the edge platform as a target network and create the connection support virtual machine in the target network.

Specifically, the creation unit selects a specific internal network where the service virtual machine is deployed as the target network among internal networks that interconnect virtual machines through a virtual LAN, or Another internal network connected to the specific internal network through a virtual router can be selected as the target network.

Specifically, the creation unit generates the connection support virtual machine within the edge platform by transmitting a golden image-based virtual machine creation request to the edge platform, and authenticates uniquely generated for the connection support virtual machine. The connection support virtual machine can be activated by processing the configuration for the connection support virtual machine based on the key.

Specifically, the setting unit will transmit a unique client key generated for the client in connection with the connection support virtual machine to the client, and allow the external connection to the client based on the client key. You can.

Specifically, the internal connection includes an SSH (Secure SHell) connection between the connection support virtual machine and the service virtual machine, and the external connection includes a VPN (Virtual Private Network) connection between the client and the connection support virtual machine. may include.

A method of operating an edge platform management device according to an embodiment of the present invention to achieve the above object includes, for a service virtual machine existing on the edge platform with access from outside the edge platform blocked, A creation step of creating a connection support virtual machine in the edge platform to process an internal connection, which is a connection from inside the edge platform; And setting access rights to the client to allow external access, which is a connection from outside the edge platform, to the connection support virtual machine, so that the connection support virtual machine confirms the external connection of the client for which the access rights are set. In this case, it is characterized by including a setting step to process the internal connection to the service virtual machine.

Specifically, in the creation step, the network where the service virtual machine is installed within the edge platform may be selected as a target network, and the connection support virtual machine may be created in the target network.

Specifically, in the creation step, a specific internal network where the service virtual machine is deployed is selected as the target network among internal networks that interconnect virtual machines through a virtual LAN, or , Another internal network connected to the specific internal network through a virtual router can be selected as the target network.

Specifically, in the creation step, a golden image-based virtual machine creation request is transmitted to the edge platform to create the connection support virtual machine within the edge platform, and a connection support virtual machine is uniquely created for the connection support virtual machine. The connection support virtual machine can be activated by processing configuration for the connection support virtual machine based on the authentication key.

Specifically, in the setting step, a unique client key generated for the client in connection with the connection support virtual machine is delivered to the client, so that the external connection is permitted to the client based on the client key. can do.

Specifically, the internal connection includes an SSH (Secure SHell) connection between the connection support virtual machine and the service virtual machine, and the external connection includes a VPN (Virtual Private Network) connection between the client and the connection support virtual machine. may include.

Accordingly, according to the edge platform management device and the operating method of the edge platform management device of the present invention, a connection support virtual machine is separately created inside the edge platform, and a connection support virtual machine is created based on the client's VPN connection to this connection support virtual machine. Since SSH connections between machines and service virtual machines can be handled, remote connections required between clients and service virtual machines for reasons such as service failures and inspections can be effectively supported.

1 is an exemplary diagram illustrating a mobile edge computing environment according to an embodiment of the present invention.
Figure 2 is a schematic configuration diagram illustrating an edge platform management device according to an embodiment of the present invention.
Figure 3 is an example diagram illustrating the network structure of an edge platform according to an embodiment of the present invention.
Figure 4 is an example diagram illustrating the flow of remote access on the network structure of an edge platform according to an embodiment of the present invention.
Figure 5 is an example diagram for explaining the operation method between each component in the mobile edge platform environment according to an embodiment of the present invention.
Figure 6 is a flowchart illustrating a method of operating an edge platform management device according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the attached drawings.

One embodiment of the present invention deals with Mobile-Edge Computing (MEC) technology, which installs containers, which are virtual resources, on a virtual machine (VM) and provides customer-specific services based on them.

This mobile edge computing technology is a concept that seeks to provide various IT services and technologies at the edge of the mobile network, and requires the use of containers, which are virtual resources, as in the existing cloud environment.

Here, containers are a virtualization technology that is much lighter than virtual machines. All related elements for application execution can be organized and run in one package, and because their capacity is smaller than virtual machines, developers have to spend less time creating and distributing containers. It has the advantage of being able to shorten and restarting quickly.

In this regard, most of the current services are composed of a microservice architecture based on Kubernetes, an open source system that automatically deploys, scales, and manages containerized applications, so the mobile edge computing environment described above Likewise, support for Kubernetes is essential.

In response to these demands, in the mobile edge computing environment, virtual machines (VMs) composed of Kubernetes-based containers (PODs) can be deployed within the edge platform to provide client-specific services based on them.

Meanwhile, client-specific services implemented in this mobile edge computing environment require remote connection between the client and the virtual machine. In particular, it is necessary to support SSH (Secure SHell) connection between the client and the virtual machine for reasons such as service failure and inspection. .

However, since mobile edge computing is directly connected to the communication network and is very sensitive to security, the principle is to block SSH connections from outside the edge platform.

Accordingly, in the client-specific service implemented in the existing mobile edge computing environment, even if remote access from outside the edge platform is required to a virtual machine inside the edge platform for reasons such as service failure or maintenance, SSH access to support this is not possible. There is bound to be a limitation.

Accordingly, in one embodiment of the present invention, in relation to client-specific services provided in a mobile edge computing environment, a new method is proposed to support remote connection between clients outside the edge platform and virtual machines within the edge platform as needed. I want to do it.

In this regard, Figure 1 exemplarily shows a mobile edge computing environment according to an embodiment of the present invention.

As shown in FIG. 1, in a mobile edge computing environment according to an embodiment of the present invention, an edge platform management device 100 that supports remote connection between a virtual machine (VM) inside the edge platform and a client outside the edge platform. It may have a configuration including.

The edge platform management device 100 supports SSH (Secure SHell) access to a virtual machine (VM) when remote connection between a virtual machine inside the edge platform and a client outside the edge platform is required for reasons such as service failure or inspection. refers to a device that

Here, the virtual machine (VM) inside the edge platform refers to a virtual resource deployed on the edge platform to implement services for clients, and will hereinafter be referred to as a 'service virtual machine'.

For reference, since these service virtual machines are deployed inside the edge platform to provide services to clients, direct SSH access from outside the edge platform is not possible due to security issues in the mobile edge computing environment, as described above. It can be seen that the status is

In this regard, the edge platform management device 100 creates a separate virtual machine (hereinafter referred to as a 'connection support virtual machine') to support remote access on the edge platform, and provides Enables SSH connection between clients outside the edge platform and service virtual machines inside the edge platform.

As above, the mobile edge computing environment according to an embodiment of the present invention can support remote connection between a client outside the edge platform and a service virtual machine inside the edge platform based on the above-described configuration. Hereinafter, the edge platform to realize this is described. The configuration of the management device 100 will be described in more detail.

In this regard, Figure 2 shows a schematic configuration of the edge platform management device 100 according to an embodiment of the present invention.

As shown in FIG. 2, the edge platform management device 100 according to an embodiment of the present invention includes a creation unit 110 that creates a connection support virtual machine, which is a separate virtual machine from the client's service virtual machine, and It may have a configuration that includes a setting unit 120 that sets access rights to the connection support virtual machine to the client.

In this way, the entire configuration or at least a portion of the edge platform management device 100, including the generating unit 110 and the setting unit 120, is implemented in the form of a hardware module or a software module, or a hardware module and a software module are implemented. It can also be implemented in a combined form.

Here, the software module can be understood as, for example, an instruction executed by a processor that processes operations within the edge platform management device 100, and these instructions are installed in a separate memory within the edge platform management device 100. It can have a shape.

The edge platform management device 100 according to an embodiment of the present invention can support remote connection between a client outside the edge platform and a service virtual machine inside the edge platform through the above-described configuration. Hereinafter, the edge platform to support this is described. We will continue with a more detailed explanation of each component within the platform management device 100.

The creation unit 110 performs the function of creating a connection support virtual machine to support remote access.

More specifically, the creation unit 110 supports a connection as a separate virtual machine to process an internal connection, which is a connection from inside the edge platform, to a service virtual machine existing in the edge platform, according to the client's request. A virtual machine is created on the edge platform.

Here, the internal connection can be understood as an SSH (Secure SHell) connection performed to support service failures and inspections between the connection support virtual machine and the service virtual machine inside the edge platform.

At this time, the generator 110 generates a unique authentication key for the connection support virtual machine prior to creating the connection support virtual machine.

Here, the authentication key generated for the connection support virtual machine is a value assigned to normally operate the connection support virtual machine as a VPN (Virtual Private Network) server, for example, CA (Certificate Authority) key (ca.key), CA It can include key values such as certificate (ca.crt), Server Key (server.key), Server certificate (server.crt), and Diffie Hellman parameters (dh{n}.pem).

In addition, when a unique authentication key for the connection support virtual machine is generated, the generator 110 selects the network in which the service virtual machine is installed within the edge platform as the target network and creates a connection support virtual machine in the selected target network. do.

At this time, the generator 110 selects a specific internal network where the service virtual machine is placed as the target network among the internal networks that interconnect virtual machines through a virtual LAN, or Another internal network connected to the specific internal network and a virtual router can be selected as the target network.

To aid understanding of the description, FIG. 3 exemplarily shows the network structure of an edge platform according to an embodiment of the present invention.

As shown in FIG. 3, a first internal network (N-x) connected via a first virtual LAN (vlan-x) and a second internal network (N-x) connected via a second virtual LAN (vlan-y) N-y) exists, and if a service virtual machine (VM#1) exists in the first internal network (N-x), the first internal network (N-x) is selected as the target network, and the first internal network selected as the target network You can create a connection support virtual machine (EgdeVPN VM) to process internal connections (SSH connections) on the network (N-x).

In addition, the first internal network (N-x) where the service virtual machine (VM#1) exists and the second internal network (N-x) connected through a virtual router (Virtual Router 1) also provide resources in the first internal network (N-x). It may be selected as a target network for reasons such as shortage, and accordingly, when a connection support virtual machine (EgdeVPN VM) is created in the second internal network (N-x), the connection support virtual machine (EgdeVPN VM) is a virtual router (Virtual Router 1). ), of course, it is possible to handle internal connection (SSH connection) with the service virtual machine (VM#1).

In this regard, in one embodiment of the present invention, priority is given to selecting the internal network where the service virtual machine is deployed as the target network, which is the connection path between virtual machines when processing internal connections between the service virtual machine and the connection support virtual machine. It can be understood that the purpose is to minimize communication delay by simplifying as much as possible.

In addition, referring to FIG. 3 illustrated above, in the network structure of the edge platform according to an embodiment of the present invention, an external network that supports routing based on a switch (Physical Switch) is connected to a virtual router (Virtual Router 1). You can expand the communication area to support Internet connectivity by connecting to .

In this regard, the external network (external net) has a public IP subnet (223.39.0/24), and the virtual router (Virtual Router 1) connected to this external network (external net) has an external network A public IP address (223.39.6.2) in one of the public IP bands of (external net) can be assigned to process Internet traffic.

Meanwhile, in the mobile edge computing environment, virtual machines operate as servers such as web servers, so most inbound packets access the virtual machine from the outside.

Accordingly, in one embodiment of the present invention, in consideration of the characteristics of the mobile edge computing environment, a floating IP address-based inbound packet processing function is provided.

In this regard, the external network moves the public IP address of one of the public IP bands for each virtual machine when processing of inbound packets is required from each virtual machine belonging to the internal network. Mapping is managed by assigning an IP address (Floating IP). In response to this, when an inbound packet is received, the edge gateway device 200 assigns the floating IP address (Floating IP) set as the destination address of the inbound packet. It can be converted to the private IP address of the virtual machine that has a mapping relationship with the address and transmitted.

Furthermore, when a target network for creating a connection-supporting virtual machine is selected, the creation unit 110 transmits a golden image-based virtual machine creation request to the edge platform to create a connection-supporting virtual machine within the edge platform. , Additionally, the configuration for the connection support virtual machine is processed based on the authentication key uniquely generated for the connection support virtual machine to activate the connection support virtual machine.

Here, the golden image-based virtual machine creation request may include OpenVPN for normal operation of the connection-supporting virtual machine as a VPN (Virtual Private Network) server.

The setting unit 120 performs the function of setting access rights to the connection-supporting virtual machine to the client.

More specifically, when a connection support virtual machine is created inside the edge platform, the setting unit 120 sets access rights to the client to allow external access from outside the edge platform to the connection support virtual machine, and sets the access rights to the client. The connection support virtual machine that confirms the external connection of the client handles the internal connection (SSH connection) to the service virtual machine.

Here, external connection can be understood as a VPN (Virtual Private Network) connection between a client outside the edge platform and a connection-supporting virtual machine inside the edge platform.

At this time, the setting unit 120 delivers to the client a unique client key generated for the client in connection with the connection support virtual machine, and the external connection (VPN connection) of the client to the connection support virtual machine is based on this client key. ) can be allowed.

Here, the client key is a key value uniquely assigned to each client to allow external access (VPN connection) to the corresponding virtual machine after the creation of a connection-supporting virtual machine. For example, Client key (server.key), and client Can include certificate (server.crt).

In relation to this, Figure 4 exemplarily shows the flow of remote access made on the network structure of an edge platform according to an embodiment of the present invention.

As shown in Figure 4, the client connects to a connection support virtual machine (EdgeVPN VM) created separately inside the edge platform through an external connection (VPN Connection), and connection support is provided by confirming the client's external connection (VPN Connection). The virtual machine (EdgeVPN VM) also handles internal connections (SSH Connection) with service virtual machines (VM #1, VM #2, VM #3) within the edge platform, preventing edge connection for reasons such as service failure and maintenance. The required remote connection between clients outside the platform and service virtual machines (VM #1, VM #2, VM #3) inside the edge platform can be normally supported.

As discussed above, according to the configuration of the edge platform management device 100 according to an embodiment of the present invention, in a mobile edge computing (MEC, Mobile-Edge Computing) environment, the service virtual machine is managed according to restrictions due to security issues. With SSH access from outside the edge platform completely blocked, a separate connection support virtual machine is created inside the edge platform, and the connection support virtual machine and the service virtual machine are connected based on the client's VPN connection to this access support virtual machine. Since SSH connections can be processed, it can be seen that remote connections required between clients and service virtual machines for reasons such as service failures and inspections can be effectively supported.

Hereinafter, the operation method between each component in the mobile edge platform environment according to an embodiment of the present invention will be described with reference to FIG. 5.

First, the edge platform management device 100 generates a unique authentication key for the connection support virtual machine according to a request from the client (S110-S120).

Here, the connection support virtual machine refers to a separate virtual machine for processing internal connections, which are connections from inside the edge platform to a service virtual machine (Virtual Machine) existing on the edge platform.

At this time, the authentication key generated for the connection support virtual machine is a value assigned to normally operate the connection support virtual machine as a VPN (Virtual Private Network) server, for example, CA (Certificate Authority) key (ca.key), CA It can include key values such as certificate (ca.crt), Server Key (server.key), Server certificate (server.crt), and Diffie Hellman parameters (dh{n}.pem).

Then, when a unique authentication key for the connection support virtual machine is generated, the edge platform management device 100 selects the network in which the service virtual machine is installed within the edge platform as the target network for installation of the connection support virtual machine ( S130).

Here, the connection support virtual machine is a separate virtual machine for processing internal connections, which are connections from inside the edge platform to the service virtual machine. In this case, the internal connection is between the connection support virtual machine and the service virtual machine inside the edge platform. It can be understood as an SSH (Secure SHell) connection performed to support service failures and inspections.

At this time, the edge platform management device 100 selects a specific internal network where the service virtual machine is deployed as the target network among the internal networks that interconnect virtual machines through virtual LAN. , or another internal network connected to the specific internal network through a virtual router can be selected as the target network.

Subsequently, when a target network for creating a connection support virtual machine is selected, the edge platform management device 100 transmits a golden image-based virtual machine creation request to the edge platform to create a connection support virtual machine within the edge platform. Also, based on the authentication key uniquely generated for the connection support virtual machine, the configuration for the connection support virtual machine is processed to activate the connection support virtual machine (S140-S150).

Here, the golden image-based virtual machine creation request may include OpenVPN for normal operation of the connection-supporting virtual machine as a VPN (Virtual Private Network) server.

Furthermore, when a connection support virtual machine is created inside the edge platform, the edge platform management device 100 sets access rights to the client to allow external access from outside the edge platform to the connection support virtual machine, and adds to the access rights. The connection support virtual machine that confirms the external connection of the corresponding client processes the internal connection (SSH connection) to the service virtual machine (S160-S190).

Here, external connection can be understood as a VPN (Virtual Private Network) connection between a client outside the edge platform and a connection-supporting virtual machine inside the edge platform.

At this time, the edge platform management device 100 transmits to the client a unique client key generated for the client in connection with the connection support virtual machine, and establishes the client's external access to the connection support virtual machine based on this client key ( VPN connection) can be allowed.

Here, the client key is a key value uniquely assigned to each client to allow external access (VPN connection) to the corresponding virtual machine after the creation of a connection-supporting virtual machine. For example, Client key (server.key), and client Can include certificate (server.crt).

Afterwards, the client connects to the connection support virtual machine (EdgeVPN VM) created separately inside the edge platform through an external connection (VPN connection), and the connection support virtual machine (EdgeVPN VM) confirms the client's external connection (VPN connection). ) handles internal connection (SSH Connection) with service virtual machines (VM #1, VM #2, VM #3) inside the edge platform (S200-S210).

Hereinafter, a method of operating the edge platform management device 100 according to an embodiment of the present invention will be described with reference to FIG. 6.

First, the generator 110 generates a unique authentication key for the connection-supporting virtual machine according to a request from the client (S310-S320).

Here, the connection support virtual machine refers to a separate virtual machine for processing internal connections, which are connections from inside the edge platform to a service virtual machine (Virtual Machine) existing on the edge platform.

At this time, the authentication key generated for the connection support virtual machine is a value assigned to normally operate the connection support virtual machine as a VPN (Virtual Private Network) server, for example, CA (Certificate Authority) key (ca.key), CA It can include key values such as certificate (ca.crt), Server Key (server.key), Server certificate (server.crt), and Diffie Hellman parameters (dh{n}.pem).

Then, when the unique authentication key for the connection support virtual machine is generated, the creation unit 120 selects the network in which the service virtual machine is installed within the edge platform as the target network for creating the connection support virtual machine (S330) .

Here, the connection support virtual machine is a separate virtual machine for processing internal connections, which are connections from inside the edge platform to the service virtual machine. In this case, the internal connection is between the connection support virtual machine and the service virtual machine inside the edge platform. It can be understood as an SSH (Secure SHell) connection performed to support service failures and inspections.

At this time, the edge platform management device 100 selects a specific internal network where the service virtual machine is deployed as the target network among the internal networks that interconnect virtual machines through virtual LAN. , or another internal network connected to the specific internal network through a virtual router can be selected as the target network.

For example, as shown in FIG. 3 previously illustrated, a first internal network (N-x) connected through a first virtual LAN (vlan-x) and a second virtual LAN (vlan-y) connected through If a second internal network (N-y) exists and a service virtual machine (VM#1) exists in the first internal network (N-x), the first internal network (N-x) is selected as the target network and selected as the target network. It is possible to create a connection support virtual machine (EgdeVPN VM) for internal connection (SSH connection) processing on the first internal network (N-x).

In addition, the first internal network (N-x) where the service virtual machine (VM#1) exists and the second internal network (N-x) connected through a virtual router (Virtual Router 1) also provide resources in the first internal network (N-x). It may be selected as a target network for reasons such as shortage, and accordingly, when a connection support virtual machine (EgdeVPN VM) is created in the second internal network (N-x), the connection support virtual machine (EgdeVPN VM) is a virtual router (Virtual Router 1). ), of course, it is possible to handle internal connection (SSH connection) with the service virtual machine (VM#1).

Next, when a target network for creating a connection-supporting virtual machine is selected, the creation unit 110 transmits a golden image-based virtual machine creation request to the edge platform to create a connection-supporting virtual machine within the edge platform. , In addition, the connection support virtual machine is activated by processing the configuration for the connection support virtual machine based on the authentication key uniquely generated for the connection support virtual machine (S340-S350).

Here, the golden image-based virtual machine creation request may include OpenVPN for normal operation of the connection-supporting virtual machine as a VPN (Virtual Private Network) server.

Thereafter, when a connection support virtual machine is created inside the edge platform, the setting unit 120 sets access rights to the client to allow external access from outside the edge platform to the connection support virtual machine, and sets the client according to the access rights. The connection support virtual machine that has confirmed the external connection handles the internal connection (SSH connection) to the service virtual machine (S360-S370).

Here, external connection can be understood as a VPN (Virtual Private Network) connection between a client outside the edge platform and a connection-supporting virtual machine inside the edge platform.

At this time, the setting unit 120 delivers to the client a unique client key generated for the client in connection with the connection support virtual machine, and the external connection (VPN connection) of the client to the connection support virtual machine is based on this client key. ) can be allowed.

Here, the client key is a key value uniquely assigned to each client to allow external access (VPN connection) to the corresponding virtual machine after the creation of a connection-supporting virtual machine. For example, Client key (server.key), and client Can include certificate (server.crt).

Meanwhile, in relation to this, the client connects to a connection support virtual machine (EdgeVPN VM) separately created inside the edge platform through an external connection (VPN Connection), as shown in Figure 4 above, and also connects to the client's external connection (VPN Connection). The connection support virtual machine (EdgeVPN VM) that confirms the connection handles internal connections (SSH Connection) with service virtual machines (VM #1, VM #2, VM #3) inside the edge platform, thereby preventing service failures and inspections. For these reasons, the required remote connection between clients outside the edge platform and service virtual machines (VM #1, VM #2, VM #3) inside the edge platform can be normally supported.

As discussed above, according to the operation method of each component in the mobile edge platform environment according to an embodiment of the present invention, in a mobile edge computing (MEC, Mobile-Edge Computing) environment, the service virtual machine is provided according to restrictions due to security issues. While SSH access from outside the edge platform is completely blocked, a separate access support virtual machine is created inside the edge platform, and based on the client's VPN connection to this access support virtual machine, the access support virtual machine and service virtual machine are connected to each other. Since SSH connections can be processed, it can be seen that the remote connection required between the client and the service virtual machine for reasons such as service failure and maintenance can be effectively supported.

Meanwhile, the operating method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the present invention has been described in detail with reference to preferred embodiments so far, the present invention is not limited to the above-described embodiments, and the technical field to which the present invention pertains without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will recognize that the technical idea of the present invention extends to the extent that various changes or modifications can be made.

According to the edge platform management device and the operating method of the edge platform management device according to the present invention, in relation to client-specific services provided in a mobile edge computing (MEC, Mobile-Edge Computing) environment, clients outside the edge platform and inside the edge platform In that it can support remote access between virtual machines (VMs), it overcomes the limitations of existing technologies, and not only has the potential to not only use related technologies but also market or sell the applied devices, it is also realistic. It is an invention that has industrial applicability because it can be clearly implemented.

100: Edge platform management device
110: creation unit 120: setting unit

Claims (12)

For a service virtual machine that exists on the edge platform while access from outside the edge platform is blocked, a connection support virtual machine that processes internal connections, which are connections from inside the edge platform, is created on the edge platform. A generating unit that does; and
When the connection permission to allow external connection from outside the edge platform to the connection support virtual machine is set on the client, and the external connection of the client for which the access permission is set is confirmed by the connection support virtual machine. , including a setting unit to process the internal connection to the service virtual machine,
The generating unit,
Among the internal networks that interconnect virtual machines through a virtual LAN, a specific internal network where the service virtual machine is deployed is first selected as a target network for creating the connection support virtual machine,
An edge platform management device characterized in that, when the connection support virtual machine cannot be created in the specific internal network, another internal network connected to the specific internal network through a virtual router is selected as the target network. delete delete According to claim 1,
The generating unit,
A golden image-based virtual machine creation request is transmitted to the edge platform to create the connection-supporting virtual machine within the edge platform,
An edge platform management device characterized in that it activates the connection support virtual machine by processing configuration for the connection support virtual machine based on an authentication key uniquely generated for the connection support virtual machine. According to claim 1,
The settings section,
Edge platform management characterized in that a unique client key generated for the client is transmitted to the client in connection with the connection support virtual machine, and the external connection is allowed to the client based on the client key. Device. According to claim 1,
The internal connection is,
Includes SSH (Secure SHell) connection between the connection support virtual machine and the service virtual machine,
The external connection is,
An edge platform management device comprising a VPN (Virtual Private Network) connection between the client and the connection-supporting virtual machine. For a service virtual machine that exists on the edge platform while access from outside the edge platform is blocked, a connection support virtual machine that processes internal connections, which are connections from inside the edge platform, is created on the edge platform. creation step; and
When the connection permission to allow external connection from outside the edge platform to the connection support virtual machine is set on the client, and the external connection of the client for which the access permission is set is confirmed by the connection support virtual machine. , including a setting step to process the internal connection to the service virtual machine,
The creation step is,
Among the internal networks that interconnect virtual machines through a virtual LAN, a specific internal network where the service virtual machine is deployed is first selected as a target network for creating the connection support virtual machine,
If the connection support virtual machine cannot be created in the specific internal network, the edge platform management device is characterized in that another internal network connected to the specific internal network through a virtual router is selected as the target network. How it works. delete delete According to claim 7,
The creation step is,
A golden image-based virtual machine creation request is transmitted to the edge platform to create the connection-supporting virtual machine within the edge platform,
A method of operating an edge platform management device, characterized in that activating the connection support virtual machine by processing configuration for the connection support virtual machine based on an authentication key uniquely generated for the connection support virtual machine. According to claim 7,
The setting step is,
Edge platform management characterized in that a unique client key generated for the client is transmitted to the client in connection with the connection support virtual machine, and the external connection is allowed to the client based on the client key. How the device works. According to claim 7,
The internal connection is,
Includes SSH (Secure SHell) connection between the connection support virtual machine and the service virtual machine,
The external connection is,
A method of operating an edge platform management device, comprising a VPN (Virtual Private Network) connection between the client and the connection-supporting virtual machine.