KR20160088409A - System and method for creating service chains and virtual networks in the cloud - Google Patents

Abstract

Embodiments for creating a virtual network having a service chain such as an n-tier network in the cloud are provided herein. In one embodiment, a network diagram for a virtual network is received from a user via a graphical user interface. The network diagram includes elements representing virtual or physical network elements. Network components include switches, routers, firewalls, links, service appliances, virtual machines, servers, or other network components. If authentication of the network diagram is successful through the authentication phase, the network diagram is compiled into an application programming interface (API) call for execution. The executed API call is used to establish a virtual network on the physical network infrastructure. The virtual network includes virtual network components corresponding to elements or network diagrams.

Description

[0001] SYSTEM AND METHOD FOR CREATING SERVICE CHAIN AND VIRTUAL NETWORK IN THE CLOUD [0002] SYSTEM AND METHOD FOR CREATING SERVICE CHAINS AND VIRTUAL NETWORKS IN THE CLOUD [

This application claims priority to U.S. Provisional Application Serial No. 14 / 191,526 entitled " System and Method for Creating Service Networks and Virtual Networks in the Cloud, " filed on February 27, 2014, The contents of which are incorporated herein.

The present invention relates to cloud computing, and more particularly, to a system and method for creating a service chain and a virtual network in the cloud.

A typical cloud network for cloud applications and services consists of a plurality of tiers, commonly referred to as n-tiers. Each tier hosts a computer or process that performs a particular function. Also, the network tiers are usually separated from each other by network components such as firewalls among others by a load balancer. An example of a n-tier network is a three-tier network that includes a web tier, an application tier, and a database tier that are in turn connected to a public network, e.g., the Internet. Each tier resides behind a firewall that protects one tier from the other. Typically, n-tier cloud networks and services are created using a comment line, a preconfigured input form, or a combination of the two. Web services such as Amazon EC2 ^TM (Elestic Compute Cloud) and OpenStack ^TM are examples of approaches for building a n-tier cloud network for cloud applications and services. These Web services are available to customers to build their own cloud networks and services. This involves the creation of a security group (SG), each group containing a set of access control lists (ACLs). The generated SG may be applied to a virtual machine (VM) in the physical network to virtualize an n-tier network. Using these web services and similar command line and form input formats to create n-tier cloud networks and services can be challenging and time consuming / costly. There is a need for a simpler system and method for creating n-tier or virtual cloud networks and services that can address these problems.

According to one embodiment of the present disclosure, a method by a cloud processing component for creating a virtual network comprises receiving a network diagram for a virtual network from a user via a graphical user interface. A network diagram includes elements, each of which represents a network element. The method validates the network diagram and, if authentication of the network diagram is successful, compiles the network diagram into an application programming interface (API) call. The API call is then executed. Using the executed API call, the virtual network is constructed according to the network diagram. The virtual network includes a virtual network element corresponding to an element of the network diagram.

According to another embodiment of the present disclosure, a method for creating a virtual network by a user includes using a graphical user interface of a cloud computing platform to enter a network diagram representing a virtual network. A network diagram contains elements, each of which represents a network element. Network diagrams enable the cloud computing platform to build virtual networks using application programming interface (API) calls. The virtual network includes a virtual network element corresponding to an element of the network diagram.

According to another embodiment of the present disclosure, a network element for creating a virtual network includes at least one processor and a non-transitory computer readable storage medium for storing programming for execution by the at least one processor . The programming includes instructions for receiving a network diagram for a virtual network from a user via a graphical user interface. The network diagram includes elements, each of which represents a physical network element. The programming further includes an instruction to authenticate the network diagram and, if authentication of the network diagram is successful, an instruction to compile the network diagram into an API call. The network component is further configured to execute an API call and build a virtual network according to the network diagram using the executed API call. The virtual network includes virtual network components corresponding to network diagrams or elements.

The foregoing has broadly outlined features of one embodiment of the invention in order that the following detailed description of the invention may be better understood. Additional features and advantages of embodiments of the present invention that form the subject of the claims of the present invention will be described hereinafter. It should be understood by those of ordinary skill in the art that the disclosed concepts and specific embodiments may be readily utilized as a basis for modifying or designing other structures or processes to accomplish the same purpose as the objects of the present invention. Those skilled in the art will recognize that such equivalent constructions do not depart from the spirit and scope of the invention as defined in the appended claims.

BRIEF DESCRIPTION OF THE DRAWINGS For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following descriptions taken in conjunction with the accompanying drawings, in which: FIG.
Figure 1 shows an example of a three-tier cloud network.
Figure 2 illustrates one embodiment of creating an n-tier network with a service chain in the cloud.
Figure 3 illustrates one embodiment of creating an n-tier network through a graphical user interface.
Figure 4 illustrates one embodiment of a method for creating an n-tier network.
5 is a diagram of a processing system that may be utilized to implement various embodiments.
Corresponding numbers and symbols in different drawings generally indicate corresponding parts, unless otherwise indicated. The drawings are intended to clearly illustrate the relevant aspects of the embodiments, and are not necessarily to scale.

The construction and use of presently preferred embodiments are described in detail below. It should be understood, however, that the invention provides a number of applicable inventive concepts that may be embodied in a wide variety of specific contexts. The specific embodiments described are merely illustrative of specific ways of constructing and using the invention and are not intended to limit the scope of the invention.

1 shows an example of a three-tier network 100 that includes a web tier 110, an application tier 120, and a database tier 130. The tiers face the public network 140, e. G. The Internet. Each tier hosts a computer, processor or server that performs certain functions of the corresponding tier. Each tier also resides behind a firewall component or function that protects the corresponding tier from external components (other tiers or public networks). Generally, a software tool such as Microsoft Visio ^TM or a network planning tool such as OpNET ^TM may be used to draw a network diagram of a three-tier or other n-tier network. This diagram is used as a guideline by the user (e.g., system engineer) to select and connect the appropriate network equipment and servers to build an n-tier network. Generally, to build an n-tier virtual network within the cloud, a group of elements, such as Amazon's security group (SG), is created using a software tool such as EC2 ^TM . For example, for each SG traffic, a policy rule is subsequently added via an access control list (ACL). For example, for a two-tier network, two SGs, a WebServerSG, and a DBServerSG are created. The ACL is then added for both inbound and outbound traffic for each SG. A virtual machine (VM) is then constructed for each tier and used to apply the SG.

With the rapid adoption of cloud computing, customers need to conveniently deploy an n-tier network in the cloud to move or mimic their on-premise environment. However, current cloud computing platforms, such as Amazon EC2 ^TM and OpenStack ^TM , include a limited user interface for creating virtual networks, such as using input forms and line commands. Here, embodiments for generating a service chain and a virtual network in the cloud, such as an n-tier network, are provided. These embodiments include a system and method for building a virtual network in the cloud using a user-friendly network diagram drawing methodology and a user interface. Using this approach, a cloud computing provider can provide a user-friendly self-service that allows the customer to easily create a virtual network in the cloud, mimicking a conventional direct-installed physical network.

Figure 2 shows an implementation 200 for creating a virtual network, such as an n-tier network with a service chain in the cloud. A user can first log in to a cloud management platform / system via a cloud portal, e.g., a website or service. The user then draws a network diagram representing the n-tier network. Each tier provides a service. In this scenario, three services, including a database service, an application service, and a web service, are linked in that order to form a service chain. The network diagram may include any suitable network elements that mimic or correspond to network components such as switches, routers, other service applications, links and / or other network components. The network diagram also reflects the actual intended topology of the virtual network, such as layer / order and interconnection between the different components. The process of drawing a network diagram is interactive in that the system requires input from the user and also provides feedback based on the user's actions.

Network diagrams are drawn using a graphical user interface (GUI) that is part of the cloud management platform / system. The GUI may be provided by a software tool or a web service. After submitting a network diagram representing an n-tier network, the system may validate the network diagram. When the network diagram passes the authentication process, the system compiles the network diagram into an application programming interface (API) call. The API call is then executed by the system to configure one or more basic physical networks to build a virtual n-tier network according to the user's network diagram. Thus, the diagram components are inevitably one to one mapped to the corresponding virtual network components. The system recognizes each element or element of the diagram and has the ability to map that element to the corresponding virtual element. Virtual networks provide network connectivity and ensure policy enforcement. A virtual network may be constructed in accordance with available virtualization techniques provided by a physical network or system, such as a virtual local area network (VLAN).

In one embodiment, each user or group of users (e. G., Within the enterprise) may initially be able to establish a virtual or cloud based n-tier network by using a resource Acquire pools (e.g., through purchases) or receive them. For example, a resource pool may include the maximum number of VLANs, switch ports, forwarding entities, bandwidth, storage size, and / or other network resources available to a user or group. The entire available resources in the resource pool assigned to the user or group of users may also be partitioned (re-allocated) to other individual users or groups. Thus, each user or group uses the corresponding designated resource to establish a corresponding virtual n-tier network.

FIG. 3 shows an implementation 300 of generating a virtual network, such as an n-tier network, via a graphical user interface. As noted above, the graphical interface is represented to the user (after sign-in) by the cloud system. As an example, the user creates three logical networks (three-tier virtual network) including a web server, an application server, and a database server connected to the Internet (or a public network) successively in that order. A three-tier or logical network is created by drawing a corresponding figure in a box or drawing an element for each element, as shown in FIG. The elements also include a firewall between the logical network and the link between the elements located by the user. Complete the network diagram. The user can then submit the diagram to the system to build his n-tier network within the cloud. The cloud system then compiles this network diagram with the API call and automatically executes the API call. An automatically executed API call configures the underlying physical network to create a three-tiered virtual network. The generated virtual network provides network connectivity and guarantees policy enforcement.

Figure 4 illustrates one embodiment of a method 400 for creating a virtual network, such as an n-tier network. At step 410, a pool of resources is assigned to the user or group of users. At step 420, a network diagram of the n-tier or other virtual network is received from the user via the graphical user interface and the cloud portal. In step 430, the system authenticates the network diagram. The authentication process includes verification that the user has not exceeded the allowed resources according to the assigned resource pool. Other authentication rules such as network policy rules can be applied. At decision step 435, the system verifies that the network diagram is valid. If the network diagram is valid, the method 400 proceeds to step 450. Otherwise, at step 440, feedback is sent to the user to modify the network diagram. The method 200 then returns to step 430 and waits for user input. Alternatively, at step 450, the network diagram is compiled into an API call. At step 460, an API is executed to configure the underlying physical network, thereby establishing a virtual network with (virtual) components that map the elements of the user network diagram.

5 is a block diagram of an exemplary processing system 500 that may be used to implement various embodiments. The processing system is part of a cloud platform / system for creating an n-tier network having a service chain in the cloud as described above. The processing system 500 may include a processing unit 501 having one or more input / output devices such as a speaker, microphone, mouse, touch screen, keypad, keyboard, printer, The processing unit 501 includes a central processing unit (CPU) 510, a memory 520, a mass storage device 530, a video adapter 540, and an input / output (I / O) . The bus may be any type of bus architecture, including a memory bus or memory controller, a peripheral bus, a video bus, and the like.

CPU 510 may comprise any type of electronic data processor. The memory 520 may include any type of system memory, such as a fixed random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous DRAM (SDRAM), a read-only memory have. In one embodiment, the memory 520 may include a ROM for use in boot-up and a program and data storage DRAM for use during execution of the program. Mass storage device 530 may include any type of storage device configured to store data, programs, and other information, and to configure data, programs, and other information accessible via the bus. Mass storage device 530 may include, for example, one or more semiconductor drives, hard disk drives, magnetic disk drives, or optical disk drives, and the like.

The video adapter 540 and the I / O interface 590 provide an interface for connecting the external input device and the output device to the processing unit. As illustrated, examples of input devices and output devices include any combination of a display 560 connected to a video adapter 540 and a mouse / keyboard / printer 570 connected to an I / O interface 590. Other devices may be coupled to the processing unit 501, and additional or fewer interface cards may be used. For example, a serial interface card (not shown) may be utilized to provide a serial interface for the printer.

The processing unit 501 also includes one or more network interfaces 550 that may include a wired link such as an Ethernet cable and / or one or more networks 580 or a wireless link to an access node. The network interface 550 allows the processing unit 501 to communicate with the remote unit via the network 580. For example, network interface 550 may provide wireless communication via one or more transmitter / transmit antennas and one or more receiver / receive antennas. In one embodiment, the processing unit 501 is coupled to a local area network or a wide area network for communication and data processing with remote units such as other processing units, the Internet, or remote storage facilities.

While several embodiments are provided herein, it should be understood that the disclosed system and method may be embodied in many different specific forms without departing from the spirit or scope of the invention. These examples are illustrative only and should not be taken as limiting, and the intent is not to be limited to the details given herein. For example, various elements or components may be combined or integrated within another system, or certain features may be omitted or not implemented.

In addition, the techniques, systems, subsystems, and methods described and illustrated in various embodiments independently or separately may be combined or integrated with other systems, modules, techniques, or methods without departing from the scope of the present invention . Other configurations illustrated or described as communicating, directly connected, or coupled to each other may be indirectly connected or communicated through some interface, device, or intermediary component in an electronic, mechanical, or other form. Other examples of alterations, substitutions, and substitutions may be made by those skilled in the art without departing from the spirit and scope of the invention as described herein.

Claims (20)

CLAIMS 1. A method by a cloud processing component for creating a virtual network,
Receiving, via a graphical user interface from a user, a network diagram for a virtual network, the network diagram comprising an element, each element representing a network component;
Authenticating the network diagram;
If authentication of the network diagram is successful, compiling the network diagram into an application programming interface (API) call;
Executing the API call; And
Establishing the virtual network according to the network diagram using the API call executed, the virtual network comprising a virtual network element corresponding to the element or the network diagram,
≪ / RTI > The method according to claim 1,
Further comprising assigning a pool of resources to the user,
Wherein authenticating the network diagram comprises verifying that the network diagram does not use more resources than resources in a pool of resources allocated for the user. The method according to claim 1,
Wherein receiving the network diagram through the graphical user interface comprises providing feedback to a user according to a user's behavior. The method according to claim 1,
If the authentication of the network diagram is successful, providing feedback to the user indicating a missing input or an incorrect input in the network diagram. The method according to claim 1,
Wherein establishing the virtual network comprises mapping each element of the network diagram to a corresponding one of the virtual network elements according to a topology of the network diagram. The method according to claim 1,
Wherein establishing a virtual network using the executed API call comprises providing network connectivity and policy enforcement. The method according to claim 1,
Wherein the virtual network is a virtual local area network (VLAN). The method according to claim 1,
Wherein the virtual network comprises a set of network tiers, the elements of the network diagram representing a virtual machine (VM) or server for each tier network, and a firewall separating the network tiers , Way. The method according to claim 1,
Wherein the network element represented by each element of the network diagram is a switch, router, firewall, link, or service appliance. A method for a user to create a virtual network,
Using a graphical user interface of a cloud computing platform, to enter a network diagram representing a virtual network, said network diagram comprising respective elements representing network components,
Lt; / RTI >
Wherein the network diagram allows the cloud computing platform to build the virtual network using an application programming interface (API) call,
Wherein the virtual network comprises a virtual network element corresponding to an element of the network diagram. 11. The method of claim 10,
Wherein the virtual network comprises a series of network tiers, the elements of the network diagram representing a virtual machine (VM) or server for each tier network, and a firewall separating the network tiers. 11. The method of claim 10,
Accessing the graphical user interface via a web portal. 11. The method of claim 10,
Further comprising selecting an element of the network diagram according to a pool of resources allocated to the user. 11. The method of claim 10,
Wherein entering the network diagram using the graphical user interface comprises receiving feedback from the cloud computing platform in accordance with user behavior. A network element for creating a virtual network,
At least one processor; And
A non-transitory computer readable storage medium storing programming for execution by the at least one processor;
Lt; / RTI >
The above-
Instructions for receiving a network diagram for a virtual network from a user via a graphical user interface, the network diagram comprising elements, each element representing a network element;
Instructions for authenticating the network diagram;
If authentication of the network diagram is successful, compile the network diagram into an application programming interface (API) call;
An instruction to execute the API call; And
Instructions for building the virtual network according to the network diagram using the API call executed, the virtual network comprising a virtual network element corresponding to the element or the network diagram,
And a network element. 16. The method of claim 15,
The programming further comprising instructions for assigning a pool of resources to a user,
Wherein authenticating the network diagram comprises verifying that the network diagram does not use more resources than resources in the pool of resources allocated for the user. 16. The method of claim 15,
Wherein the instructions for building the virtual network comprise instructions for mapping each element of the network diagram to a corresponding component of one of the virtual network components in accordance with the topology of the network diagram. . 16. The method of claim 15,
Wherein the instructions for establishing a virtual network using the executed API call comprise instructions for providing network connectivity and policy enforcement. 16. The method of claim 15,
Wherein the virtual network comprises a database tier, an application tier, and a web tier interconnected in order through a link, wherein the web tier is further connected to a public network,
Wherein the virtual network further comprises a firewall on each link between the database tier, the application tier, and the web tier. 16. The method of claim 15,
Wherein the graphical user interface is accessible through a web portal.

Images