KR20160137248A - Method and System for providing multi-path for a cloud service - Google Patents

Abstract

The present invention relates to a multi-path providing method for a cloud service and a system thereof. The method and system can enable an enterprise network and a cloud center to exchange and manage information regarding transmission paths by using locator/ID separation protocols (LISPs), provide a network concealment function for the enterprise network address by encapsulating an LISP header on transmission data and decapsulating the LISP header therefrom, and transmit transmission data by using multiple transmission paths between the enterprise network and the cloud center to transmit the transmission data in a distributed manner, thereby enhancing network security even more.

Description

METHOD AND SYSTEM FOR PROVIDING MULTI-PATH FOR A CLOUD SERVICE

The present invention relates to a multi-path providing method and system for a cloud service, and more particularly, to a multi-path providing method and system for enhancing transmission security of a cloud center and a corporate network provided with a cloud service from the cloud center .

As evolving into the era of smart work based on cloud computing, interest in virtual private cloud technology that secure private cloud services through Internet use is increasing. Virtual private cloud technology is a technology that allows users to store their services or applications on a common server instead of on the user's desktop, and to execute them whenever needed. Users can be provided with services in the enterprise or in the public cloud It is a service that provides the same work environment.

The most important thing in providing such a cloud service is the security of the corporate network information stored in the cloud center. In addition to the security of the corporate network information in the cloud center server, the backbone network used for information exchange between the enterprise network and the cloud center Such as hacking and eavesdropping.

Accordingly, there is a need for a method for enhancing security when exchanging data between a corporate network and a cloud center through a backbone network in a virtual private cloud network.

Accordingly, embodiments of the present invention provide a method and system for securing security against various security threats such as hacking and eavesdropping in a backbone network in providing a virtual private cloud service.

According to an aspect of the present invention, a method for providing a multipath for a cloud service is provided. When the terminal of the enterprise network to receive the cloud service tries to transmit a packet to the cloud server providing the cloud service, the method includes an ingress tunnel router (ITR) connecting the enterprise network and the backbone network, ) Requesting RLOC (Routing Locator) information to be mapped to an identifier (EID) of the cloud server; And an Egress Tunnel Router (ETR) connecting the backbone network and the cloud server receives the request and notifies RLOC information mapped to the EID and all available multipath information between the ITR and the ETR ; And constructing a multipath between the ITR and the ETR in the backbone network according to the notified RLOC information and the available multipath information of the ITR.

In one embodiment, the RLOC information request may be communicated to the ETR via at least one of the router and the mapping system in the backbone network.

In one embodiment, the method may further include the step of the ETR mapping the EID of the cloud server with the RLOC information of the cloud center to which the cloud server belongs and registering the information in the mapping system.

In one embodiment, the method may further comprise the step of the ITR requesting a router of the backbone network for multi-path establishment to allocate the bandwidth by requesting multi-path bandwidth reservation.

In one embodiment, the method further comprises distributing, after the multi-path between the ITR and the ETR is established, the terminal of the enterprise network to distribute packets to be transmitted to the cloud server through the multi-path by the ITR .

In one embodiment, the method may further comprise the step of the ETR receiving packets distributed over the multipath from the ITR and combining the received packets to the cloud server.

In one embodiment, the ITR encapsulates a tunnel IP header that designates the RLOC received as a destination IP address and designates its RLOC as a source IP address in a packet to be transmitted to the cloud server by the terminal of the enterprise network (Encapsulation) to the backbone network.

The encapsulated packet is delivered to the destination ETR by the routers of the backbone network based on the RLOC information specified in the destination IP address of the tunnel IP header.

The ETR, upon receiving the encapsulated packet, decapsulates the tunnel IP header in the packet and delivers it to the cloud server.

According to another aspect of the present invention, a multipath provisioning system for a cloud service is provided. The system connects an enterprise network and a backbone network. When the terminal of the enterprise network desires to transmit a packet to a cloud server providing a cloud service, the system requests RLOC information mapped to an identifier (EID) of the cloud server And an RLOC information requesting unit configured to connect to the backbone network and the cloud server and to receive an RLOC information request from the ITR, the RLOC information being mapped to an identifier (EID) of the cloud server, And an advance tunnel router (ETR) for informing the ITR of all available multi-path information between the ITR and the ETR, wherein the ITR, in response to the notified RLOC information and the available multi-path information, And establishes a multi-path between the ITR and the ETR.

According to an embodiment of the present invention, network security can be enhanced by providing multiple transmission paths in a backbone network between a corporate network and a cloud center in providing a virtual private cloud service, which is rapidly increasing in demand. Through this, it is possible to provide secure cloud services to enterprise network users who are worried about using virtual private cloud service due to security problems, and will contribute to activation of smart work projects of public institutions.

FIG. 1 shows a virtual private cloud network configuration based on a LISP (Locator / ID Separation Protocol) according to an embodiment of the present invention.
2 shows a multipath providing procedure for a cloud service according to an embodiment of the present invention.

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the present invention, detailed description of known related arts will be omitted when it is determined that the gist of the present invention may be unnecessarily obscured.

In addition, the singular phrases used in the present specification and claims should be interpreted generally to mean "one or more " unless otherwise stated.

The present invention exchanges and manages information about transmission paths between a corporate network and a cloud center using a LISP (Locator / ID Separation Protocol) protocol, encapsulates and decapsulates LISP headers in transmission data, We propose a method to enhance network security by distributing transmission data while using multiple transmission paths between the enterprise network and the cloud center.

In order to solve various problems caused by simultaneously performing two roles of the IP address locator and the identifier, the LISP protocol uses an endpoint identifier for identifying an individual terminal, EID) and a routing locator (RLOC) used to distinguish the location of the network to which the terminal belongs and to perform routing. The LISP protocol defines a set of information exchanged by routers for the mapping of EID and RLOC, and defines a mechanism for routing and forwarding packets transmitted from the terminal to LISP routers to other terminals through the backbone network.

LISP related standards are defined by the Internet Engineering Task Force (IETF), and there are currently standards such as RFC6830, RFC6831, RFC6832, RFC6833, RFC6834, RFC6835, RFC6836, and RFC6837.

1 is a block diagram of a virtual private cloud network based on LISP according to an embodiment of the present invention. As shown in FIG. 1, a corporate network 1100 is connected to a cloud center 1300 through a backbone network 1200. The cloud center 1300 provides computing resources to subscribers of the enterprise network 1100. The computing resources include applications, CPU processing capacity, storage capacity, and the like.

In order to perform LISP protocol-based data communication between the enterprise network 1100 and the cloud center 1300, an ITR (Ingress Tunnel Router) 1110 exists at a boundary between the enterprise network 1100 and the backbone network 1200, An ETR (Egress Tunnel Router) 1310 exists at the boundary between the backbone network 1200 and the cloud center 1300. Although FIG. 1 shows only one ITR and one ETR in the cloud center 1300 in the enterprise network 1100, the ITR and the ETR are classified according to the flow of traffic. In reality, one router is divided into ITR And the ETR function simultaneously. Of course, it is also possible to use separate ITRs and ETRs in each enterprise or cloud center, and it is also possible to use multiple ITRs and ETRs.

When the subscriber terminal 1120 wants to deliver a packet to the server 1320 in the cloud center 1300 in the enterprise network 1100, the ITR 1110 transmits the RLOC allocated to the cloud center to which the destination EID belongs to the mapping system 1400). The ITR 1110 generates a tunnel IP header having the RLOC of the identified cloud center as a destination IP address and its RLOC as a source IP address, and then encapsulates the packet with the EID-based IP address. And transmits it to the backbone network 1200. The backbone network 1200 delivers the packet to the cloud center 1300 based on the RLOC address of the tunnel IP header, and the ETR 1310 of the cloud center decapsulates the tunnel IP header, .

The routers 1210 in the backbone network perform the same function as the routers used in general, and perform routing based on the IP address used in the RLOC. Since the IP address used in RLOC must be unique, private IP addresses can not be used and public IP addresses should be used. On the other hand, in each enterprise network, packets are transmitted by EID, and public IP addresses as well as private IP addresses can be used.

A mapping system 1400 is used for generating and managing EID-RLOC mapping information and may include a mapping resolver 1410 and a mapping server 1420. The mapping server 1420 substantially manages the EID-RLOC mapping information. When the mapping resolver 1410 receives a request for mapping information from the ITR, the mapping resolver 1410 transmits the request to the mapping server 1420. Depending on the implementation, the mapping interpreter 1410 and the mapping server 1420 may be implemented and communicated on separate systems, or may be implemented on a single system.

2 shows a multipath providing procedure for a cloud service according to an embodiment of the present invention. 2, the subscriber terminal 1120, the ITR 1110, the backbone router 1210, the mapping analyzer 1410, the mapping server 1420, the ETR 1310, and the server 1320 shown in FIG. ) Correspond to the components shown in Fig. 1, respectively.

First, the server 1320 operates and attempts to establish a connection to the ETR 1310 (S201).

The ETR 1310 recognizes the EID of the server and registers the EID of the server and the RLOC of the corresponding cloud center in the mapping server 1420 using the LISP control message (S202).

The mapping server 1420 stores the corresponding EID-RLOC mapping information and notifies the ETR of the registration result using the LISP control message (S203). Of course, the mapping server 1420 will also store and manage the EID-RLOC mapping information reported from other ETRs.

Thereafter, the subscriber terminal 1120 of the enterprise network transmits a packet to utilize the computing resources of the cloud center (S204).

Upon receiving the packet, the ITR 1110 requests the mapping analyzer 1410 for RLOC mapping information for the corresponding EID based on the destination EID (S205).

Upon receiving the RLOC information request, the mapping analyzer 1410 transmits an RLOC information request to the mapping server 1420 (S206). The mapping server 1420 transmits the RLOC information request to the mapping server 1420 based on the EID- And transmits the request to the ETR 1310 to which it belongs (S207).

Finally, the ETR 1310 receiving the RLOC information request for the EID notifies the ITR 1110 of the RLOC information about the EID (S208). At this time, when there are a plurality of transmission paths between the ITR 1110 and the ETR 1310, the ETR 1310 notifies all available transmission paths together and notifies the transmission order of each transmission path together .

The ITR 1110 having received the RLOC information for the destination EID reserves the same bandwidth for the routers 1210 in the backbone network for all available transmission paths (S209). It should be appreciated by those skilled in the art that the backbone router 1210 in Figure 2 refers to all routers included in multiple transmission paths between the ITR 1110 and the ETR 1310, rather than referring to a particular router present in the backbone network. I can understand it enough. At this time, the protocols for bandwidth reservation may be signaling protocols used in the Internet field such as LDP and RSVP.

If the bandwidth on the backbone network is successfully allocated for all the multiple transmission paths (S210), then multiple transmission paths are established between the ITR 1110 and the ETR 1310.

After the multi-path between the ITR 1110 and the ETR 1310 is established, the ITR 1110 can dispersively transmit the packets to be transmitted to the cloud server 1320 by the terminal 1120 of the enterprise network through the multipath.

The ITR 1110 designates the RLOC information of the cloud center as a destination IP address, constructs a tunnel IP header (or LISP-related header) designating the RLOC information of the corresponding enterprise network as a source IP address, encapsulates the tunnel IP header To the backbone network (S211).

The backbone routers 1210 that have received the encapsulated packet from the ITR 1110 transmit the packet to the destination ETR 1310 based on the RLOC information of the corresponding tunnel IP header (S212).

After receiving the packet, the ETR 1310 combines the packets received through the multiplex transmission path and delivers the combined packets to the server 1320 of the destination EID (S213).

When the server 1320 in the cloud center transmits information according to the request of the corresponding subscriber terminal 1120, the ETR of the cloud center performs the above-described ITR in a manner opposite to the above procedure, The ITR performs the role of the ETR described above and delivers the packet to the subscriber terminal of the enterprise network (S214 to S217).

In the above embodiment, the EID-RLOC mapping information is managed in the mapping server 1420 with respect to the information of the entire network, but depending on the implementation, the ITR and ETR may also manage partial EID-RLOC mapping information and operate accordingly It is possible.

According to the above-described procedure, a cloud provider providing a virtual private cloud service can prevent threats such as hacking and eavesdropping on data transmitted through a backbone network, and provide security to a cloud service .

The apparatus and method according to the above-described embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination.

Program instructions to be recorded on a computer-readable medium may be those specially designed and constructed for the present invention or may be available to those skilled in the computer software arts. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Includes hardware devices specifically configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. The above-mentioned medium may also be a transmission medium such as a light or metal wire, wave guide, etc., including a carrier wave for transmitting a signal designating a program command, a data structure and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

The embodiments of the present invention have been described above. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (13)

When the terminal of the enterprise network to receive the cloud service tries to transmit a packet to the cloud server providing the cloud service, an ingress tunnel router (ITR) connecting the enterprise network and the backbone network, Requesting RLOC (Routing Locator) information to be mapped to an identifier (EID) of a server;
And an Egress Tunnel Router (ETR) connecting the backbone network and the cloud server receives the request and notifies RLOC information mapped to the EID and all available multipath information between the ITR and the ETR ; And
Establishing a multipath between the ITR and the ETR in the backbone network according to the notified RLOC information and the available multipath information of the ITR
The method comprising the steps of: 2. The method of claim 1, wherein the RLOC information request is communicated to the ETR via at least one of a router and a mapping system in the backbone network. The method of claim 1, wherein the ETR further comprises the step of mapping the EID of the cloud server to the RLOC information of the cloud center to which the cloud server belongs and registering the same in the mapping system . The method of claim 1, further comprising the step of the ITR requesting a router of the backbone network for multi-path bandwidth reservation to allocate the bandwidth. 2. The method of claim 1, wherein after the multi-path between the ITR and the ETR is established, a step in which the terminal of the enterprise network dispersively transmits packets to be transmitted to the cloud server through the ITR A method for providing multipath for a cloud service further comprising: 6. The method of claim 5, wherein the method further comprises receiving packets from the ITR that are distributed over the multi-path and combining the received packets to the cloud server. How to provide a route. The method as claimed in claim 1, wherein the terminal of the enterprise network encapsulates a tunnel IP header for designating the RLOC notified by the ITR as a destination IP address and designating its RLOC as a source IP address in a packet to be transmitted to the cloud server And providing the multi-path to the backbone network. 8. The method of claim 7, wherein the encapsulated packet is delivered to a destination ETR by routers of the backbone network based on RLOC information specified in a destination IP address of the tunnel IP header. 9. The method of claim 8, wherein the ETR receives the encapsulated packet and decapsulates the tunnel IP header in the packet before delivering the encapsulated packet to the cloud server. 2. The method of claim 1, wherein after the multi-path between the ITR and the ETR is established, the cloud server may also transmit packets to the terminal of the enterprise via the multi-path, And the multi-path providing method for the cloud service in which the ITR plays the role of the ETR. (RLOC) information that is mapped to an identifier (EID) of the cloud server when a terminal of the enterprise network attempts to transmit a packet to a cloud server providing the cloud service, ITR)
(RLOC) information, which is mapped to an identifier (EID) of the cloud server, from the ITR through the backbone network, RLOC information to be mapped to the EID, And an advance tunnel router (ETR) for notifying all available multipath information to the ITR,
Wherein the ITR establishes a multi-path between the ITR and the ETR in the backbone network according to the notified RLOC information and the available multi-path information. 12. The method as claimed in claim 11, wherein, after the multi-path between the ITR and the ETR is established, the ITR transmits the packets to be transmitted to the cloud server through the multi- Delivery system. 13. The system of claim 12, wherein the ETR receives packets distributed through the multipath from the ITR and combines the received packets to the cloud server.

Images