RU2804054C2 - Method for secure deployment and registration of a cluster based on white boxes - Google Patents

Abstract

FIELD: white box devices.

SUBSTANCE: invention is related to a method for providing secure routing functionality in a white box cluster containing multiple standalone white boxes, where at least two of the standalone white boxes are manufactured by different manufacturers. The new white box is identified as a white box to be added to the cluster. The specified white box is registered in the installation block of the platform coordinator, and, as part of the registration procedure, the white box is assigned a unique white box identifier (WB-UID) and this identifier is automatically associated with a serial number (S/N). Using the specified new white box, a control “call home” is made to the specified installation block. Using the specified installation block, the information received from the specified new white box is compared with the previously certified configuration of the white box hardware, and when determining that the white box hardware meets the certification requirements of the installation block, the specified new white box is installed along with the corresponding software of the computer platform, containing a software agent provided by the manufacturer of the specified new white box.

EFFECT: ensuring blocking of attempts of unauthorized devices to join a cluster based on white boxes.

5 cl, 2 dwg

Description

Field of technology to which the invention relates

The present disclosure relates generally to the field of communication systems. More specifically, the present disclosure relates to a method for securely deploying and registering virtual clusters.

Glossary

CA – Certificate Authority – Certifying Authority;

NC – Network Cloud – Network cloud;

NCC – Network Cloud Controller – Network cloud controller;

NCF – Network Cloud Fabric – Network cloud switching system;

NCM - Network Cloud Manager - Network cloud management center;

NCP – Network Cloud Packet Forwarder – Transmitter of data packets in the network cloud;

NOS – Network Operating System – Network operating system;

ODM - Original Design Manufacturer - Manufacturer of systems of its own design;

ONIE - Open Network Install Environment - Environment for deploying an open network;

OS – Operating System – Operating system;

S/N – Serial Number – Serial number;

WB – White-box – “White” box;

WB-UID – White-box Unique Identifier – unique identifier of the “white” box; And

The term "White Box" refers to a product that is off the shelf and represents open or industry standard hardware for switches and/or routers within the transmission plane. White boxes provide users with the fundamental hardware elements of a network.

State of the art

Deployment and registration procedures for disaggregated white-box virtual clusters pose a number of security and operational risks. To name just a few, problems with securing cluster boundaries, avoiding unauthorized attempts to join the cluster, ensuring that the white box added to the cluster is certified and has the proper hardware and firmware editions, between white boxes located in the same cluster, authentication and encryption traffic, etc. are exchanged.

The present disclosure is intended to provide a technical solution for securely operating white box clusters.

Disclosure of the invention

The present disclosure may be summarized by reference to the accompanying Claims.

The purpose of the present disclosure is to provide a new system and method for providing a secure method for deploying and maintaining a cluster containing multiple autonomous white boxes used to implement large-scale router functionality.

Another objective of the present disclosure is to provide a new method for aggregating white boxes from various ODM vendors and managing these aggregated boxes as a single entity using Network Operating System (NOS) software from those vendors in a secure manner while maintaining with the ability to choose cluster membership.

Another object of the present disclosure is to provide a new system and method for white box cluster management.

Another goal of the present disclosure is to provide a new method for blocking attempts by unauthorized devices to join a white-box cluster.

Other objects of the present disclosure will become apparent from the following description.

According to a first embodiment of the present disclosure, there is provided a method for obtaining secure routing functionality in a white box cluster containing a plurality of standalone white boxes, where at least two of the standalone white boxes are manufactured by different manufacturers, and where the method comprises: identifying a serial number (S/N) associated with each white box based on that identification, and installing each of the white boxes along with software for the corresponding computer platform associated with the white box , for inclusion in the cluster in question, determining the predefined properties of each of the corresponding white boxes based on this identification and installing each of the specified white boxes along with the corresponding computer platform software containing a software agent developed by the manufacturer of the white box in question .

The term "computer platform", as used in the present specification and claims, is used herein to refer to the environment in which software execution occurs. This may be hardware or an operating system (OS), or both, and be associated with application programming interfaces or other supporting software while those interfaces execute program code. In fact, a computer platform can be thought of as an installation where software can run.

In another embodiment, the method further comprises the step of confirming each white box's configuration and/or revision number, after identifying a serial number associated with the white box in question, such that the white box may conform to the specifications and requirements of the NOS operating system.

In yet another embodiment, the method further comprises the step of associating each white box with a network operating system (NOS) identity, which may optionally implicitly indicate who the manufacturer of each corresponding white box is.

In yet another embodiment, the computer platform software further includes certification by the manufacturer of the corresponding white box, which can be used to confirm the configuration or revision of the configuration of the white box.

According to yet another embodiment, the proposed method comprises the steps:

(a) identifying the new white box as a white box to be added to a cluster containing a plurality of autonomous white boxes;

(b) registering a new white box in the platform coordinator installation object;

(c) connecting the new white box to the communications network running the routing cluster to which the new white box is to be attached, and making a control “call home” to the platform coordinator installation object;

(d) extracting information from the white box regarding at least one of the members of the group, which includes: hardware model, hash, and revision number, and verifying that the extracted information is consistent with the predefined certified hardware configuration of the white box;

(e) deploying a predefined platform software image to a new white box, where the platform software image contains the assigned WB-UID and the new white box manufacturer's security certificate;

(f) updating the control center of the corresponding network cloud to add the new valid unique white box identifier to the list of unique white box identifiers;

(g) after connecting the new white box to the network cloud controller (NCC), attempting to join the cluster by performing a call-home check procedure;

(h) verifying whether the WB-UID associated with the new white box is listed as an entity that can be selected to join a particular cluster;

(i) after verifying the unique identifier of the white box, installing the cluster certificate in this new white box and installing the network operating system (NOS) in this new white box; And

(j) joining the new white box in question to the cluster and associating the new white box with the ID of the specified cluster, defining the role that the white box in question needs to perform while it is part of the cluster operations.

Brief description of drawings

The accompanying drawings, incorporated herein and forming a part of this specification, illustrate a number of embodiments of the present disclosure and, together with this description, serve to explain the principles of the embodiments discussed herein.

Fig. 1 illustrates a simplified general diagram of a network containing a white box cluster constructed in accordance with an embodiment of the present disclosure, and the steps that must be followed to add a new white box to that cluster, and

Fig. 2 shows an example logic diagram illustrating a method constructed in accordance with an embodiment of the present disclosure.

Carrying out the invention

Certain specific details and quantities in the following detailed description relate to certain examples of the invention. However, this description is by way of example only and is not intended to limit the scope of the invention in any way. As will be appreciated by those skilled in the art, the inventive method and apparatus may be implemented by other methods, which are themselves known in the art. In addition, the described embodiments contain various steps, not all of which are required for all embodiments of the invention. The scope of the invention may be summarized by reference to the accompanying Claims.

Fig. 1 illustrates a simplified general diagram of a network containing a white box cluster constructed in accordance with embodiments of the present disclosure and the steps that must be performed to add a new white box to said cluster. The network cloud (1) illustrated in this drawing includes a network coordinator (2) and a network cloud cluster (5). The network coordinator (2) in turn contains the platform installation block (3) and the network cloud control center (4). The network cloud cluster (5) in turn contains a local network block controller (6), several white boxes (7) and switches for network management (8). The operation of these various elements is explained in detail in the following examples, described in conjunction with FIGS. 2.

Fig. 2 is an example logic diagram illustrating a method according to one embodiment of the present disclosure. According to this embodiment, an example of which is shown in FIG. 2, first, a new white box is identified as a white box to be added to a cluster containing multiple autonomous white boxes (step 10). Such identification may be, for example, visual identification by an engineer, operator, or the like. This new white box is then registered in the installation block of the platform coordinator (step 20). As part of the registration procedure, a white box is assigned a unique white box identifier (WB-UID) and automatically associates this identifier with a white box serial number (S/N) (thus associating the white box serial number (S/N) with its assigned WB-UID). After registration, the installation block of the platform waits for the white box, which has the newly registered S/N number, to make a control “call home”.

This new white box is then connected to the network running the routing cluster to which the new white box is to be added, and a test call home is made to the platform installation block using, for example, an Open Network Deployment Environment (ONIE) procedure (step 30). . The ONIE environment is an open source "installation environment" that acts as a hardened boot loader that takes advantage of the functionality of the Linux/BusyBox environment. This small Linux-based operating system allows end users and channel partners to install a target network operating system as part of a data center organization in such a way as to create servers.

The platform installation unit reads the hardware-related information from the white box, extracts the hardware model, hash, and revision number indications from that information, and verifies that the extracted information is consistent with the pre-certified white box hardware configuration (step 40). If the white box hardware is determined to meet the platform installation unit certification requirements, the procedure will continue.

Next, the platform installation unit deploys the predefined platform software image into a new white box, where the platform software image further contains the assigned WB-UID. In addition, at this step, the security certificate of the manufacturer of the new white box is preferably also installed (step 50).

The platform software installation unit updates the control center of the corresponding network cloud with a new valid white box unique identifier (WB-UID) added to the specified list (step 50). A cluster is a logical entity defined and created by the network cloud management module. During this creation process, the cluster is assigned (assigned) a unique cluster ID and a cluster certificate. This cluster is also assigned a list of WB-UIDs for selectable white boxes that are qualified to join the cluster.

When the new white box is connected (by cable) to the network cloud controller (NCC), it attempts to join the corresponding cluster by making a control call home (step 60). The NCC handles this join attempt in a sandbox to verify that the new white box is associated with a valid provider certificate. On the other hand, if such a join attempt is made by an element (for example, a white box) that does not have a valid provider certificate and WB-UID, the attempt will be automatically rejected.

If the new white box is associated with a valid vendor certificate, the NCC verifies with the associated Network Cloud Management Center (NCM) whether the WB-UID associated with the new white box in question is included in the specified list as an object that can be selected for joining the specific cluster in question. The NCM controller at this stage needs to confirm that the box with the new WB-UID actually belongs to the cluster in question, in order to proceed to the stage of installing the cluster certificate (step 70). If the box with the WB-UID is not listed as an object belonging to the particular cluster in question, the join attempt will be rejected by the NCC.

After the white box's WB-UID is verified by the network cloud management center, the NCC installs the cluster certificate in the new white box (step 80). After installing the certificate, the NCC continues to operate by installing the network operating system (NOS) in the new white box (step 90).

After this last step, the new white box is successfully joined to the cluster. It becomes associated with a cluster ID and receives a definition of the role it will play as part of the cluster operations (step 100). The white box is then able to begin functioning while maintaining compliance with the role for which it was included in the specified cluster.

Other variations of the present disclosure will become apparent to those skilled in the art upon examination of the present disclosure and practice of the invention described herein. The foregoing description and embodiments are exemplary only, so that the true scope and spirit of the present disclosure is indicated by the appended claims.

Claims (15)

1. A method of obtaining secure routing functionality in a white box cluster containing a plurality of standalone white boxes, wherein at least two of said standalone white boxes are manufactured by different manufacturers, the method comprising the steps of: identifying a new white box in as a white box to be added to the cluster, the specified white box is registered in the installation block of the platform coordinator, and as part of the registration procedure, the white box is assigned a unique white box identifier (WB-UID) and this identifier is automatically associated with a serial number (S/N) , using said new white box to make a control "call home" to said installation block, using said installation block to compare the information received from said new white box with the pre-certified white box hardware configuration, and upon determining that the white box hardware meets the requirements certification of the installation unit, install the specified new white box together with the corresponding software of the computer platform containing a software agent provided by the manufacturer of the specified new white box. 2. The method of claim 1, further comprising confirming the configuration and/or revision number of each white box after identifying the serial number associated with said white box. 3. The method of claim 2, further comprising associating each white box with a network operating system (NOS) identity. 4. Method according to any one of paragraphs. 1-3, wherein said computer platform software further comprises certification provided by the manufacturer of the corresponding white box. 5. Method according to any one of paragraphs. 1-4, further comprising the steps of: (a) identifying the new white box as a white box to be added to a cluster containing a plurality of autonomous white boxes; (b) registering the new white box with the platform coordinator install object; (c) connect the new white box to the communication network in which the routing cluster to which the new white box is to be connected operates, and make a control “call home” to the installing object of the platform coordinator; (d) extracting from the white box information related to at least one of the group consisting of: hardware model, hash, and revision number, and verifying that the extracted information is consistent with the specified certified white box hardware configuration; (e) deploying a given platform software image to a new white box, wherein said platform software image contains an assigned WB-UID and a security certificate from the manufacturer of the new white box; (f) updating the control center of the corresponding network cloud with the new valid unique white box identifier added to the list of unique white box identifiers; (g) performing, after connecting the new white box to the network cloud controller (NCC), attempting to join the cluster by performing a test call home procedure; (h) verifying whether the WB-UID associated with the new white box is listed as an entity that can be selected to join a particular cluster; (i) performing, after verifying the unique identifier of the white box, installing a cluster certificate in the specified new white box and installing a network operating system (NOS) in the specified new white box; And (j) attaching said new white box to the cluster and associating said new white box with the ID of said cluster and determining the role to be played by said white box while it is part of the operation of the cluster.

Images