TW201911068A - Virtual private network service provisioning system that supports diverse end-to-end network isolation - Google Patents

Abstract

A VPN service provision system with diversified end-to-end network isolation support, which provides a flexible provision using network function virtualization and software-defined networking (SDN), is provided, to improve safety of VPN end-to-end between enterprises and reduce establishment cost of VPN effectively. The design of the invention focuses on arranging multiple virtual routers in single server, to isolate traffics with different types and apparatuses in different local network, and to prevent single apparatus or system being hacked and causing that other systems are hacked in the enterprise. The invention simplifies the network management and network access time control mechanism through SDN, to improve flexibility and safety upon modifying network.

Description

Virtual private network service installation system supporting diverse end-to-end network isolation

The present invention relates to a virtual private network, and more particularly to a virtual private network service provisioning system capable of supporting a diverse architecture.

Virtual private network (Virtual Private Network, VPN) mainly uses tunneling technology and encryption and decryption security technologies on the public Internet to establish a private and secure network. Compared with traditional private networks, virtual private networks do not require dedicated lines. Using communication protocol technology can enjoy the cheap price of the Internet and enjoy the security of dedicated lines. The virtual private network also has better expansion flexibility and flexible applications than traditional private networks. The expansion point is convenient and it is easy to increase the connection bandwidth as required. You can use the existing connection technology without adjusting the existing architecture. Virtual private networks have the advantages of lower equipment investment costs and easier management and maintenance.

Although existing virtual private networks can already use IP Security (IPSec), Multiprotocol Label Switching (MPLS), Generic Routing Encapsulation (GRE) and dynamic multipoint Virtual private network (Dynamic Multipoint VPN, DMVPN) and other technologies to achieve the establishment of point-to-point or point-to-multipoint virtual private network connection, but currently the virtual private network focuses only on the Internet to build a corporate private network to achieve Intranet, upstream and downstream manufacturers or affiliated enterprise extranet, and remote access regardless of national borders.

Chinese Patent No. CN106411735 "A routing configuration method and device" published on February 15, 2017. The routing configuration method and device provided by this patent is applied to a controller in Software-Defined Networking (SDN) The proposed method configures the Router Target (RT) attribute of the tenant VPN instance and the routing policy of the external VPN instance through the controller, so that the gateway device sets the RT attribute to the routes from different external network devices according to the routing policy. And match the RT attribute of the route with the RT attribute of the tenant VPN instance. After successful matching, the route is added to the tenant's VPN instance to direct the tenant traffic to the external network. The invention can realize the dynamic routing on the gateway device. Update.

However, the current virtual private networks have not been discussed in depth. First, virtual private networks have been widely used in Wide Area Networks (WANs). How can virtual private networks be extended from the WAN side to the enterprise? Local area network (LAN) and data center (Datacenter) to achieve multi-point to multi-point end-to-end network isolation. Second, all users' traffic is mixed in the same circuit, and how to isolate different types of traffic from each other. Third, a dynamic and flexible supply management system based on time management. Therefore, it can be known that the above-mentioned problems still need to be solved urgently in actual application of the existing technology.

In view of this, the object of the present invention is to propose a virtual private network (VPN) service provisioning system that supports diverse end-to-end network isolation, and utilizes network function virtualization and software-defined network to flexibly schedule network configurations. Extend your existing virtual private network from your WAN to your corporate LAN and data center.

The invention provides end-to-end high-security network isolation services for installation, and conducts traffic diversion according to different traffic types, solving the security of all traffic in the current enterprise area network mixed in the same circuit for transmission and shared routing tables. Problems to avoid the risk of a single system being compromised and affecting other systems within the enterprise. The invention proposes a network access management and control mechanism based on time management policies and illegal use blocking, which further improves the security of the enterprise virtual private network solution and reduces the cost of establishing and maintaining the virtual private network.

A VPN service provisioning system that supports the diversity of end-to-end network architecture isolation to achieve the above-mentioned object of the invention is composed of the following architectures: a virtualization management platform on the server, a virtual network control module, a virtual router and a network Controllers, and physical or virtual switches. The virtual router is based on network function virtualization technology to proxy traffic processing. The network controller dynamically configures the operation of the virtual router based on the software-defined network technology, and establishes the correspondence between the virtual private network and the local area network and the virtual local access network (Vlan) tags. The virtualization management platform configures the hardware and network resources of the virtual router. The physical switch or the virtual switch receives a command from the network controller, and injects the flow entry information (Flow Entries) of the physical switch or the virtual switch to make a traffic forwarding decision. The virtual router diverts different traffic from different local area networks to the corresponding virtual private network through a physical switch or a virtual switch according to this correspondence.

In this way, through the virtualization management platform, multiple virtual routers can be deployed according to different types of traffic to establish end-to-end virtual network isolation, thereby achieving the effect of different types of traffic isolation. In addition, the network controller controls the physical or virtual switch and determines the message forwarding policy. It also provides a time-based dynamic and flexible supply scheduling mechanism to provide more efficient and secure network access management. Finally, the physical or virtual switch performs message packet forwarding, and determines the message forwarding route based on the Internet Protocol (IP) address and virtual local area network tag of the message destination to achieve the end-to-end virtual network. The design of security isolation also simplifies the construction and maintenance costs of the virtual private network.

In order to make the above features and advantages of the present invention more comprehensible, embodiments are hereinafter described in detail with reference to the accompanying drawings.

The present invention is a VPN service installation system supporting diversified end-to-end network isolation. The present invention proposes a cost-effective, flexible network installation guidance based on network function virtualization and software-defined network, and supports Multi-architecture end-to-end network security isolation, improving end-to-end security of the virtual private network between the corporate LAN, WAN and data center, while reducing the cost of building and maintaining the virtual private network.

The traditional virtual private network architecture is shown in Figure 1. The local network 18 includes user equipment A 14, user equipment B 15, user equipment C 16, and user equipment D 17. Different user equipments generate different types of traffic. These user equipments They are connected to each other through the second-layer switch 13 and the user equipments in the local area network 18 are connected to the users in other branch sites of the enterprise through the virtual private network 19 through the physical router 11 to which the gateway Z 12 belongs. Devices, that is, these user devices are connected to the corporate remote site through a virtual private network. Under this architecture, systems of different types of traffic can communicate with each other in the same local area network. All traffic is mixed in the same circuit to transmit and share the routing table of the same router. Security issues are bound to exist. If one type of host or system is hacked, other systems may be hacked due to the end-to-end security isolation of the corporate network, which may attack important information systems of the enterprise.

FIG. 2 is a structural diagram of a virtual private network service provisioning system supporting diversified end-to-end isolation according to an embodiment of the present invention. The virtual private network service installation system includes a server 27, a physical or virtual switch 26, a second layer switch 13 and a user device 28 (for example, a mobile phone, a desktop computer, a notebook computer, etc.).

The server 27 of this entity includes a virtual router 21, a network controller 22, a time management module 23, a virtual network control module 24, and a virtualization management platform 25. The server 27 can be accessed through, for example, a central processing unit (CPU), Microprocessors, digital signal processors (DSPs), programmable controllers and the like execute these virtual components, platforms and software modules.

The virtual router 21 is an open source network operating system, and is installed on a physical server (ie, the server 27) or a virtual machine. In the embodiment of the present invention, multiple virtual machines may be installed on a single server 27, and a virtual router 21 may be configured on each virtual machine. The functions of the virtual router 21 can be used to proxy traffic processing based on network function virtualization technology on general x86 platforms to provide the network functions of physical routers such as routing functions, network address translation, firewalls, and virtual private network functions.

The network controller 22 is a network controller supporting multiple open source or commercial controllers. In the embodiment of the present invention, the network controller 22 can be installed on a physical server (ie, the server 27) or a virtual machine. The function of the network controller 22 is mainly to manage the network entity or virtual switch 26 through multiple communication protocols, and it also has terminal equipment (such as user equipment 28) and group management, network topology management, and network access strategy. Management, content management and control, traffic statistics and log management functions, dynamically deploy the operation of the virtual router 21 based on software-defined network technology, and establish multiple virtual private networks, multiple local networks and multiple virtual areas Correspondence between a network (virtual local access network, VLAN) tag. The corresponding relationship is that each virtual private network and each local network have a corresponding virtual local network label.

The virtual network control module 24 can be widely used in various virtualization management platforms 25, and its function is mainly responsible for establishing the connection between the virtual machine and the physical network and the virtual machine. The time management module 23 receives the time management settings of the virtual network control module 24, and is responsible for controlling the legal network time of each user equipment and blocking the traffic of the user equipment 28 during the illegal network time. The functions of the virtualization management platform 25 are mainly provided on a general x86 server for virtualization and resource allocation management of computing resources, network resources, and storage resources to configure the hardware and network resources of the virtual router 22.

The physical switch or virtual switch 26 (the virtual switch 26 can be deployed in the server 27 or other servers or operated by a virtual machine) is responsible for receiving instructions from the network controller 22 and injecting the physical or virtual switch Flow Entries of the server 26 to make traffic forwarding decisions. The operation of the message forwarding is described in the subsequent embodiments.

In order to facilitate understanding of the operation flow of the embodiments of the present invention, the following describes the traffic routing architecture of the embodiments of the present invention in detail with many embodiments. In the following, description will be given with each component and module in FIG. 2. Each process of the embodiment of the present invention can be adjusted according to the implementation situation, and is not limited to this.

FIG. 3 is an implementation architecture diagram applied to a hybrid end-to-end isolated virtual private network according to an embodiment of the present invention, which aims to retain the existing physical router 11 and cooperate with the internal virtual network design of the enterprise to provide flexibility for different types of traffic isolation Provides different virtual routers (for example, virtual router X 33 and virtual router Y 34). The virtual router X 33 and virtual router Y 34 can be installed in the virtual machine. Their functions are mainly based on different traffic Vlan tags sent by user equipment (user equipment A, B, C, D 14, 15, 16, 17). Isolate and direct different types of traffic to the virtual private network 19 to achieve end-to-end virtual network isolation. The virtual router X 33, virtual router Y 34, network controller 22, time management module 23, virtual network control module 24, and virtualization management platform 25 mentioned above are all deployed on a single server 27.

In order to cut the corporate intranet into multiple virtual local area networks (that is, local area networks A, B, C 35, 36, 37) according to different system applications and traffic types, the different types of traffic are isolated from each other. For example, user equipment A 14 belongs to local network A 35, user equipment B 15 and user equipment C 16 belong to local network B 36, and user equipment D 17 belongs to local network C 37. The user equipment's virtual private network connection can be flexibly configured to use an existing physical router 11 or a virtual router X, Y 33, 34. The second layer switch 13 is matched with different VLAN tags according to the local network to which the user equipment's traffic content belongs (for example, the traffic of user equipment A 14 is matched with Vlan A, and so on) and sent to the physical or virtual exchange.器 26。 26. The physical or virtual switch 26 checks the traffic information (for example, the source IP address (IP1 ~ IP4) and the source Media Access Control (MAC) address (MAC1 ~ MAC4) according to the settings of the time management module 23) ) To determine whether the corresponding user device can access the network within a specific time frame. If the network is accessible, the physical or virtual switch 26 sends it to the corresponding gateway Z 12, gateway X 31 and gateway Y 32 according to the Vlan Tag of the traffic. The routing mechanism recorded in its routing table can be illustrated by the following example.

For example, Vlan A traffic sent by user equipment A 14 is directed to the physical router 11 where the gateway Z 12 is located via the second layer switch 13 and the physical or virtual switch 26. The physical router 11 routes the traffic back to the physical or After the virtual switch 26, the physical or virtual switch 26 judges that the traffic of Vlan A is sent from Vlan D to the virtual private network 19 according to the Vlan Tag of the received traffic. The Vlan B traffic sent by the user equipment B 15 and the user equipment C 16 is directed to the virtual router X 33 where the gateway X 31 is located via the second layer switch 13 and the physical or virtual switch 26, and the virtual router X 33 sends the traffic After routing back to the physical or virtual switch 26, the physical or virtual switch 26 judges according to the Vlan Tag of the received traffic and sends the traffic of Vlan B to the virtual private network 19 through Vlan E. The Vlan C traffic sent by the user equipment D 17 is directed to the virtual router Y 34 where the gateway Y 32 is located via the second layer switch 13 and the physical or virtual switch 26. The virtual router Y 34 routes the traffic back to the physical or After the virtual switch 26, it also judges according to the Vlan Tag of the received traffic, and sends the traffic of Vlan C to the virtual private network 19 through Vlan F.

Similarly, the traffic from the virtual private network 19 to the user equipment A 14 will send the traffic to the physical router 11 via the physical or virtual switch 26, and the physical router 11 routes the traffic back to the physical or virtual switch. After 26, according to the destination IP address of the message, the message is sent to the user equipment A 14 through the second-layer switch 13. The traffic sent by the virtual private network 19 to the user equipment B 15 or the user equipment C 16 is directed to the virtual router X 33 via the physical or virtual switch 26, and the virtual router X 33 routes the traffic back to the entity After the virtual switch 26, the traffic is also sent to the user equipment B 15 or the user equipment C 16 via the second layer switch 13 according to the destination IP address of the traffic. The virtual router Y 34 is responsible for routing the traffic from the virtual private network 19 to the user equipment D 17. In the above, through the mechanism that different VLANs use different entities or virtual routers and different routing tables, the routing table is physically separated from the end-to-end virtual network.

FIG. 4 is an implementation architecture diagram of a unified end-to-end isolated virtual private network according to an embodiment of the present invention. The difference from FIG. 3 is that the virtual router Z 41 replaces the physical router 11 of FIG. 3. The virtual router Z 41 is provided with the same gateway Z 12 as the gateway of the user equipment A 14, and the user equipment A 14 does not need to be changed. Gateway IP addresses provide a flexible and seamless physical-to-virtual router architecture, effectively reducing the purchase and maintenance costs of physical routers. In this architecture, the virtual router Z 41 is used to replace the physical router 11, and the virtual area network label of the traffic packet is viewed through the physical or virtual switch 26 to determine the traffic routing path. For example, the traffic of Vlan A is directed to virtual router Z 41, the traffic of Vlan B is directed to virtual router X 33, and the traffic of Vlan C is directed to virtual router Y 34. It should be noted that different virtual routers can be deployed on different virtual machines in one or more servers 27 to ensure that different traffic has independent routing tables to achieve end-to-end isolated virtual private network services.

The present invention also supports the implementation architecture of an integrated end-to-end isolated virtual private network as shown in FIG. 5 to simplify the deployment mode. The difference from FIG. 4 is that this embodiment is to house the physical or virtual switch 26 in the server 27. The embodiments of the present invention are applied to the field of small and medium-sized software-defined networks to provide an end-to-end isolated virtual private network management solution. Traditional architectures need to deploy one or more physical or virtual switches, which means that it needs to spend a lot of hardware resources and consume packet transmission delay time. The embodiment of the present invention simplifies the network architecture. The physical or virtual switch 26, the network controller 22, and the virtual routers 33, 34, and 41 are deployed in a server 27, which not only keeps different network segments of the internal network isolated. The design greatly reduces the cost of network component deployment, while reducing the bandwidth consumption and network delay time between the original physical or virtual switch 26 and server 27, and increasing the flexibility and portability of service installation. Compared with the traditional architecture, the system of the embodiment of the present invention significantly reduces the use of hardware resources and also reduces procurement capital expenditures (CAPEX) and maintenance operations expenses (OPEX). When the network configuration is changed, the present invention can dynamically and flexibly schedule and provide installation through a network controller, which provides more installation flexibility.

The three types of flexible and deployable end-to-end network isolation virtual private network architectures can be understood through the end-to-end virtual private network isolation diagram in FIG. 6 (for example, office 1 site). The entire end-to-end virtual private network connected to the Office 2 site or data center) isolates the actual operation. Between the two sites, the enterprise can use the secure and high-quality MPLS VPN to realize the external network interconnection of the enterprise, or it can be realized by the affordable Internet broadband access circuit. With multiple virtual routers running on a single physical server according to the embodiment of the present invention, different virtual private networks have their own independent routing tables. At the same time, the fast and flexible change installation feature of the network controller 22 is used to focus on the original The WAN VPN isolation method extends to the internal network of the enterprise and the data center to achieve a complete end-to-end isolated virtual private network service installation system. [Features and effects]

When a VPN service provisioning system that supports diversified end-to-end network isolation according to the embodiments of the present invention is compared with conventional techniques, it has the following advantages:

An embodiment of the present invention provides a VPN service installation system supporting diverse end-to-end network isolation. A cost-effective and flexible installation service system based on end-to-end virtual private network isolation is provided to provide an enterprise intranet. Different types of traffic in the external network and data center achieve end-to-end isolation. Adopting a network usage management mechanism to provide enterprise network access time management and illegal use blocking. The embodiments of the present invention can flexibly have a diverse architecture according to different needs, dynamic scheduling and flexible provisioning, which can greatly reduce CAPEX and OPEX.

Compared with the traditional architecture, the system of the embodiment of the present invention can extend a virtual private network from a traditional WAN end to an enterprise LAN end and a data center, and has more end-to-end isolated virtual private network security.

The system of the embodiment of the present invention can support the flexible deployment of multiple virtual routers in a single server, and provide independent routing tables for different types of traffic to achieve the effect of securely isolating traffic from each other.

When the network configuration changes, the embodiments of the present invention can dynamically and flexibly dispatch and install via a network controller. The system of the present invention has more portability and installation flexibility than the traditional architecture.

The diversified end-to-end network-isolated VPN service provisioning system provided by the present invention can flexibly reduce the deployment of physical network components and resource usage according to the requirements of enterprise network applications, and also reduces CAPEX and OPEX.

Although the present invention has been disclosed as above with the examples, it is not intended to limit the present invention. Any person with ordinary knowledge in the technical field can make some modifications and retouching without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be determined by the scope of the attached patent application.

1, 2‧‧‧ office

11‧‧‧physical router

12‧‧‧Gateway Z

13‧‧‧Layer 2 Switch

14‧‧‧User Equipment A

15‧‧‧User Equipment B

16‧‧‧User Equipment C

17‧‧‧User Equipment D

18‧‧‧ LAN

19‧‧‧Virtual Private Network

21‧‧‧Virtual Router

22‧‧‧Network Controller

23‧‧‧Time Management Module

24‧‧‧Virtual Network Control Module

25‧‧‧Virtualization Management Platform

26‧‧‧ physical or virtual switch

27‧‧‧Server

28‧‧‧User Equipment

31‧‧‧Gateway X

32‧‧‧Gateway Y

33‧‧‧Virtual RouterX

34‧‧‧Virtual Router Y

35‧‧‧LAN A

36‧‧‧LAN B

37‧‧‧LAN C

41‧‧‧Virtual Router Z

Figure 1 is a traditional virtual private network architecture diagram; Figure 2 is a diagram illustrating a virtual private network service provisioning system supporting diverse end-to-end isolation according to an embodiment of the present invention; Figure 3 is an application according to an embodiment of the present invention Implementation architecture diagram of a hybrid end-to-end isolated virtual private network; Figure 4 is an implementation architecture diagram of a unified end-to-end isolated virtual private network according to an embodiment of the present invention; Figure 5 is an implementation according to the present invention Figure 6 illustrates the implementation architecture of an integrated end-to-end isolated virtual private network. Figure 6 is a schematic diagram of end-to-end virtual private network isolation according to an embodiment of the present invention.

Claims (9)

A virtual private network service installation system supporting diversified end-to-end isolation includes: a server including: at least one virtual router, which is based on network function virtualization technology to proxy traffic processing; a network controller, which is based on Software-defined networking technology dynamically configures the operation of the at least one virtual router, and establishes multiple virtual private networks and multiple local area networks with multiple virtual local access network (Vlan) tags Relationship; and a virtualization management platform that configures the hardware and network resources of the at least one virtual router; and a physical switch or a virtual switch that receives instructions from the network controller and injects the physical switch or Flow Entries of the virtual switch to make traffic forwarding decisions; wherein the virtual router passes different traffic from different local networks through the physical switch or the virtual switch according to the corresponding relationship. Diversion to the corresponding virtual private network. The virtual private network service supply system supporting diversified end-to-end isolation as described in item 1 of the scope of patent application, wherein the correspondence relationship is that each of the virtual private networks and each of the local networks have corresponding virtual networks. LAN label. The virtual private network service provisioning system supporting diversified end-to-end isolation as described in item 1 of the scope of the patent application, wherein the virtual router is based on the Internet Protocol (IP) address of the destination of different communications. Corresponding to the virtual local area network tag, the traffic is sent to the user equipment corresponding to the local area network. The virtual private network service supply system supporting diversified end-to-end isolation as described in item 1 of the scope of patent application, wherein the physical switch or the virtual switch views a virtual local area network tag of the service and The traffic is directed to the virtual router. The virtual private network service provisioning system supporting diversified end-to-end isolation as described in item 1 of the scope of patent application, wherein the physical switch or the virtual switch is deployed on the server. As described in item 4 of the scope of the patent application, a virtual private network service installation system supporting diversified end-to-end isolation is provided, wherein the server is used to install multiple virtual machines, and each virtual machine is configured with the at least one virtual router. The virtual private network service provisioning system supporting diversified end-to-end isolation according to item 1 of the scope of patent application, wherein the at least one virtual route is based on a virtual local area network tag of different services sent by multiple user equipment , Isolate and direct different types of traffic to the corresponding virtual private network to achieve end-to-end virtual network isolation. As described in item 4 of the scope of the patent application, a virtual private network service supply system supporting diversified end-to-end isolation is adopted, in which a physical router is replaced by the at least one virtual router, and the same gateway is set by the at least one virtual router Server, multiple user devices do not need to change the Internet Protocol address of the gateway, and different virtual routers are deployed on different virtual machines in the server to ensure that different traffic has independent routing tables to Virtual private network service with end-to-end isolation. The virtual private network service installation system supporting diversified end-to-end isolation as described in item 1 of the scope of patent application, wherein the server further includes: a virtual network control module responsible for connecting multiple virtual machines to the physical network And the establishment of connections between the virtual machines and the virtual machines, in which a virtual router is configured in each virtual machine; and a time management module, which receives the time management settings of the virtual network control module and is responsible for controlling multiple The user's legal network connection time and blocking the traffic between the user equipment during the illegal network connection time, and the physical switch or the virtual switch checks the traffic information according to the settings of the time management module to determine the time range. Whether the user equipment can access the network, wherein the setting checks that the traffic information is based on the time management setting.