WO2016180181A1

WO2016180181A1 - Service function deployment method and apparatus

Info

Publication number: WO2016180181A1
Application number: PCT/CN2016/079667
Authority: WO
Inventors: 李忠良; 李炀; 王小威; 左奇
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-08-28
Filing date: 2016-04-19
Publication date: 2016-11-17
Also published as: CN106487556A; CN106487556B

Abstract

A service function deployment method and apparatus. The method comprises: acquiring predetermined network function virtualization (NFV) information, wherein the NFV information comprises resource indication information for indicating an underlayer network resource required for establishing a network function and function indication information for indicating an SF deployed on the underlayer network resource; and creating, according to the resource indication information and the function indication information, the underlayer network resource and deploying the SF on the underlayer network resource.

Description

Business function deployment method and device

Technical field

This document relates to, but is not limited to, the field of communications, and in particular, to a method and apparatus for deploying a service function SF.

Background technique

In NFV (Network Function Virtualization) technology, software processing that carries many functions can be carried out by using general-purpose hardware such as x86 and virtualization technology, thereby reducing the expensive equipment cost of the network. Through software and hardware decoupling and functional abstraction, network device functions are no longer dependent on dedicated hardware. Resources can be fully and flexibly shared, enabling rapid development and deployment of new services, and automatic deployment, elastic scaling, and fault isolation based on actual business requirements. And self-healing.

SFC (Service Function Chain) is a collection of ordered service functions. It performs a series of IP (Internet Protocol) packets, link frames or data streams on the network based on classification and policy. Business processing. SFC can be used in fixed, mobile networks and data centers, independent of specific network applications. The SFC includes a traffic classification node, an SF (Service Function), an SFF (Service Function Forwarder), an SFC proxy, and a DPI (Deep Packet Inspection). The SF receives a message from one or more SFFs and sends a message to one or more SFFs. The SFF is responsible for sending the message or data frame received from the network to the SF according to the SFC encapsulation information. The SFC control plane is responsible for the management and configuration of the SFC, including the discovery, management, and configuration of related nodes such as convection classification nodes, SF, SFF, and SFC agents.

SFC is an indispensable part of NFV technology. SFC users can create SF, SFF and other components required by SFC through virtual resources such as virtual machines and virtual switches created by NFV, including in the service chain. SF is a representation of VNFI (Virtualized Network Function Instance).

In the related art, SDN (Software Defined Network) When SFC is mapped, the administrator needs to create the network function to virtualize the underlying network resources of the NFV and provide them to the SFC. The new SF is deployed on the basis of the existing network resources, and then the administrator selects the group to build the SFC. The SFCs thus formed are relatively rigid, and it is not possible to adjust the SF according to changes in actual business needs, and it is not possible to make any changes to the underlying network resources.

In view of the problems in the related art that require manual intervention to create the underlying network resources and deploy SF, thereby creating the underlying network resources and deploying SF rigidities, and not being able to flexibly adjust the underlying network resources and SF, no effective solution has been proposed yet.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

An embodiment of the present invention provides a method and an apparatus for deploying a service function, so as to at least solve the problem that the related technologies need to manually create an underlying network resource and deploy an SF, thereby creating an underlying network resource and deploying SF rigidity, and cannot flexibly adjust the underlying network. Resources and SF issues.

A method for deploying a service function SF, including:

Obtaining predetermined network function virtualization NFV information, the NFV information including resource indication information indicating an underlying network resource required for establishing a network function, and function indication information indicating an SF deployed on the underlying network resource ;

And creating the SF resource according to the resource indication information and the function indication information, and deploying the SF on the underlying network resource.

Optionally, the creating the bottom network resource according to the resource indication information and the function indication information, and deploying the SF on the underlying network resource includes:

Transmitting the resource indication information to the forwarding plane by using an interface with the forwarding plane, to instruct the forwarding plane to create the underlying network resource on the forwarding plane according to the resource indication information;

Distributing deployment information determined according to the function indication information to the virtual machine to indicate the virtual machine deployment by using the interface to communicate with a resident program in a virtual machine in the underlying network resource The SF.

Optionally, the resource indication information is delivered to the forwarding plane by using an interface between the forwarding plane and the forwarding plane, to indicate that the forwarding plane creates the underlying network on the forwarding plane according to the resource indication information. Resources include:

Transmitting, by the interface, the resource indication information to the forwarding plane, to indicate that the forwarding plane configures, by using the resource indication information, a parameter for creating the underlying network resource into the forwarding plane. On the virtual machine;

Transmitting the deployment information determined according to the function indication information to the virtual machine by using the interface to communicate with a resident program in the virtual machine in the underlying network resource to indicate the virtual The deployment of the SF includes:

Passing the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to configure parameters for deploying SF included in the function indication information to On the virtual machine.

Optionally, the SF is load balancing, where the resource indication information includes: a first management network network protocol IP address, an IP address of the first service subnet, and first routing information, where the function indication information includes: load balancing Protocol information, member information of the load balancing resource pool, and load balancing algorithm information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to load, by the forwarding plane, a parameter for creating the underlying network resource included in the resource indication information to the forwarding plane The virtual machines in the include:

Transmitting the resource indication information to the forwarding plane by using the interface, to instruct the forwarding plane to perform the following operations: configuring an IP address of the first virtual machine in the forwarding plane on the management network as the first Configuring the IP address of the network, configuring the IP address of the first virtual machine on the service subnet as the IP address of the first service subnet, and configuring the routing information of the first virtual machine as the first routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to use parameters included in the function indication information for deploying SF Configuring to the virtual machine includes:

Creating a load balancing configuration file according to the function indication information; by using the interface and the Passing the load balancing configuration file to the first virtual machine to instruct the first virtual machine to perform the following operations: configuring a protocol of the first virtual machine as the load Configuring a protocol corresponding to the protocol information, configuring a member of the first virtual machine as a member corresponding to member information of the load balancing resource pool, and configuring an algorithm of the first virtual machine as the load balancing algorithm information Algorithm.

Optionally, the SF is a firewall, and the resource indication information includes: a second management network network protocol IP address, an IP address of the second service subnet, and second routing information, where the function indication information includes: a firewall rule and Strategy information;

Passing the resource indication information to the forwarding plane with the interface, to instruct the forwarding plane to perform the following operations: configuring an IP address of the second virtual machine in the forwarding plane on the management network as the The second management network IP address, the IP address of the second virtual machine on the service subnet is configured as the second service subnet IP address, and the routing information of the second virtual machine is configured as the second routing information. ;

Creating a firewall configuration file according to the function indication information; transmitting the firewall configuration file to the second virtual machine by using the interface to communicate with the resident program, to indicate that the second virtual machine will The rules and policies of the second virtual machine are configured as rules and policies corresponding to the firewall rules and policy information.

Optionally, the SF is a virtual private network VPN, and the resource indication information includes: a third management network network protocol IP address, a third service subnet IP address, and third routing information, where the function indication information includes: Key exchange protocol IKE policy, IP layer security protocol IPSec policy, IPSec site information;

Transmitting, by the interface, the resource indication information to the forwarding plane to indicate Loading, by the forwarding plane, the parameter for creating the underlying network resource included in the resource indication information to the virtual machine in the forwarding plane includes:

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to perform the following operations: configuring an IP address of a third virtual machine in the forwarding plane on the management network as the third The management network IP address, the IP address of the third virtual machine on the service subnet is configured as the third service subnet IP address, and the routing information of the third virtual machine is configured as the third routing information;

Creating a VPN configuration file according to the function indication information; transmitting the VPN configuration file to the third virtual machine by using the interface to communicate with the resident program, to instruct the third virtual machine to execute The following operations: configuring a protocol policy of the third virtual machine as the key exchange protocol IKE policy and the IP layer security protocol IPSec policy, and configuring a site of the third virtual machine to correspond to the IPSec site information Site.

Optionally, the SF is a network element WEB protection, and the resource indication information includes: a fourth management network network protocol IP address, a fourth service subnet IP address, and fourth routing information, where the function indication information includes: WEB Protection strategy and WEB application server or data center information that needs protection;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to perform the following operations: configuring an IP address of a fourth virtual machine in the forwarding plane on the management network as the fourth The management network IP address, the IP address of the fourth virtual machine on the service subnet is configured as the fourth service subnet IP address, and the routing information of the fourth virtual machine is configured as the fourth routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to include the part included in the function indication information The parameter configuration of the SF to the virtual machine includes:

Creating a WEB protection configuration file according to the function indication information; transmitting the WEB protection configuration file to the fourth virtual machine by using the interface to communicate with the resident program, to indicate the fourth virtual The device performs the following steps: configuring the rules and policies of the fourth virtual machine as the WEB protection policy and rules, and configuring the server or data center of the fourth virtual machine as the WEB application server or data that needs to be protected. The server or data center corresponding to the central information.

Optionally, the obtaining the predetermined network function virtualization NFV information includes:

Receiving the NFV information delivered by the application plane.

And receiving, by the control plane, the NFV information, where the NFV information is delivered to the control plane.

Optionally, after the creating the MME and the SF on the underlying network resource according to the resource indication information and the function indication information, the method further includes:

Obtaining updated NFV information, where the updated NFV information includes updated resource indication information and/or updated function indication information;

And updating the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information.

Optionally, the updating the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information includes:

Changing, adding, or deleting the created underlying network resource according to the updated resource indication information; and/or,

The deployed SF is changed, added, or deleted according to the updated function indication information.

The forwarding plane reports the information of the underlying network resource to the control plane after the underlying network resource is created; and/or,

After the SF is deployed, the forwarding plane reports the information about the SF to the control plane.

A deployment device for a service function SF, comprising:

a first acquiring module, configured to acquire predetermined network function virtualization NFV information, where the NFV information includes resource indication information used to indicate an underlying network resource required for establishing a network function, and is used to indicate on the underlying network resource Function indication information of the deployed SF;

And a processing module, configured to create the underlying network resource according to the resource indication information and the function indication information, and deploy the SF on the underlying network resource.

Optionally, the processing module includes:

a first transmitting unit, configured to: pass the resource indication information to the forwarding plane by using an interface with a forwarding plane, to instruct the forwarding plane to create the bottom layer on the forwarding plane according to the resource indication information Internet resources;

a second delivery unit configured to: pass the deployment information determined according to the function indication information to the virtual machine by using the interface to communicate with a resident program in a virtual machine in the underlying network resource, to Instructing the virtual machine to deploy the SF.

Optionally, the first delivery unit includes: a first delivery subunit, configured to: pass the resource indication information to the forwarding plane by using the interface, to indicate that the forwarding plane is to be in the resource indication information Included parameters for creating the underlying network resource are configured on a virtual machine in the forwarding plane;

The second delivery unit includes: a second delivery subunit configured to pass the deployment information to the virtual machine by using the interface to communicate with the resident program to indicate the virtual machine The parameters for deploying the SF included in the function indication information are configured on the virtual machine.

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operations: The IP address of the first virtual machine in the forwarding plane is configured as the IP address of the first management network, and the IP address of the first virtual machine on the service subnet is configured as the first service subnet. An IP address, configured to configure routing information of the first virtual machine as the first routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a load balancing configuration file according to the function indication information; and using the interface to communicate with the resident program The load balancing configuration file is delivered to the first virtual machine to instruct the first virtual machine to perform the following operations: configuring a protocol of the first virtual machine as a protocol corresponding to the load balancing protocol information, and the A member of a virtual machine is configured as a member corresponding to the member information of the load balancing resource pool, and an algorithm of the first virtual machine is configured as an algorithm corresponding to the load balancing algorithm information.

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane by using the interface, to instruct the forwarding plane to perform the following operations: Configuring an IP address of the second virtual machine in the forwarding plane on the management network as the second management network IP address, and configuring an IP address of the second virtual machine on the service subnet as the second service sub Configuring the routing information of the second virtual machine as the second routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a firewall configuration file according to the function indication information; and using the interface to communicate with the resident program to use the firewall The configuration file is delivered to the second virtual machine to instruct the second virtual machine to configure rules and policies of the second virtual machine as rules and policies corresponding to the firewall rule and policy information.

Optionally, the SF is a virtual private network VPN, and the resource indication information includes: a third management network network protocol IP address, a third service subnet IP address, and third routing information, where the function is The indication information includes: a key exchange protocol IKE policy, an IP layer security protocol IPSec policy, and an IPSec site information;

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operations: The IP address of the third virtual machine in the forwarding plane is configured as the IP address of the third management network, and the IP address of the third virtual machine on the service subnet is configured as the third service subnet. An IP address, configured to configure routing information of the third virtual machine as the third routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a VPN configuration file according to the function indication information; and using the interface to communicate with the resident program to use the VPN The configuration file is delivered to the third virtual machine to instruct the third virtual machine to perform the following operations: configuring a protocol policy of the third virtual machine as the key exchange protocol IKE policy and the IP layer security protocol The IPSec policy configures the site of the third virtual machine as the site corresponding to the IPSec site information.

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operations: The IP address of the fourth virtual machine in the forwarding plane is configured as the fourth management network IP address, and the IP address of the fourth virtual machine on the service subnet is configured as the fourth service subnet. An IP address, configured to configure routing information of the fourth virtual machine as the fourth routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a WEB protection configuration file according to the function indication information; and using the interface to communicate with the resident program The WEB protection profile is delivered to the fourth virtual machine to instruct the fourth virtual machine to perform the following operations: configuring the rules and policies of the fourth virtual machine as the WEB protection policy and rules, and the The server or data center of the four virtual machines is configured as the server or data center corresponding to the WEB application server or data center information that needs to be protected.

Optionally, the first obtaining module includes:

The first receiving unit is configured to receive the NFV information transmitted by the application plane.

Optionally, the first obtaining module includes:

The second receiving unit is configured to receive the NFV information transmitted by the control plane, where the NFV information is transmitted to the control plane by the application plane.

Optionally, the device further includes:

a second acquiring module, configured to acquire the updated NFV information after the processing module creates the underlying network resource according to the resource indication information and the function indication information, and deploys the SF on the underlying network resource The updated NFV information includes updated resource indication information and/or updated function indication information;

And an update module, configured to update the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information.

Optionally, the update module includes:

a first update unit, configured to change, add, or delete the created underlying network resource according to the updated resource indication information; and/or,

The second update unit is configured to change, add or delete the deployed SF according to the updated function indication information.

Optionally, the device further includes:

The first reporting module is applied to the forwarding plane, and is configured to report the information of the underlying network resource to the control plane after the network resource is created; and/or

The second reporting module is applied to the forwarding plane, and is configured to report the information of the deployed SF to the control plane after the SF is deployed.

A readable storage medium storing computer executable instructions for performing the above method.

The embodiments of the present invention solve the problem that the related technologies need to manually create the underlying network resources and deploy the SF, thereby creating the underlying network resources and deploying the SF rigid, and cannot be flexibly adjusted. The underlying network resources and SF issues, in turn, achieve the effect of flexible adjustment of the underlying network resources and SF.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a flowchart of a method for deploying an SF according to an embodiment of the present invention;

2 is a structural block diagram of a deployment apparatus of an SF according to an embodiment of the present invention;

3 is a structural block diagram of a processing module 24 in a deployment apparatus of an SF according to an embodiment of the present invention;

4 is a structural block diagram of a first transfer unit 32 and a second transfer unit 34 in a deployment device of an SF according to an embodiment of the present invention;

FIG. 5 is a structural block diagram 1 of a first obtaining module 22 in a deployment device of an SF according to an embodiment of the present invention;

FIG. 6 is a second structural block diagram of the first obtaining module 22 in the SF deployment apparatus according to an embodiment of the present invention;

7 is a block diagram showing a preferred structure of a deployment apparatus of an SF according to an embodiment of the present invention;

FIG. 8 is a structural block diagram of an update module 74 in a deployment apparatus of an SF according to an embodiment of the present invention;

9 is a schematic diagram of an SDN network architecture according to an embodiment of the present invention;

10 is a flowchart 1 of a method for planning and deploying an SFC according to an embodiment of the present invention;

11 is a second flowchart of a method for planning and deploying an SFC according to an embodiment of the present invention;

12 is a schematic diagram of an SFC including a load balancing node according to an embodiment of the present invention;

FIG. 13 is a schematic diagram of an SFC including a firewall according to an embodiment of the present invention.

Embodiments of the invention

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

The terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a particular order or order. In the present application The "application plane" in the specification and claims and the accompanying drawings may be a set of logic application functions consisting of software and/or hardware, which may be implemented by an application device, as such, the "control plane" may be A set of logical control functions consisting of software and/or hardware. The logic control function can be implemented by a control device. The "forwarding plane" can be a set of logical forwarding functions composed of software and/or hardware. The logical forwarding function can be forwarded. Equipment implementation.

In the embodiment of the present invention, a method for deploying an SF is provided. FIG. 1 is a flowchart of a method for deploying an SF according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps:

Step S102, acquiring predetermined NFV information, where the NFV information includes resource indication information for indicating an underlying network resource required for establishing a network function, and function indication information for indicating an SF deployed on the underlying network resource;

Step S104: Create an underlying network resource according to the resource indication information and the function indication information, and deploy the SF on the underlying network resource.

The foregoing operation may be a resource management system, which can complete the deployment of the underlying network resources and the deployment of the SF by the resource management system without manual intervention, thereby solving the need for manual intervention to create the underlying network in the related art. Resources and deployment of SF, resulting in the creation of the underlying network resources and deployment of SF rigid, can not flexibly adjust the underlying network resources and SF issues, thereby achieving the flexibility to adjust the underlying network resources and SF.

In an optional embodiment, creating the underlying network resource according to the resource indication information and the function indication information and deploying the SF on the underlying network resource includes:

Passing the resource indication information to the forwarding plane through an interface between the forwarding plane for deploying the underlying network resource and the SF, to indicate that the forwarding plane creates the underlying network resource on the forwarding plane according to the resource indication information; The manner in which the interface communicates with the resident program in the virtual machine in the underlying network resource passes the deployment information determined according to the function indication information to the virtual machine to instruct the virtual machine to deploy the SF.

Through the foregoing embodiment, the forwarding plane can be used to implement the creation of the underlying network resources and the deployment of the SF, thereby improving the flexibility of adjusting the underlying network resources and the SF without manual intervention.

There are various ways to create the underlying network resource and deploy the SF on the underlying network resource. In an optional embodiment, the underlying network resource creation and SF can be performed by configuring parameters. Deployment, the following describes the way:

Transmitting, by the interface with the forwarding plane, the resource indication information to the forwarding plane, to indicate that the forwarding plane creates the underlying network resource on the forwarding plane according to the resource indication information, including:

Passing the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to configure the parameter for creating the underlying network resource included in the resource indication information to the virtual machine in the forwarding plane;

And transmitting, by using the interface, the deployment information determined according to the function indication information to the virtual machine by using the interface to communicate with the resident program in the virtual machine in the underlying network resource, to indicate that the virtual machine deploying the SF includes:

The deployment information is delivered to the virtual machine by communicating with the resident program by using the interface to instruct the virtual machine to configure parameters for deploying the SF included in the function indication information to the virtual machine.

The above scheme for creating the underlying network resources and deploying SF can be applied to multiple scenarios. Several typical scenarios are as follows:

In an optional embodiment, the SF may be load balancing, and the resource indication information includes: a first management network network protocol IP address, an IP address of the first service subnet, and first routing information, where the function indication The information includes: load balancing protocol information, member information of a load balancing resource pool, and load balancing algorithm information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to indicate that the forwarding plane loads the parameter for creating the underlying network resource included in the resource indication information into the virtual machine in the forwarding plane, including: The interface forwards the resource indication information to the forwarding plane, to indicate that the forwarding plane performs the following operations: configuring the IP address of the first virtual machine in the forwarding plane on the management network as the IP address of the first management network, and placing the first virtual machine in The IP address of the service subnet is configured as the IP address of the first service subnet, and the routing information of the first virtual machine is configured as the first routing information.

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to indicate that the virtual machine configures parameters for deploying the SF included in the function indication information to the virtual machine, including: according to the function Instructing information to create a load balancing configuration file; communicating the load balancing configuration file to the first virtual machine by using the interface to communicate with the resident program, to instruct the first virtual machine to perform the following operation: protocol of the first virtual machine Configured as a load balancing protocol information pair The protocol of the first virtual machine is configured as a member corresponding to the member information of the load balancing resource pool, and the algorithm of the first virtual machine is configured as an algorithm corresponding to the load balancing algorithm information.

In another optional embodiment, the SF may be a firewall, and the resource indication information includes: a second management network network protocol IP address, an IP address of the second service subnet, and second routing information, where the function The indication information includes: firewall rules and policy information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to indicate that the forwarding plane loads the parameter for creating the underlying network resource included in the resource indication information into the virtual machine in the forwarding plane, including: Passing the resource indication information to the forwarding plane to instruct the forwarding plane to perform the following operations: configuring the IP address of the second virtual machine in the forwarding plane on the management network as the second management network IP address, and placing the second virtual machine on the service subnet The IP address is configured as the second service subnet IP address, and the routing information of the second virtual machine is configured as the second routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to configure the parameter for deploying the SF included in the function indication information to the virtual machine, including: The function indication information creates a firewall configuration file; the firewall configuration file is passed to the second virtual machine by using the interface to communicate with the resident program, to instruct the second virtual machine to configure the rules and policies of the second virtual machine to Rules and policies for firewall rules and policy information.

In another optional embodiment, the SF is a VPN (Virtual Private Network), and the resource indication information includes: a third management network network protocol IP address, a third service subnet IP address, and a third The routing information includes: an IKE (Internet Key Management) policy, an IPSec (IP Security) policy, and an IPSec Site information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to indicate that the forwarding plane loads the parameter for creating the underlying network resource, which is included in the resource indication information, into the virtual machine in the forwarding plane, including: Passing to the forwarding plane to instruct the forwarding plane to perform the following operations: configuring the IP address of the third virtual machine in the forwarding plane on the management network as the third management network IP address, and configuring the IP address of the third virtual machine on the service subnet Configure the routing information of the third virtual machine as the third routing information for the IP address of the third service subnet;

Passing the deployment information to the virtual by communicating with the resident program using the interface Configuring the virtual machine to instruct the virtual machine to configure the parameter for deploying the SF included in the function indication information to the virtual machine includes: creating a VPN configuration file according to the function indication information; and communicating with the resident program by using the interface The method forwards the VPN configuration file to the third virtual machine, to instruct the third virtual machine to perform the following operations: configuring the protocol policy of the third virtual machine as a key exchange protocol IKE policy and an IP layer security protocol IPSec policy, and the third The site of the virtual machine is configured as the site corresponding to the IPSec site information.

In another optional embodiment, the SF is a network element WEB protection, and the resource indication information includes: a fourth management network network protocol IP address, a fourth service subnet IP address, and fourth routing information, where The function indication information includes: a WEB protection policy and a WEB application server or data center information that needs to be protected;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to load the parameter for creating the underlying network resource included in the resource indication information to the virtual machine in the forwarding plane, including: indicating the resource through the interface The information is delivered to the forwarding plane to instruct the forwarding plane to perform the following operations: configuring the IP address of the fourth virtual machine in the forwarding plane on the management network as the fourth management network IP address, and the fourth virtual machine on the service subnet. The IP address is configured as the fourth service subnet IP address, and the routing information of the fourth virtual machine is configured as the fourth routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to configure the parameter for deploying the SF included in the function indication information to the virtual machine, including: The function indication information creates a WEB protection configuration file; the WEB protection configuration file is transmitted to the fourth virtual machine by using the interface to communicate with the resident program, to instruct the fourth virtual machine to perform the following operation: the fourth virtual machine is executed The rules and policies are configured as the WEB protection policy and rules, and the server or data center of the fourth virtual machine is configured as a server or data center corresponding to the WEB application server or data center information that needs to be protected.

For the embodiments in the above four scenarios, a detailed description will be given in the following embodiments.

The manner of obtaining the NFV information may be multiple. In an optional embodiment, the acquiring the NFV information includes: receiving the NFV information delivered by the application plane.

In another optional embodiment, the acquiring the NFV information comprises: receiving the NFV information transmitted in the control plane, wherein the NFV information is delivered to the control plane by an application plane.

In an optional embodiment, the creating the underlying network resource according to the resource indication information and the function indication information, and after deploying the SF on the foregoing network resource, further comprising: obtaining the updated NFV information, wherein the updating The updated NFV information includes updated resource indication information and/or updated function indication information; and the created underlying network resource and the deployed SF are updated according to the updated resource indication information and/or the updated function indication information.

Changing, adding, or deleting the created underlying network resource according to the updated resource indication information; and/or changing, adding, or deleting the deployed SF according to the updated function indication information.

In an optional embodiment, after the creating the underlying network resource according to the resource indication information and the function indication information, and deploying the SF on the underlying network resource, the method further includes:

The forwarding plane reports the information of the underlying network resource to the control plane after the foregoing network resource is created; and/or the forwarding plane reports the information of the deployed SF to the control plane after the SF is deployed. This embodiment can enable the control plane to discover and manage the created underlying network resources and deployed SFs.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in a form of a software product stored in a readable storage medium (such as ROM/RAM). Computer-executable instructions stored in a readable storage medium for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the operations described in each embodiment of the present invention. method.

An apparatus for creating an SF is also provided in the embodiment of the present invention. The apparatus is configured to implement the foregoing embodiments and optional implementations, and details are not described herein. As used below, the term "module" can be a combination of software and/or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of an apparatus for deploying an SF according to an embodiment of the present invention. As shown in FIG. 2, the apparatus includes a first obtaining module 22 and a processing module 24. The apparatus will be described below.

The first obtaining module 22 is configured to obtain predetermined network function virtualization NFV information, where the NFV information includes resource indication information used to indicate an underlying network resource required for establishing a network function, and is used to indicate on the underlying network resource. Function indication information of the deployed SF;

The processing module 24 is connected to the first obtaining module 22, and is configured to create an underlying network resource according to the resource indication information and the function indication information, and deploy the SF on the underlying network resource.

3 is a structural block diagram of a processing module 24 in a deployment apparatus of an SF according to an embodiment of the present invention. As shown in FIG. 3, the processing module 24 includes a first delivery unit 32 and a second delivery unit 34, and the processing module is provided below. 24 for explanation.

The first delivery unit 32 is configured to: pass the resource indication information to the forwarding plane through an interface with the forwarding plane, to instruct the forwarding plane to create an underlying network resource on the forwarding plane according to the resource indication information;

a second transfer unit 34, coupled to the first transfer unit 32, configured to determine, according to the function indication information, by using the interface to communicate with a resident program in a virtual machine in an underlying network resource The deployment information is passed to the virtual machine to instruct the virtual machine to deploy SF.

4 is a structural block diagram of a first transfer unit 32 and a second transfer unit 34 in a deployment device of an SF according to an embodiment of the present invention. As shown in FIG. 4, the first transfer unit 32 includes a first transfer subunit 42. The second transfer unit 34 includes a second transfer subunit 44, and the first transfer subunit 42 and the second transfer subunit 44 are described below.

The first delivery sub-unit 42 is configured to: pass the resource indication information to the forwarding plane through the interface, to indicate that the forwarding plane allocates parameters for creating the underlying network resource included in the resource indication information to the virtual machine in the forwarding plane. on.

The second delivery sub-unit 44 is configured to deliver the deployment information to the virtual machine by communicating with the resident program by using the interface, to indicate that the virtual machine configures parameters for deploying the SF included in the function indication information to On the virtual machine.

In an optional embodiment, the SF may be load balancing, and the information only information may include: a first management network network protocol IP address, an IP address of the first service subnet, and the first The routing information, the function indication information may include: load balancing protocol information, member information of a load balancing resource pool, and load balancing algorithm information;

The first delivery sub-unit 42 may indicate that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to indicate that the forwarding plane performs the following operation: the first in the forwarding plane The IP address of the virtual machine on the management network is configured as the IP address of the first management network, the IP address of the first virtual machine on the service subnet is configured as the IP address of the first service subnet, and the routing information of the first virtual machine is configured as the first a routing information;

The second delivery sub-unit 44 may instruct the virtual machine to deploy the SF by: creating a load balancing configuration file according to the function indication information; and transmitting the load balancing configuration file to the first manner by using the interface to communicate with the resident program. The virtual machine is configured to instruct the first virtual machine to perform the following operations: configuring the protocol of the first virtual machine as a protocol corresponding to the load balancing protocol information, and configuring the member of the first virtual machine as a member corresponding to the member information of the load balancing resource pool And configuring the algorithm of the first virtual machine as an algorithm corresponding to the load balancing algorithm information.

In another optional embodiment, the SF may be a firewall, and the resource indication information may include: a second management network network protocol IP address, an IP address of the second service subnet, and second routing information, where The function indication information may include: firewall rules and policy information;

The first delivery sub-unit 42 may indicate that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane by using the interface, to instruct the forwarding plane to perform the following operation: performing the second operation in the forwarding plane The IP address of the virtual machine on the management network is configured as the IP address of the second management network, the IP address of the second virtual machine on the service subnet is configured as the IP address of the second service subnet, and the routing information of the second virtual machine is configured as the first Two routing information;

The second delivery sub-unit 44 may instruct the virtual machine to deploy the SF by: creating a firewall configuration file according to the function indication information; and transmitting the firewall configuration file to the second by using the interface to communicate with the resident program The virtual machine is configured to instruct the second virtual machine to configure rules and policies of the second virtual machine as rules and policies corresponding to firewall rules and policy information.

In another optional embodiment, the SF is a VPN, and the resource indication information includes: a third management network network protocol IP address, a third service subnet IP address, and third routing information, where the function indication information is Including: Key Exchange Protocol IKE Policy, IP Layer Security Protocol IPSec Policy, IPSec Site Information;

The first delivery sub-unit 42 may be configured to instruct the forwarding plane to configure the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operation: the third virtual machine in the forwarding plane is The IP address of the management network is configured as the third management network IP address, the IP address of the third virtual machine on the service subnet is configured as the third service subnet IP address, and the routing information of the third virtual machine is configured as the third routing information. ;

The second delivery sub-unit 44 may instruct the virtual machine to deploy the SF by: creating a VPN configuration file according to the function indication information; and transmitting the VPN configuration file to the third manner by using the interface to communicate with the resident program. a virtual machine, to instruct the third virtual machine to perform the following operations: configuring a protocol policy of the third virtual machine as a key exchange protocol IKE policy and an IP layer security protocol IPSec policy, and configuring a site of the third virtual machine as IPSec site information Corresponding site.

The first delivery sub-unit 42 may indicate that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operation: the fourth virtual in the forwarding plane The IP address of the management network is configured as the IP address of the fourth management network, the IP address of the fourth virtual machine on the service subnet is configured as the IP address of the fourth service subnet, and the routing information of the fourth virtual machine is configured as the fourth. Routing information;

The second delivery sub-unit 44 may instruct the virtual machine to deploy the SF by: creating a WEB protection configuration file according to the function indication information; and transmitting the WEB protection configuration file by using the interface to communicate with the resident program a fourth virtual machine, to instruct the fourth virtual machine to perform the following operations: configuring rules and policies of the fourth virtual machine as the WEB protection policy and rules, and configuring the server or data center of the fourth virtual machine to be protected The server or data center corresponding to the WEB application server or data center information.

FIG. 5 is a block diagram of an optional structure of the first obtaining module 22 in the deployment device of the service function section SF according to the embodiment of the present invention. As shown in FIG. 5, the first acquiring module 22 may include a first receiving unit 52, The first receiving unit 52 will be described.

The first receiving unit 52 is configured to receive the NFV information transmitted by the application plane.

FIG. 6 is a block diagram 2 of an optional structure of the first acquiring module 22 in the SF deployment apparatus according to the embodiment of the present invention. As shown in FIG. 6, the first acquiring module 22 may include a second receiving unit 62. The second receiving unit 62 will be described.

The second receiving unit 62 is configured to receive the NFV information transmitted by the control plane, wherein the NFV information is transmitted to the control plane by the application plane.

FIG. 7 is a block diagram showing an optional structure of an apparatus for deploying an SF according to an embodiment of the present invention. As shown in FIG. 7, the apparatus may include a second obtaining module 72 and an updating module 74 in addition to all the modules shown in FIG. The device will be described below.

The second obtaining module 72 is connected to the processing module 24, and is configured to obtain updated NFV information after the underlying network resource is created according to the resource indication information and the function indication information, and the SF is deployed on the underlying network resource, where The updated NFV information includes updated resource indication information and/or updated function indication information;

The update module 74 is connected to the second obtaining module 72, and is configured to update the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information.

FIG. 8 is a block diagram showing an optional structure of an update module 74 in an SF creation apparatus according to an embodiment of the present invention. As shown in FIG. 8, the update module 74 may include a first update unit 82 and/or a second update unit 84. The update module 74 will be described.

The first update unit 82 is configured to change, add, or delete the created underlying network resource according to the updated resource indication information;

The second update unit 84 is configured to change, add or delete the deployed SF according to the updated node indication information.

The methods and apparatus in the described embodiments can be applied to a resource management system.

In an optional embodiment, the SF creation device may further include a first reporting module and/or a second reporting module, where the first reporting module and the second reporting module may be applied to the forwarding plane. The device is described below:

The first reporting module is applied to the forwarding plane, and is configured to report the information of the underlying network resource to the control plane after the underlying network resource is created;

The solution in the embodiment of the present invention has advantages over the technical solutions existing in the related art. In the related art, planning an SFC in an SDN network requires first creating an underlying network resource, deploying an SF on an existing network resource, and then planning an SFC. . The "first resource, post-planning" approach causes the SFC to fail to customize the SF and automatically create the required network resources according to the actual business requirements, making the deployment of the SFC inflexible and also causing waste of resources. In the embodiment of the present invention, the SDN support includes load balancing, firewall, carrier grade network address translation (CGN), IP service identification and control system DPI, and router according to the planned SFC customization. The functional SF automatically creates the required network resources and deploys the SF in the underlying network, and the control plane can discover and manage the newly created SF. The use of this "first definition, after resource" way allows SFC to have flexible deployment features in SDN, while improving resource utilization and reducing manual maintenance costs.

In the embodiment of the present invention, the resource management system is used to create required network resources and deploy SF for the planned SFC automation in the SDN network architecture, and the related information of the SF is updated to the SFC controller, so that the SFC controller can Discover and manage newly created SFs for use with flat business applications.

The technical solutions in the above embodiments are described here:

FIG. 9 is a schematic diagram of an SDN network architecture according to an embodiment of the present invention. As shown in FIG. 9, the utility model mainly includes a resource management system, a network management system, and three levels, that is, an application plane and a control plane in a software-defined network SDN framework. And forwarding planes. The application plane is divided into multiple applications (applications); the control plane includes an orchestrator and a controller; and the forwarding plane includes a flow classifier, an SF, and a forwarding device such as a switch. The network management system is an important module to ensure the reliable operation of the network. It is set up to detect the running status of the network resources of the forwarding plane, fault diagnosis and alarm, and interact with the state of the network and the control plane. The resource management system is configured to create network resources and deploy SFs on the forwarding plane for the newly planned SFC.

Figure 9 mainly includes five interfaces: the A-CPI interface is used for the interaction between the application plane and the control plane, and the interaction content includes the creation, modification, and configuration of the SFC by the application layer. The B-CPI is used for the interaction between the application plane and the resource management system. The interactive content includes information related to NFV; C-CPI is used to control the flat The interaction with the resource management system, the interaction content is the SF information of the SFC that needs to be created; the D-CPI is used to control the interaction between the plane and the SFC-supporting SF, and is used for control plane discovery, management, and configuration of SF; E-CPI is used for The interaction between the resource management system and the forwarding plane is used by the resource management system to create network resources on the forwarding plane. The locations of the five interfaces are as shown in FIG. 9.

The trigger resource management system creates two types of required network resources and deploys the SF solution according to the planned SFC. In the first solution, the application plane directly transmits the related information of the planned NFV to the resource management system through the B-CPI interface, and triggers the resource management system. The SF information is updated to the control plane through the D-CPI through the E-CPI interface. The SFV information is transmitted to the control plane through the A-CPI interface through the control plane. The SF-related information of the SFC that needs to be created is transmitted to the resource management system through the C-API interface, and the resource management system is triggered to create the required network resources and deploy the SF at the forwarding level through the E-CPI interface, and the SF information is updated by the D-CPI. Go to the SFC controller.

FIG. 10 is a flowchart 1 of the method for planning and deploying an SFC according to an embodiment of the present invention. The flowchart is shown in FIG. 10, and the process includes the following steps:

Step 1. New business applications need to be deployed to the cloud platform. The application plane plans SFC according to the requirements of the business application, such as custom virtual machine specifications (CPU, memory, image files, etc.), SF IP address, network, routing, gateway, etc. SF related parameter settings, analogous to the SFC shown in Figure 12. (corresponding to step S1002 in Fig. 10)

Step 2. The application plane transmits the NFV and SF related information to the resource management system through the B-CPI interface. The resource management system creates the required network resources, including routing and virtual, on the forwarding plane through the E-CPI interface according to the information of the SFC. Machine (using a custom image file containing modules such as resident programs), network, etc. (corresponding to steps S1004-S1006 in Fig. 10)

Step 3. The resource management system saves the information about the defined SF to the control forwarding interface adaptation module, and then the agent in the control forwarding interface communicates with the resident program of the virtual machine, and the information is delivered to the virtual machine. The resident program completes the deployment and configuration of the SF function based on the received information. (corresponding to steps S1008-S1010 in Fig. 10)

Step 4. The forwarding plane updates the information about the NFV and its SF to the SFC controller through the D-CPI interface, so that the SFC controller can discover and manage the SF, and the service application can use the entire SFC. (corresponding to steps S1012-S1014 in Fig. 10)

FIG. 11 is a flowchart 2 of the method for planning and deploying an SFC according to an embodiment of the present invention. The process is as shown in FIG. 11. The process includes the following steps:

Step 1. New business applications need to be deployed to the cloud platform. The application plane plans SFC according to the requirements of the business application, such as custom virtual machine specifications (CPU, memory, image files, etc.), SF IP address, network, routing, gateway, etc. The SF related parameter settings are analogized to the SFC shown in FIG. 12, and the NFV and SF related information is transmitted to the control plane through the A-CPI interface. (corresponding to step S1102 in Fig. 11)

Step 2. The control plane transmits the SF-related information that needs to be created to the SFC to the resource management system through the C-CPI interface. The resource management system creates the required network resources on the forwarding plane through the E-CPI interface according to the information about the SF, including Routing, virtual machines (using custom image files containing modules such as resident programs), networks, etc. (corresponding to steps S1104-S1108 in Fig. 11)

Step 3. Same as step 3 in scenario 1. (corresponding to step S1110 in Fig. 11)

Step 4. Same as step 4 in scenario 1. (corresponding to steps S1112-S1114 in Fig. 11)

The following describes the embodiments in different scenarios as described above:

Embodiment 1

When the SF is load balancing, dynamically create an LB (Load Balancing) according to SFC usage scheme 1:

FIG. 12 is a schematic diagram of an SFC including a load balancing node according to an embodiment of the present invention. As shown in FIG. 12, a scenario 1 is used to automatically deploy an SF with a load balancing function according to an SFC to provide load balancing for a backend service server. The load balancing service is implemented based on Nginx, but is not limited to Nginx. The load balancing products with high performance are applicable to the embodiments of the present invention.

The resource management system automatically creates and deploys a load balancing SF according to the planned SFC:

Step 1. The service capability of the application-oriented service application needs to be greatly improved. This requires the load balancing service for SDN. It is required to build a load balancer to provide load balancing for three service servers. Of course, it is also possible to build other numbers. Business server provides load-balanced load The equalizer, in this embodiment, is described by taking as an example a load balancer that provides load balancing for three service servers.

Step 2. The application plane plans an SFC that includes the load balancing SF according to the service application requirements, as shown in FIG. The IP address of the management network public in the SFC can be 10.46.178.0/24, the IP address of the service subnet vxlan can be 192.168.100.0/24, and the floating IP address of the load balancing SF management network can be 10.46.178.27, load balancing SF The VIP in the service subnet can be 192.168.100.27, and load balancing can be provided for three cloud hosts with IP addresses of 192.168.100.1, 192.168.100.2, and 192.168.100.3 in the service subnet. The resource indication information may include an IP address of the virtual machine in the forwarding plane in the foregoing management network, an IP address in the service subnet, and routing information, where the function indication information may include load balancing protocol information and load balancing resources. Pool member information, load balancing algorithm information.

Step 3: The application plane transmits the related information of the SFC to the resource management system through the B-CPI interface, and the resource management system automatically creates the network resources required by step 2 of the embodiment according to the SFC of the application plan, including automatically creating the public, vxlan. Networks and routers, creating resource pools and active and standby virtual machines for load balancing SF automation (using custom virtual machine image files containing resident programs, Nginx, etc.) and assigning them floating IP and virtual terminal protocols (virtual terminal protocol, Referred to as VIP address, etc. That is, the IP address of the virtual machine in the forwarding plane is configured on the management network by using the forwarding plane as the IP address of the virtual machine included in the resource indication information in the embodiment, and the IP address of the virtual machine on the service subnet is configured. The IP address of the virtual machine on the service subnet included in the resource indication information in the embodiment is configured, and the routing information of the virtual machine is configured as the routing information included in the resource indication information in this embodiment. The load balancing SF and three cloud hosts are mounted in the vxlan, and the SF provides load balancing for the three cloud hosts. The entire process is completed by the resource management system call control forwarding interface, without the need for the cloud administrator to manually create virtual machines and configure the network.

Step 4. The resource management system automatically creates a load balancing configuration file conf according to the function indication information in the SFC according to the function indication information in the planned SFC, and communicates with the resident program in the virtual machine by controlling the forwarding interface. The conf configuration file is delivered to the virtual machine, and the load balancer (for example, Nginx) is automatically deployed according to the information contained in the function indication information of the embodiment, and the protocol (load balancing protocol), the member (resource pool member), and the Method (load) are configured. Equalization algorithm) and other load balancing strategies.

Step 5. The forwarding plane updates the SFC and all SF information to the SFC controller in the control plane through the D-API interface, so that related SFs such as load balancing can be discovered and managed by the SFC controller, and the SFC controller can also be made according to requirements. The SFC is configured to be provisioned with a flat business application call.

Embodiment 2

When the SF is a firewall, the FW (FireWall) is dynamically created according to the SFC usage scheme 1:

FIG. 13 is a schematic diagram of an SFC including a firewall according to an embodiment of the present invention. As shown in FIG. 13 , the SF with firewall function is automatically deployed according to SFC to provide security protection for the back-end service network.

The resource management system automatically creates a firewall SF based on the planned SFC:

Step 1. The application plane requires the service network security of the service application, and the firewall needs to be built to provide security protection for the service network.

Step 2. The requirements planning of the application plane service application includes the SFC of the firewall SF, as shown in FIG. The IP of the management network public in the SFC can be 10.46.178.0/24, and the IP address of the service network vxlan can be 192.168.168.0/24, router interface settings, firewall, firewall rules and policies (including support protocols, IP versions, source addresses). , destination address, source port, destination port, action set, etc.). In this scenario, the resource indication information may include an IP address of the virtual machine in the forwarding plane in the foregoing management network, an IP address in the service subnet, and routing information, where the function indication information may include firewall rules and policy information. .

Step 3. The application plane transmits the related information of the SFC to the resource management system through the B-CPI interface. The resource management system automatically creates the network resources required by step 2 of the embodiment, including the router, and deploys the firewall according to the SFC of the application plan. Need a virtual machine (using a custom virtual machine image file containing modules such as resident programs), add a business network, and so on. That is, the IP address of the virtual machine in the forwarding plane is configured on the management network by using the forwarding plane as the IP address of the virtual machine included in the resource indication information in the embodiment, and the IP address of the virtual machine on the service subnet is configured. The IP address of the virtual machine on the service subnet included in the resource indication information in the embodiment is configured, and the routing information of the virtual machine is configured as the routing information included in the resource indication information in this embodiment. The entire process is completed by the resource management system call control forwarding interface, without the need for the cloud administrator to manually create virtual machines and configure the network.

Step 4. The resource manager saves the planned firewall rules and policies to the corresponding files according to the function indication information in the SFC according to the function requirements of the firewall SF in the planned SFC, and is associated with the corresponding virtual machine. The resident program communication, the policy and the rule in the file are transmitted to the virtual machine, and the information contained in the function indication information in the embodiment indicates that the resident program in the virtual machine updates the policy and the rule to the firewall, and starts the protection. .

Step 5. The forwarding plane updates all relevant information of the SFC containing the firewall SF to the SFC controller through the D-API interface, so that related SFs such as firewalls can be discovered and managed by the SFC controller, and the SFC controller can also modify the firewall rules according to requirements. And strategy.

Embodiment 3

When the SF is a VPN, the VPN is dynamically created according to the SFC usage scheme 2, and the VPN service is provided for the network.

The resource management system automatically creates a VPN deployment according to the planned SFC:

Step 1. The application plane needs to provide a service network for the service application, and needs to construct a VPN to provide a VPN service for the service network.

Step 2. The application plane plans an SFC that includes the VPN function according to the requirements of the service application. The IP address of the public network in the SFC can be 10.46.178.0/24, the IP address of the service network vxlan can be 192.168.168.0/24, the router interface is set, and the SFC related information is transmitted to the control plane through the A-CPI interface. . In this scenario, the resource indication information may include an IP address of the virtual machine in the forwarding plane in the foregoing management network, an IP address in the service subnet, and routing information, and the function indication information may include a key exchange protocol IKE. Policy, IP layer security protocol IPSec policy, IPSec site information.

Step 3. The control plane transmits the related information (VPN) of the SFC-enabled SF that needs to be created to the resource management system through the C-API interface, and triggers the resource management system to automatically create the required step 2 of the embodiment according to the planned SFC. Network resources, including routers (routers with special features, using custom virtual machine image files containing modules such as resident programs), adding service networks, and so on. That is, the IP address of the virtual machine in the forwarding plane is configured on the management network by using the forwarding plane as the IP address of the virtual machine included in the resource indication information in the embodiment, and the IP address of the virtual machine on the service subnet is configured. The IP address of the virtual machine on the service subnet included in the resource indication information in this embodiment, and the routing information of the virtual machine are configured as the routing information included in the resource indication information in this embodiment. The entire process is completed by the resource management system call control forwarding interface, without the need for the cloud administrator to manually create virtual machines and configure the network.

Step 4. The resource manager saves the planned IKE Policy, IPSec PolicyIPSec Site, and the like to the configuration file corresponding to the VPN according to the function requirement of the VPN in the planned SFC, that is, according to the function indication information in this embodiment, and Corresponding to the resident program communication in the virtual machine, the configuration file is delivered to the virtual machine, so that the resident program in the virtual machine configures and starts the VPN according to the function indication information in this embodiment.

Step 5. The forwarding plane updates all relevant information of the SFC including the VPN to the SFC controller through the D-CPI, so that the related SF such as the VPN can be discovered and managed by the SFC controller, and the SFC controller can also modify the VPN policy according to requirements. .

Embodiment 4

When the SF is WEB protection, according to the SFC usage scheme 2, the WEB protection SF is dynamically created to provide WEB security protection for the server, and the defense includes SQL (Structured Query Language) injection, file inclusion vulnerability, and XSS (Cross Site) Scripting, cross-site scripting attacks, XSRF (Cross-site request forgery), and directory traversal attacks.

Step 1. The service application of the application plane requires WEB security protection for the service server. The WEB security protection SF needs to be built to provide security protection for the service server.

Step 2. The application plane plans an SFC that includes the WEB security protection SF according to the requirements of the service application. Plan the network in the SFC, where the planned network includes the management network and the service subnet, the WEB protection policy (which may include an Access Control List (ACL)), the IP blacklist, and the user data to be blocked. Disable dangerous methods (including OPTIONS, DELETE, etc.), anti-theft chain, hidden server version information, flow control, configuration for known attack signatures Etc.) A WEB application server or data center that needs to be protected, and the planned SFC related information is transmitted to the control plane through the A-CPI interface. In this scenario, the resource indication information may include an IP address of the virtual machine in the management plane in the forwarding plane, an IP address in the service subnet, and routing information. The function indication information may include the foregoing WEB protection policy and protection. WEB application server or data center information.

Step 3. The control plane transmits the related information (WEB security protection) of the SF to be created to the resource management system through the C-CPI interface, and triggers the resource management system to automatically create the step 2 of the embodiment according to the SFC of the application plane planning. Network resources, including the network, virtual machines required to deploy WEB Security SF (using a custom virtual machine image file containing resident programs, Naxsi, Nginx, SSL, etc.), adding a WEB application server, and so on. That is, the IP address of the virtual machine in the forwarding plane is configured on the management network by using the forwarding plane as the IP address of the virtual machine included in the resource indication information in the embodiment, and the IP address of the virtual machine on the service subnet is configured. The IP address of the virtual machine on the service subnet included in the resource indication information in this embodiment, and the routing information of the virtual machine are configured as the routing information included in the resource indication information in this embodiment. The entire process is completed by the resource management system call control forwarding interface, without the need for the cloud administrator to manually create virtual machines and configure the network.

Step 4. The resource manager saves the planned security protection policy to the corresponding file according to the above-mentioned indication information according to the functional requirements of the WEB security protection SF in the planned SFC (the control node creates for each SF configuration information). File), and communicate with the resident program in the corresponding virtual machine, the policy in the file is passed to the virtual machine, and the resident program in the virtual machine configures the policy and the rule to the WEB security module according to the function indication information in this embodiment. And start protection.

Step 5. The forwarding plane updates the information about the WEB security protection SF to the SFC controller through the D-CPI port, so that the SF can be discovered and managed by the SFC controller, and the SFC controller can also modify the security protection rules and policies according to requirements. .

According to the foregoing embodiment, it can be found that the solution in the embodiment of the present invention automatically creates the underlying network resource through the resource management system for the SFC of the application plane planning, deploys the SF, and the related information of the SF is updated to the SFC controller, so that the SFC controller is implemented. Ability to discover and manage new SFs. The solution of the invention realizes the purpose of dynamically creating the SF based on the SDN service chain, so that the SFC has the characteristics of flexible deployment in the SDN, and improves the resource utilization rate and the manual maintenance cost.

It should be noted that the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are respectively located in multiple processes. In the device.

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1. Acquire a predetermined network function virtualization NFV information, where the NFV information includes resource indication information for indicating an underlying network resource required for establishing a network function, and a function for indicating an SF deployed on the underlying network resource. Indication information;

S2. Create an underlying network resource according to the resource indication information and the function indication information, and deploy the SF on the underlying network resource.

Optionally, in this embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a ROM (Read-Only Memory), a RAM (Random Access Memory), a mobile hard disk, and a magnetic device. A variety of media that can store program code, such as a disc or a disc.

Optionally, in the embodiment, the processor performs the above steps S1-S2 according to the stored program code in the storage medium.

For example, the examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

In the related technical solution, when an SDN creates an SFC, the administrator needs to create the underlying network resources required by the SFC, deploy a new SF based on the existing network resources, and then form an SFC. In the solution of the embodiment of the present invention, the support SDN can conveniently plan the SFC according to the service requirements of the application plane, without considering the underlying network resources. The resource management system automatically creates the required underlying network resources according to the requirements of the SFC, configures and deploys the SF, and the SF information is updated to the SFC controller, so that the SFC controller can discover and manage the relevant SF nodes. This patent improves the flexibility and scalability of SFC in SDN and reduces the cost of manual maintenance.

Obviously, those skilled in the art should understand that the above modules or steps can be implemented by a general computing device, which can be concentrated on a single computing device or distributed over a network of multiple computing devices, optionally They may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, The steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into an integrated circuit module, or a plurality of modules or steps thereof may be implemented as a single integrated circuit module. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

Industrial applicability

The embodiments of the present invention solve the problems in the related art that require manual intervention to create an underlying network resource and deploy SF, thereby creating an underlying network resource and deploying SF rigidity, and cannot flexibly adjust the underlying network resource and SF, thereby achieving flexible adjustment of the underlying layer. The effect of network resources and SF.

Claims

A method for deploying a service function SF, including:

Obtaining predetermined network function virtualization NFV information, the NFV information including resource indication information indicating an underlying network resource required for establishing a network function, and function indication information indicating an SF deployed on the underlying network resource ;

And creating the SF resource according to the resource indication information and the function indication information, and deploying the SF on the underlying network resource.
The method of claim 1, wherein the creating the underlying network resource according to the resource indication information and the function indication information and deploying the SF on the underlying network resource comprises:

Transmitting the resource indication information to the forwarding plane by using an interface with the forwarding plane, to instruct the forwarding plane to create the underlying network resource on the forwarding plane according to the resource indication information;

Distributing deployment information determined according to the function indication information to the virtual machine to indicate the virtual machine deployment by using the interface to communicate with a resident program in a virtual machine in the underlying network resource The SF.
The method of claim 2, wherein the resource indication information is communicated to the forwarding plane through an interface with a forwarding plane to indicate that the forwarding plane is forwarded according to the resource indication information Creating the underlying network resources on a plane includes:

Transmitting, by the interface, the resource indication information to the forwarding plane, to indicate that the forwarding plane configures, by using the resource indication information, a parameter for creating the underlying network resource into the forwarding plane. On the virtual machine;

Transmitting the deployment information determined according to the function indication information to the virtual machine by using the interface to communicate with a resident program in the virtual machine in the underlying network resource to indicate the virtual The deployment of the SF includes:

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to include the SF included in the function indication information for deploying SF The parameters are configured to the virtual machine.
The method according to claim 3, wherein the SF is load balancing, and the resource indication information comprises: a first management network network protocol IP address, an IP address of a first service subnet, and first routing information, The function indication information includes: load balancing protocol information, member information of the load balancing resource pool, and load balancing algorithm information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to load, by the forwarding plane, a parameter for creating the underlying network resource included in the resource indication information to the forwarding plane The virtual machines in the include:

Transmitting the resource indication information to the forwarding plane by using the interface, to instruct the forwarding plane to perform the following operations: configuring an IP address of the first virtual machine in the forwarding plane on the management network as the first Configuring the IP address of the network, configuring the IP address of the first virtual machine on the service subnet as the IP address of the first service subnet, and configuring the routing information of the first virtual machine as the first routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to use parameters included in the function indication information for deploying SF Configuring to the virtual machine includes:

And generating a load balancing configuration file according to the function indication information, and transmitting the load balancing configuration file to the first virtual machine by using the interface to communicate with the resident program, to indicate the first virtual The device performs the following operations: configuring the protocol of the first virtual machine as a protocol corresponding to the load balancing protocol information, and configuring a member of the first virtual machine as a member corresponding to the member information of the load balancing resource pool. And configuring an algorithm of the first virtual machine as an algorithm corresponding to the load balancing algorithm information.
The method according to claim 3, wherein the SF is a firewall, and the resource indication information comprises: a second management network network protocol IP address, an IP address of the second service subnet, and second routing information, the function The indication information includes: firewall rules and policy information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to load, by the forwarding plane, a parameter for creating the underlying network resource included in the resource indication information to the forwarding plane The virtual machines in the include:

Passing the resource indication information to the forwarding plane with the interface, to instruct the forwarding plane to perform the following operations: configuring an IP address of the second virtual machine in the forwarding plane on the management network as the The second management network IP address, the IP address of the second virtual machine on the service subnet is configured as the second service subnet IP address, and the routing information of the second virtual machine is configured as the second routing information. ;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to use parameters included in the function indication information for deploying SF Configuring to the virtual machine includes:

Creating a firewall configuration file according to the function indication information; transmitting the firewall configuration file to the second virtual machine by using the interface to communicate with the resident program, to indicate that the second virtual machine will The rules and policies of the second virtual machine are configured as rules and policies corresponding to the firewall rules and policy information.
The method according to claim 3, wherein the SF is a virtual private network VPN, and the resource indication information comprises: a third management network network protocol IP address, a third service subnet IP address, and third routing information, The function indication information includes: a key exchange protocol IKE policy, an IP layer security protocol IPSec policy, and an IPSec site information;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to load, by the forwarding plane, a parameter for creating the underlying network resource included in the resource indication information to the forwarding plane The virtual machines in the include:

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to perform the following operations: configuring an IP address of a third virtual machine in the forwarding plane on the management network as the third The management network IP address, the IP address of the third virtual machine on the service subnet is configured as the third service subnet IP address, and the routing information of the third virtual machine is configured as the third routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to use parameters included in the function indication information for deploying SF Configuring to the virtual machine includes:

Creating a VPN configuration file according to the function indication information; by using the interface and the resident Passing the VPN configuration file to the third virtual machine to instruct the third virtual machine to perform the following operations: configuring a protocol policy of the third virtual machine as the key exchange The protocol IKE policy and the IP layer security protocol IPSec policy are configured to configure the site of the third virtual machine as the site corresponding to the IPSec site information.
The method according to claim 3, wherein the SF is a network element WEB protection, and the resource indication information comprises: a fourth management network network protocol IP address, a fourth service subnet IP address, and fourth routing information, The function indication information includes: a WEB protection policy and a WEB application server or data center information that needs to be protected;

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to load, by the forwarding plane, a parameter for creating the underlying network resource included in the resource indication information to the forwarding plane The virtual machines in the include:

Transmitting, by the interface, the resource indication information to the forwarding plane, to instruct the forwarding plane to perform the following operations: configuring an IP address of a fourth virtual machine in the forwarding plane on the management network as the fourth The management network IP address, the IP address of the fourth virtual machine on the service subnet is configured as the fourth service subnet IP address, and the routing information of the fourth virtual machine is configured as the fourth routing information;

Transmitting the deployment information to the virtual machine by using the interface to communicate with the resident program, to instruct the virtual machine to use parameters included in the function indication information for deploying SF Configuring to the virtual machine includes:

Creating a WEB protection configuration file according to the function indication information; transmitting the WEB protection configuration file to the fourth virtual machine by using the interface to communicate with the resident program, to indicate the fourth virtual The device performs the following steps: configuring the rules and policies of the fourth virtual machine as the WEB protection policy and rules, and configuring the server or data center of the fourth virtual machine as the WEB application server or data that needs to be protected. The server or data center corresponding to the central information.
The method of claim 1, wherein the obtaining the predetermined network function virtualization NFV information comprises:

Receiving the NFV information delivered by the application plane.
The method of claim 1, wherein the obtaining the predetermined network function virtualization NFV information comprises:

And receiving, by the control plane, the NFV information, where the NFV information is delivered to the control plane.
The method of claim 1, wherein the creating the underlying network resource according to the resource indication information and the function indication information and deploying the SF on the underlying network resource further comprises:

Obtaining updated NFV information, where the updated NFV information includes updated resource indication information and/or updated function indication information;

And updating the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information.
The method according to claim 10, wherein the updating the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information comprises:

Changing, adding, or deleting the created underlying network resource according to the updated resource indication information; and/or,

The deployed SF is changed, added, or deleted according to the updated function indication information.
The method according to claim 2, wherein after the creating the MME and the SF on the underlying network resource according to the resource indication information and the function indication information, the method further includes:

The forwarding plane reports the information of the underlying network resource to the control plane after the underlying network resource is created; and/or,

After the SF is deployed, the forwarding plane reports the information about the SF to the control plane.
A deployment device for a service function SF, comprising:

a first acquiring module, configured to acquire predetermined network function virtualization NFV information, where the NFV information includes resource indication information used to indicate an underlying network resource required for establishing a network function, and is used to indicate on the underlying network resource Function indication information of the deployed SF;

And a processing module, configured to create the underlying network resource according to the resource indication information and the function indication information, and deploy the SF on the underlying network resource.
The apparatus of claim 13 wherein said processing module comprises:

a first transmitting unit, configured to: pass the resource indication information to the forwarding plane by using an interface with a forwarding plane, to instruct the forwarding plane to create the bottom layer on the forwarding plane according to the resource indication information Internet resources;

a second delivery unit configured to: pass the deployment information determined according to the function indication information to the virtual machine by using the interface to communicate with a resident program in a virtual machine in the underlying network resource, to Instructing the virtual machine to deploy the SF.
The device of claim 14 wherein:

The first delivery unit includes: a first delivery subunit, configured to: pass the resource indication information to the forwarding plane by using the interface, to indicate that the forwarding plane uses the information included in the resource indication information Creating a parameter of the underlying network resource to be configured on the virtual machine in the forwarding plane;

The second delivery unit includes: a second delivery subunit configured to pass the deployment information to the virtual machine by using the interface to communicate with the resident program to indicate the virtual machine The parameters for deploying the SF included in the function indication information are configured on the virtual machine.
The device according to claim 15, wherein the SF is load balancing, and the resource indication information comprises: a first management network network protocol IP address, an IP address of a first service subnet, and first routing information, The function indication information includes: load balancing protocol information, member information of the load balancing resource pool, and load balancing algorithm information;

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operations: The IP address of the first virtual machine in the forwarding plane is configured as the IP address of the first management network, and the IP address of the first virtual machine on the service subnet is configured as the first service subnet. An IP address, configured to configure routing information of the first virtual machine as the first routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a load balancing configuration file according to the function indication information; and using the interface to communicate with the resident program The load balancing configuration file is delivered to the first virtual machine to instruct the first virtual machine to perform the following operations: configuring a protocol of the first virtual machine as a protocol corresponding to the load balancing protocol information, and the A member of a virtual machine is configured as a member corresponding to the member information of the load balancing resource pool, and an algorithm of the first virtual machine is configured as an algorithm corresponding to the load balancing algorithm information.
The device according to claim 15, wherein the SF is a firewall, and the resource indication information comprises: a second management network network protocol IP address, an IP address of the second service subnet, and second routing information, the function The indication information includes: firewall rules and policy information;

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane by using the interface, to instruct the forwarding plane to perform the following operations: Configuring an IP address of the second virtual machine in the forwarding plane on the management network as the second management network IP address, and configuring an IP address of the second virtual machine on the service subnet as the second service sub Configuring the routing information of the second virtual machine as the second routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a firewall configuration file according to the function indication information; and using the interface to communicate with the resident program to use the firewall The configuration file is delivered to the second virtual machine to instruct the second virtual machine to configure rules and policies of the second virtual machine as rules and policies corresponding to the firewall rule and policy information.
The device according to claim 15, wherein the SF is a virtual private network VPN, and the resource indication information comprises: a third management network network protocol IP address, a third service subnet IP address, and third routing information, The function indication information includes: a key exchange protocol IKE policy, an IP layer security protocol IPSec policy, and an IPSec site information;

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operations: The IP address of the third virtual machine in the forwarding plane is configured as the IP address of the third management network, and the IP address of the third virtual machine on the service subnet. The address is configured as the third service subnet IP address, and the routing information of the third virtual machine is configured as the third routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a VPN configuration file according to the function indication information; and using the interface to communicate with the resident program to use the VPN The configuration file is delivered to the third virtual machine to instruct the third virtual machine to perform the following operations: configuring a protocol policy of the third virtual machine as the key exchange protocol IKE policy and the IP layer security protocol The IPSec policy configures the site of the third virtual machine as the site corresponding to the IPSec site information.
The device according to claim 15, wherein the SF is a network element WEB protection, and the resource indication information comprises: a fourth management network network protocol IP address, a fourth service subnet IP address, and fourth routing information, The function indication information includes: a WEB protection policy and a WEB application server or data center information that needs to be protected;

The first delivery sub-unit indicates that the forwarding plane configures the underlying network resource by: transmitting the resource indication information to the forwarding plane through the interface, to instruct the forwarding plane to perform the following operations: The IP address of the fourth virtual machine in the forwarding plane is configured as the fourth management network IP address, and the IP address of the fourth virtual machine on the service subnet is configured as the fourth service subnet. An IP address, configured to configure routing information of the fourth virtual machine as the fourth routing information;

The second delivery subunit instructs the virtual machine to deploy the SF by: creating a WEB protection configuration file according to the function indication information; and using the interface to communicate with the resident program The WEB protection profile is delivered to the fourth virtual machine to instruct the fourth virtual machine to perform the following operations: configuring the rules and policies of the fourth virtual machine as the WEB protection policy and rules, and the The server or data center of the four virtual machines is configured as the server or data center corresponding to the WEB application server or data center information that needs to be protected.
The apparatus of claim 13, wherein the first obtaining module comprises:

The first receiving unit is configured to receive the NFV information transmitted by the application plane.
The apparatus of claim 13, wherein the first obtaining module comprises:

a second receiving unit configured to receive the NFV information transmitted by the control plane, where The NFV information is passed to the control plane for the application plane.
The apparatus of claim 13 further comprising:

a second acquiring module, configured to acquire the updated NFV information after the processing module creates the underlying network resource according to the resource indication information and the function indication information, and deploys the SF on the underlying network resource The updated NFV information includes updated resource indication information and/or updated function indication information;

And an update module, configured to update the created underlying network resource and the deployed SF according to the updated resource indication information and/or the updated function indication information.
The apparatus of claim 22 wherein said updating module comprises:

a first update unit, configured to change, add, or delete the created underlying network resource according to the updated resource indication information; and/or,

The second update unit is configured to change, add or delete the deployed SF according to the updated function indication information.
The apparatus of claim 14 further comprising:

The first reporting module is applied to the forwarding plane, and is configured to report the information of the underlying network resource to the control plane after the network resource is created; and/or

The second reporting module is applied to the forwarding plane, and is configured to report the information of the deployed SF to the control plane after the SF is deployed.