A resource management system for network function virtualization NFV network

Abstract

The present invention discloses a resource management system for a network function virtualization (NFV) network, comprising: a virtualized network function module, a virtualized network facility module, and a management, automation and network orchestration module. The present invention proposes a sensitivity feature and combines it with the task orchestration process. At the same time, the present invention also takes into account the security issues that may exist at the physical level, quantifies them to a certain extent and distinguishes them as an important part of the task orchestration process, which can effectively ensure the information security of data and computing tasks at the physical level.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing, and in particular to a resource management system for a network function virtualization (NFV) network. Background Art

[0002] Network Function Virtualization (NFV) is a concept about network architecture. The x86 servers we usually use are produced by hardware manufacturers and realize various functions after installing different operating systems and software. Traditional network devices do not adopt this model. Routers, switches, firewalls, load balancers and other devices all have their own independent hardware and software systems. NFV draws on the architecture of x86 servers. It encapsulates different network functions such as routers, switches, firewalls, and load balancers into independent modular software. By running different modular software on hardware devices, diversified network functions can be realized on a single hardware device.

[0003] The NFV architecture is a standard architecture proposed by the European Telecommunications Standards Institute (ETSI) to define NFV implementation standards. The concept of NFV is to apply standardized network functions to hardware of a unified standard. Unlike the strong binding relationship between software and hardware in traditional physical devices, in the NFV architecture, standardized software that implements various network functions must be able to be applied on the same hardware device. This requires NFV to have a unified standard. The NFV architecture consists of three parts: basic network function virtualization architecture, virtual network functions, management automation, and network orchestration:

[0004] Network Functions Virtualization Infrastructure (NFVI): NFVI is like the mobile phone systems launched by various mobile phone manufacturers. It gives basic components to hardware devices and supports the software or container management platform required by network applications.

[0005] Virtual Network Functions (VNF): VNF is a software application that implements network functions (forwarding services, IP configuration, etc.), just like an APP on a mobile phone. In the NFV architecture, various VNFs are implemented on the basis of NFVI. Since NFVI is a standardized architecture, different VNFs have gained universality and no longer rely on the original black box equipment.

[0006] Management Automation and Network Orchestration (MANO): MANO is a unified framework for managing VNFs and NFVI, making it easier for operation and maintenance personnel to perform service orchestration and device management.

[0007] After the existing NFV network is deployed, the impact of subsequent hardware expansion on system security is rarely considered. Summary of the invention

[0008] The main technical problem solved by the present invention is to provide a resource management system for a network function virtualization NFV network, which can realize security management and scheduling of resources on a network function virtualization cloud platform.

[0009] The present invention adds a resource authentication module and a resource scheduling module to the MANO part of the existing NFV framework, which can realize hardware authentication of all devices in the NFV network. When the newly added hardware is not authenticated, the resource scheduling module performs sensitivity calculation before data allocation. High-sensitivity data is only allocated to the VNF whose corresponding hardware has completed authentication when passing through the resource scheduling module.

[0010] In order to solve the above technical problems, the technical solution adopted by the present invention is: to provide a resource management system for a network function virtualization NFV network, comprising:

[0011] Virtualized network function module, virtualized network facility module, management, automation and network orchestration module;

[0012] The virtualized network function module is a software application that provides network functions;

[0013] The virtualized network facility module includes infrastructure components and virtualizes physical resources into virtual resources;

[0014] The management, automation and network orchestration module includes: a virtualized infrastructure management module, a virtualized network function management module, a virtualized network function orchestration module, a physical resource authentication module, and a virtual resource scheduling module;

[0015] The virtualized infrastructure management module controls the allocation of virtual resources for virtualized network functions;

[0016] The virtualized network function management module manages the life cycle of the virtualized network function;

[0017] The virtualized network function orchestration module manages the life cycle of network services and coordinates the operation of the virtualized infrastructure management module and the virtualized network function management module;

[0018] The infrastructure components include: physical resources, virtual resources, and a virtualization layer.

[0019] Further, the physical resource authentication module includes: existing physical resource authentication, newly added physical resource authentication;

[0020] The existing physical resource authentication performs security authentication on the existing physical resources on the network function virtualization cloud platform. If the authentication result is a safe device, the authentication result is used as the physical layer label of the resource; if the authentication result is a risky device, a risk warning is issued to the management personnel, and the authentication result is used as the physical layer label of the resource. At the same time, the virtualization infrastructure management module marks the virtual resources corresponding to the resource as risk;

[0021] The newly added physical resource authentication, when the physical layer is expanded, the security authentication of the newly added physical resources is carried out. If the authentication result is a safe device, the authentication result is used as the physical layer label of the resource and is normally applied as an infrastructure component; if the authentication result is a risky device, when the resource is a necessary device, the authentication result is used as the physical layer label of the resource, and the virtualized infrastructure management module marks the corresponding virtual resources after the resource is virtualized as a risk;

[0022] When a newly added physical resource has not undergone security authentication, or the authentication result indicates that the device is a risky device but not essential, the virtualization and application of the physical resource will be suspended;

[0023] When a virtual resource contains a risk tag, the virtualized network function management module strengthens the status monitoring of the network service corresponding to the virtual resource, and preferentially schedules data or computing tasks to the virtual resource that does not contain the risk tag.

[0024] Furthermore, the virtual resource scheduling module includes:

[0025] The data and computing tasks on the network function virtualization cloud platform are divided into different levels according to their sensitivity. When virtual resources are scheduled, the highly sensitive parts are identified. When virtual resources are insufficient, the highly sensitive data and computing tasks are preferentially scheduled to the virtual resources that do not contain risk tags. When the virtual resources that do not contain risk tags are still insufficient, the highly sensitive data and computing tasks are desensitized and encrypted before being scheduled.

[0026] Furthermore, the sensitivity classification includes:

[0027] Establish sensitivity characteristics for data and computing tasks, calculate sensitivity characteristic values ​​for different data and computing tasks, and sort the sensitivity characteristic values ​​from low to high;

[0028] The sorting results are divided into the first 30% of data and computing tasks as the low-sensitivity part, the second 30% of data and computing tasks as the high-sensitivity part, and the middle 40% of data and computing tasks as the ordinary part;

[0029] The sensitivity feature is established to determine the source of the data and computing tasks, the user information involved, and the type of processing results, and a high-dimensional vector value is obtained according to preset weight calculations, and the high-dimensional vector value is used as the sensitivity feature.

[0030] The beneficial effects of the present invention are:

[0031] The present invention proposes sensitivity features and combines them with the task scheduling process. At the same time, the present invention also takes into account possible security issues at the physical level, quantifies them to a certain extent and distinguishes them as an important part of the task scheduling process, which can effectively ensure the information security of data and computing tasks at the physical level. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a structural schematic diagram of a resource management system of a network function virtualization NFV network of the present invention. DETAILED DESCRIPTION

[0033] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0034] See also Figure 1 , the embodiment of the present invention includes:

[0035] A resource management system for a network function virtualization (NFV) network, comprising:

[0036] Virtualized network function module, virtualized network facility module, management, automation and network orchestration module;

[0037] The virtualized network function module is a software application that provides network functions;

[0038] The virtualized network facility module includes infrastructure components and virtualizes physical resources into virtual resources;

[0039] The management, automation and network orchestration module includes: a virtualized infrastructure management module, a virtualized network function management module, a virtualized network function orchestration module, a physical resource authentication module, and a virtual resource scheduling module;

[0040] The virtualized infrastructure management module controls the allocation of virtual resources for virtualized network functions;

[0041] The virtualized network function management module manages the life cycle of the virtualized network function;

[0042] The virtualized network function orchestration module manages the life cycle of network services and coordinates the operation of the virtualized infrastructure management module and the virtualized network function management module;

[0043] The infrastructure components include: physical resources, virtual resources, and a virtualization layer.

[0044] Further, the physical resource authentication module includes: existing physical resource authentication, newly added physical resource authentication;

[0045] The existing physical resource authentication performs security authentication on the existing physical resources on the network function virtualization cloud platform. If the authentication result is a safe device, the authentication result is used as the physical layer label of the resource; if the authentication result is a risky device, a risk warning is issued to the management personnel, and the authentication result is used as the physical layer label of the resource. At the same time, the virtualization infrastructure management module marks the virtual resources corresponding to the resource as risk;

[0046] The newly added physical resource authentication, when the physical layer is expanded, the security authentication of the newly added physical resources is carried out. If the authentication result is a safe device, the authentication result is used as the physical layer label of the resource and is normally applied as an infrastructure component; if the authentication result is a risky device, when the resource is a necessary device, the authentication result is used as the physical layer label of the resource, and the virtualized infrastructure management module marks the corresponding virtual resources after the resource is virtualized as a risk;

[0047] When a newly added physical resource has not undergone security authentication, or the authentication result indicates that the device is a risky device but not essential, the virtualization and application of the physical resource will be suspended;

[0048] When a virtual resource contains a risk tag, the virtualized network function management module strengthens the status monitoring of the network service corresponding to the virtual resource, and preferentially schedules data or computing tasks to the virtual resource that does not contain the risk tag.

[0049] The security authentication is performed by the physical resource authentication module on the devices at the physical resource layer. The authentication content includes: device model, device MAC address, device capacity, and device operation security. Among them, the device operation security is comprehensively evaluated by the system administrator based on the actual application and network environment, and several preset levels are used as the device security evaluation results.

[0050] The preset level is set by the system administrator according to the requirements of the cloud computing platform.

[0051] Furthermore, the virtual resource scheduling module includes:

[0052] The data and computing tasks on the network function virtualization cloud platform are divided into different levels according to their sensitivity. When virtual resources are scheduled, the highly sensitive parts are identified. When virtual resources are insufficient, the highly sensitive data and computing tasks are preferentially scheduled to the virtual resources that do not contain risk tags. When the virtual resources that do not contain risk tags are still insufficient, the highly sensitive data and computing tasks are desensitized and encrypted before being scheduled.

[0053] Furthermore, the sensitivity classification includes:

[0054] Establish sensitivity characteristics for data and computing tasks, calculate sensitivity characteristic values ​​for different data and computing tasks, and sort the sensitivity characteristic values ​​from low to high;

[0055] The sorting results are divided into the first 30% of data and computing tasks as the low-sensitivity part, the second 30% of data and computing tasks as the high-sensitivity part, and the middle 40% of data and computing tasks as the ordinary part;

[0056] The sensitivity feature is established to determine the source of the data and computing tasks, the user information involved, and the type of processing results, and a high-dimensional vector value is obtained according to preset weight calculations, and the high-dimensional vector value is used as the sensitivity feature.

[0057] Taking the expansion of the cloud computing platform by the computing center as an example, 5 computing devices and 10 storage devices were expanded at the physical resource layer. For these newly added devices, the physical resource authentication module first authenticated the detailed information of each device. Among them, the device security was only completed for 3 computing devices and 8 storage devices due to human resource issues.

[0058] After the cloud computing platform is running, the devices that have completed security certification are put into use after being virtualized by the virtual layer, and the devices that have not completed certification are retained until the security certification is completed. When the task volume of the cloud computing platform triggers the expansion threshold, the devices that have not completed certification can be marked as risk and then put into use after being virtualized by the virtualization layer. The virtual resources virtualized from this part of the physical resource layer equipment are also marked as risk as a security prerequisite for virtual resource scheduling.

[0059] Taking the electricity bill calculation task and electricity consumption query task in the power system cloud computing platform as an example, the data required for the electricity bill calculation task involves the meter number, user contact information, user payment information, electricity consumption information, and electricity price information, and the data required for the electricity consumption query task involves the meter number and electricity consumption information; the electricity bill calculation task comes from the system periodic tasks, and the electricity consumption query task comes from the user's initiation; according to the above content combined with the preset weights, the sensitivity characteristics of the two tasks are that the sensitivity characteristics of the electricity bill calculation task are greater than the electricity consumption query task, then the electricity bill calculation task shall be calculated by the virtual resources that do not contain risk tags first.

[0060] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A resource management system for a network function virtualization NFV network, characterized in that: include: Virtualized network function module, virtualized network facility module, management, automation and network orchestration module; The virtualized network function module is a software application that provides network functions; The virtualized network facility module includes infrastructure components and virtualizes physical resources into virtual resources; The management, automation and network orchestration module includes: a virtualized infrastructure management module, a virtualized network function management module, a virtualized network function orchestration module, a physical resource authentication module, and a virtual resource scheduling module; The virtualized infrastructure management module controls the allocation of virtual resources for virtualized network functions; The virtualized network function management module manages the life cycle of the virtualized network function; The virtualized network function orchestration module manages the life cycle of network services and coordinates the operation of the virtualized infrastructure management module and the virtualized network function management module; The infrastructure components include: physical resources, virtual resources, and a virtualization layer; The physical resource authentication module includes: existing physical resource authentication and new physical resource authentication; The existing physical resource authentication performs security authentication on the existing physical resources on the network function virtualization cloud platform. If the authentication result is a safe device, the authentication result is used as the physical layer label of the resource; if the authentication result is a risky device, a risk warning is issued to the management personnel, and the authentication result is used as the physical layer label of the resource. At the same time, the virtualization infrastructure management module marks the virtual resources corresponding to the resource as risk; The newly added physical resource authentication, when the physical layer is expanded, the security authentication of the newly added physical resources is carried out. If the authentication result is a safe device, the authentication result is used as the physical layer label of the resource and is normally applied as an infrastructure component; if the authentication result is a risky device, when the resource is a necessary device, the authentication result is used as the physical layer label of the resource, and the virtualized infrastructure management module marks the corresponding virtual resources after the resource is virtualized as a risk; When a newly added physical resource has not undergone security authentication, or the authentication result indicates that the device is a risky device but not essential, the virtualization and application of the physical resource will be suspended; When a virtual resource contains a risk tag, the virtualized network function management module strengthens the status monitoring of the network service corresponding to the virtual resource and preferentially schedules data or computing tasks to the virtual resource that does not contain the risk tag; The virtual resource scheduling module includes: Data and computing tasks on the network function virtualization cloud platform are divided into different sensitivity levels. When virtual resources are scheduled, the highly sensitive parts are identified. When virtual resources are insufficient, highly sensitive data and computing tasks are preferentially scheduled to virtual resources without risk tags. When virtual resources without risk tags are still insufficient, highly sensitive data and computing tasks are desensitized and encrypted before scheduling. The sensitivity classification includes: Establish sensitivity characteristics for data and computing tasks, calculate sensitivity characteristic values ​​for different data and computing tasks, and sort the sensitivity characteristic values ​​from low to high; The sorting results are divided into the first 30% of data and computing tasks as the low-sensitivity part, the second 30% of data and computing tasks as the high-sensitivity part, and the middle 40% of data and computing tasks as the ordinary part; The sensitivity feature is established to determine the source of the data and computing tasks, the user information involved, and the type of processing results, and a high-dimensional vector value is obtained according to preset weight calculations, and the high-dimensional vector value is used as the sensitivity feature.

Images