A unified scheduling method based on virtual network elements and physical devices

Abstract

The present invention relates to a unified scheduling method based on virtual network elements and physical devices, belonging to the field of network security. The method of the present invention includes: a physical network element definition and a unified service chain arrangement method; physical network element definition: defining the network into four categories: internal management network, business network, service chain series network and service chain bypass network; dividing the interface into four categories: internal management interface, business network interface, series interface and bypass interface; the physical network element only cares about the network and interface of the series or bypass business; service chain unified arrangement method: based on the differences between virtual network elements and physical network elements, the two objects are abstracted, the attributes of the intersection of the two objects are extracted, and a new common network element object is formed. The present invention allows users to ignore the two device forms and only focus on their security protection capabilities, and use service chains for flexible combination, which greatly reduces the complexity of operation and maintenance.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a unified scheduling method based on virtual network elements and physical devices. Background Art

[0002] Currently, network security service systems contain a large number of virtual and physical network elements. However, these two types of elements cannot be orchestrated together. Orchestration can only be performed on physical or virtual network elements. This not only wastes resources but also creates significant management and maintenance challenges. Hybrid orchestration of virtualized and physical network elements is a challenge. Summary of the Invention

[0003] (1) Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is how to provide a unified scheduling method based on virtual network elements and physical devices to solve the problem of mixed orchestration of virtualized network elements and physical network elements.

[0005] (2) Technical solution

[0006] In order to solve the above technical problems, the present invention proposes a unified scheduling method based on virtual network elements and physical devices, which includes: a physical network element definition and service chain unified orchestration method;

[0007] Definition of physical network elements: Networks are defined as four categories: internal management network, service network, service chain tandem network, and service chain bypass network. Interfaces are also divided into four categories: internal management interface, service network interface, tandem interface, and bypass interface. Physical network elements are only concerned with networks and interfaces for tandem or bypass services.

[0008] Unified service chain orchestration method: Based on the differences between virtual network elements and physical network elements, the two objects are abstracted, and the attributes of the intersection of the two objects are extracted to form a new common network element object; for service chain functions, this new network element object is orchestrated, and the previous virtual network element objects and physical network element objects are no longer used. It is no longer distinguished whether the orchestration is virtual or physical network elements. When distributing traffic, only the series or bypass interface of the network element object is concerned.

[0009] (3) Beneficial effects

[0010] The present invention proposes a unified scheduling method based on virtual network elements and physical devices. The present invention proposes a unified scheduling method based on virtual network elements and physical devices. It is an innovative method mainly proposed to solve the problem that virtual network elements and physical devices cannot be uniformly orchestrated and scheduled. Compared with the current situation that traditional orchestration technology can only orchestrate virtual network elements or physical devices separately, this method can abstract both virtual network elements and physical devices into a new security service object, allowing users to ignore the two device forms and only focus on their security protection capabilities. The unified service chain can be flexibly combined, greatly reducing the complexity of operation and maintenance, and can also reuse old equipment and solve the problem that some devices do not have a virtualized form. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a schematic diagram of the same arrangement of virtual network elements and physical devices;

[0012] Figure 2 Classify diagrams for software-defined networks;

[0013] Figure 3 Define a graph for a virtual network element object;

[0014] Figure 4 Define graphs for physical network element objects;

[0015] Figure 5 Define a graph for a new network element object. DETAILED DESCRIPTION

[0016] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below with reference to the accompanying drawings and examples.

[0017] The present invention proposes a unified scheduling method based on virtual network elements and physical devices, which is an innovative method mainly proposed to solve the problem that virtual network elements and physical devices cannot be uniformly scheduled.

[0018] like Figure 1 As shown, virtual network elements are connected to the corresponding virtual network upon creation for orchestration and use. Physical devices, on the other hand, are connected to the physical network and are independent of the virtual network. To orchestrate both physical devices in the physical network and virtual network elements in the virtual network to form a hybrid virtual-physical service chain, it is necessary to reclassify and define the network, analyze the usage of virtual and physical network elements, define the characteristics of physical network elements, and then conduct compatibility analysis and design based on unified service chain orchestration.

[0019] 4.1 Definition of Physical Network Elements

[0020] To design and define physical network elements, it's necessary to first clarify the primary deployment and usage methods for physical security devices within the network. Physical security devices within service networks are primarily categorized as Layer 2 and Layer 3 access. Layer 3 access service chains typically link devices together based on routing, with traffic directed to the physical security devices through policy-based routing. This access method requires assigning physical security devices corresponding Layer 3 networks and IP addresses to logically string them together into a service chain. This approach is complex and inflexible, and adjusting the composition of the service chain is particularly difficult. Therefore, Layer 3 access is generally not considered. Layer 2 access is more flexible and convenient, and is categorized as in-line and bypass access. Different physical security devices may utilize different access methods. Combined with the unified use of compatible virtual network elements, this approach will clarify the scope of software-defined networking.

[0021] like Figure 2 , defines four types of networks: internal management network, business network, service chain tandem network, and service chain bypass (mirror) network. Interfaces are also divided into four categories: internal management interface, business network interface, tandem interface (pair), and bypass (mirror) interface.

[0022] The network is divided into four categories based on different demand scenarios.

[0023] Internal Management Network: This is an internal management network that is not externally visible and is used to manage VNFs, including password-free redirection, VNF configuration initialization (network), and centralized management. This network is required for virtual network elements (VNEs) but not for physical network elements.

[0024] Business Network: This network connects to the user's business network and is primarily used to proactively provide security services based on a Layer 3 network. For example, vulnerability scanning systems connect to the customer's business network through this network for scanning. This network is mandatory for virtual network elements (VNEs), but not for physical network elements (PNEs). Multiple VNFs can have this network. Each VNF has an interface connected to it.

[0025] Service Chaining Network: A service chaining network orchestrates network elements (NEs) to form a logically connected network. Service chaining doesn't require routing because it connects multiple VNFs via Layer 2 access. Unlike other service chaining implementations, which rely on configuring multiple Layer 3 networks and combining them with policy routing to achieve the effect of a single service chain, this network is selected based on how the NEs are used. NEs requiring security protection in the chain should be configured accordingly.

[0026] Service Chain Bypass Network: This network is specifically designed for traffic mirroring, replicating specified traffic and distributing it to bypass audit, analysis, and statistics network elements in adjacent chains within the service chain. This network is also selected based on how the network elements are used. NEs that require statistical analysis on the bypass chain must be configured.

[0027] According to the above four types of network definitions, there are also corresponding four types of interfaces.

[0028] Internal management interface: The internal management network is mandatory for virtual network elements, so there must be an internal management interface in the VNF. The default is the first interface, DHCP mode, and it will automatically obtain an internal network IP after startup. This IP will be used for password-free jumps and RESTAPI configuration, etc., while physical network elements do not need it. The internal management interface is Figure 2 The e0 interface in the network element.

[0029] Service network interface: Since service network is mandatory for virtual network elements and there is at least one, there will be an interface for each service network in the VNF. Service-oriented VNFs will provide relevant security protection through this interface, such as vulnerability scanning, SSLVPN, etc., which is not required for physical network elements. Figure 2 The e1 interface in the VNF in the .

[0030] Serial interface: If you want to orchestrate the network element into the serial chain of the service chain, you need to select the serial network when creating or defining the network element. There will be a pair of interfaces in the virtual network element, and the physical network element needs to select a pair of interfaces on the physical device as the serial interface. This pair of interfaces is required to be included in the bridge for Layer 2 transmission, with one interface in and one interface out. The service chain orchestration engine will send the specified traffic to the serial interface of the corresponding network element in sequence according to the diversion strategy and service chain strategy, and the traffic received from the serial interface will find the next network element according to the service chain strategy, and repeat the above actions until the traffic is processed from the last network element in the serial chain of the service chain and then forwarded. The serial interface is Figure 2 The e2 and e3 interfaces within the VNF are: e2 is the serial input interface, and e3 is the serial output interface.

[0031] Bypass interface: If you want to orchestrate the VNF into the bypass chain of the service chain, you need to select the bypass network when creating or defining the network element. There will be an additional corresponding interface in the VNF, and the physical network element needs to select an interface on the physical device as the bypass interface. The interface needs to be set to bypass mode to receive and process the mirrored traffic. The service chain orchestration engine will copy the specified traffic according to the diversion strategy and service chain strategy, and send it to the bypass interface of each network element in the bypass chain. The bypass interface is Figure 2The e4 interface in the VNF in the .

[0032] According to the above definition and analysis, there are significant differences between physical network elements and virtual network elements. Physical network elements only care about the networks and interfaces of serial or bypass services. They do not require any customized development of physical devices and can be directly managed by the service chain, thereby better achieving the effect of reusing old equipment.

[0033] 4.2 Unified Service Chain Orchestration Method

[0034] Given the differences between virtual and physical network elements, it's necessary to abstract these two objects, extracting the properties of the intersection between them to form a new, common network element object. For service chaining, orchestration must be performed on this new network element object, discontinuing the previous virtual and physical network element objects. No distinction is made between orchestrated virtual and physical network elements. Traffic distribution focuses solely on the inline or bypass interfaces of the network element objects, achieving compatibility.

[0035] like Figure 3 In addition to some of its own characteristics, the virtual network element also includes network-related attributes. The network-related attributes include the internal management network, service network, series network, bypass network, and the corresponding interface information of the corresponding network.

[0036] like Figure 4 The attributes of a physical network element are fewer than those of a virtual network element. In addition to its own characteristics, it also includes network-related attributes. The network-related attributes only include the serial network, bypass network, and the corresponding interface information of the corresponding network.

[0037] like Figure 5 Ultimately, both virtual and physical network element objects are converted into new network element objects. This object extracts and retains the attributes of the intersection and refines the four types of networks and their corresponding four types of interfaces to form independent interface objects. After the service chain references the new network element object, compatibility between virtual and physical network elements is achieved. In subsequent use, there is no need to consider the relevant differences. Simply define the required virtual and physical network elements and directly reference them in the service chain, forming a hybrid virtual and real service chain that achieves the corresponding security protection effect, simple operation, and high flexibility.

[0038] This invention proposes a unified scheduling method for virtual network elements and physical devices. This innovative approach addresses the issue of inability to coordinate and schedule virtual network elements and physical devices in a unified manner. Compared to traditional orchestration technologies that can only orchestrate virtual network elements or physical devices individually, this method abstracts both virtual network elements and physical devices into a new security service object, allowing users to ignore the two device forms and focus solely on their security protection capabilities. Flexible combinations are achieved through unified service chains, significantly reducing operational complexity, enabling reuse of older devices, and resolving the issue of some devices not being virtualized.

[0039] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A unified scheduling method based on virtual network elements and physical devices, characterized in that: The method includes: physical network element definition and service chain unified orchestration method; Definition of physical network elements: Networks are defined as four categories: internal management network, service network, service chain tandem network, and service chain bypass network. Interfaces are also divided into four categories: internal management interface, service network interface, tandem interface, and bypass interface. Physical network elements are only concerned with networks and interfaces for tandem or bypass services. Unified service chain orchestration method: Based on the differences between virtual and physical network elements, the two objects are abstracted and their attributes are extracted to form a new common network element object. For service chain functions, this new network element object is orchestrated, and the previous virtual and physical network element objects are no longer used. No distinction is made between virtual and physical network elements being orchestrated. When distributing traffic, only the serial or bypass interfaces of the network element objects are considered. in, When the service chain is orchestrated in a unified manner, the virtual network element includes not only some of its own characteristics but also network-related attributes. Network-related attributes include the internal management network, service network, serial network, bypass network, and the corresponding network interface information. In addition to its own characteristics, the physical network element also includes network-related attributes. The network-related attributes only include the serial network, bypass network, and the corresponding interface information of the corresponding network. Both virtual network element objects and physical network element objects are eventually converted into new network element objects. The object extracts the attributes of the intersection and refines the four types of networks and the corresponding four types of interfaces to form independent interface objects. After the service chain references the new network element object, the compatibility of virtual and physical network elements has been completed. In subsequent use, there is no need to consider the relevant differences. You only need to define the required virtual network elements and physical network elements and directly reference them in the service chain to form a mixed virtual and real service chain.

2. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: The internal management network is a network used for internal management and is not externally perceived. It is used to manage VNFs, including password-free jumps, VNF configuration initialization, and centralized management. This network is required for virtual network elements but not for physical network elements.

3. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: The service network is connected to the user's network service network and is used to proactively provide security services based on a three-layer network. This network is mandatory for virtual network elements (VNEs) but not for physical network elements. Multiple VNEs can exist, and each service network has an interface connected to it within the VNF.

4. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: The service chain serial network is used to orchestrate network elements and form a logical serial network. The reason why the service chain does not require routing for serial connection is that multiple VNFs are connected in series through a two-layer access method. This network is selected based on the use of the network elements. Network elements that require security protection in the serial chain need to be configured.

5. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Service chain bypass network: The service chain bypass network is specifically used for traffic mirroring, which is used to copy the specified traffic and distribute it to the bypass audit, analysis, and statistics network elements in the adjacent chains in the service chain; This network is also selected based on how the network elements are used. The network elements that need to perform statistical analysis on the bypass chain need to be configured.

6. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, wherein: Internal management interface: An internal management network is mandatory for virtual network elements (NEs). Therefore, there must be an internal management interface within the VNF. By default, it is the first interface, in DHCP mode. After startup, it automatically obtains an internal network IP address. This IP address is used for password-free redirection and REST API configuration delivery. However, it is not required for physical NEs.

7. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Service network interface: Since a service network is mandatory for virtual network elements and there must be at least one, there is an interface for each service network in the VNF. Service-oriented VNFs provide relevant security protection through this interface, and physical network elements do not need it.

8. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, characterized in that: Serial interface: If you want to orchestrate a network element into the serial chain of a service chain, you need to select the serial network when creating or defining the network element. A pair of interfaces will correspond to the virtual network element, while the physical network element needs to select a pair of interfaces on the physical device as the serial interface. This pair of interfaces is required to be included in the bridge for Layer 2 transmission, with one interface in and one interface out. The service chain orchestration engine will send the specified traffic to the serial interface of the corresponding network element in sequence according to the diversion strategy and service chain strategy. The traffic received from the serial interface will find the next network element according to the service chain strategy and repeat the above actions until the traffic is processed by the last network element in the serial chain of the service chain and then forwarded.

9. The method for unified scheduling based on virtual network elements and physical devices according to claim 1, wherein: Bypass interface: If you want to orchestrate a VNF into a bypass chain within a service chain, you must select a bypass network when creating or defining a network element. A corresponding interface will appear within the VNF, and the physical network element must select an interface on the physical device as the bypass interface. This interface must be set to bypass mode to receive and process mirrored traffic. The service chain orchestration engine will copy the specified traffic according to the traffic diversion strategy and service chain strategy, and send it to the bypass interface of each network element in the bypass chain.

Images