Hybrid Container and VM Network Function Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network automation frameworks, such as ONAP, face challenges in efficiently deploying and managing network functions due to the resource-intensive nature of virtual machines, which can compromise performance and security when used for network components.
Innovation Solution
Implementing a hybrid approach where network components are constructed as both container-based and virtual machine-based network functions, leveraging the orchestrator to parse design templates and manage lifecycle processes, allowing for improved performance without compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used for network functions, then program isolation and security are improved, but resource consumption (storage and memory) increases
Solution Approach 1:
The patent segments network functions into two categories: security-critical functions deployed as virtual machines with strong isolation, and non-security-critical functions deployed as containers with shared resources. This segmentation allows the system to apply different virtualization strategies based on functional requirements, reducing overall resource consumption while maintaining necessary security isolation.
Solution Approach 2:
The patent applies different virtualization qualities to different parts of the network function architecture. Virtual machines provide strong isolation for functions requiring security, while containers provide lightweight execution for functions where resource efficiency is prioritized. This local differentiation of virtualization quality resolves the contradiction by matching isolation strength to actual security needs rather than applying uniform virtualization.
2Reliability
If virtual machines are used for network functions, then program isolation is improved, but startup time increases
Solution Approach 1:
The patent segments network functions based on their isolation requirements and deployment characteristics. Functions requiring fast startup are deployed as containers that share the host operating system kernel, eliminating the need for full OS booting. Functions requiring strong isolation are deployed as virtual machines. This segmentation allows the system to achieve fast startup times for appropriate functions without compromising isolation where needed.
Solution Approach 2:
The patent applies different virtualization qualities to different functions based on their specific requirements. Containers provide rapid startup for non-security-critical functions by sharing the host OS, while virtual machines provide strong isolation for security-critical functions. This local differentiation resolves the contradiction by matching virtualization type to functional requirements.
3Reliability
If virtual machines are used for network functions, then security is improved, but latency increases
Solution Approach 1:
The patent segments network functions into security-critical and non-security-critical categories, deploying appropriate virtualization types for each. Container-based functions provide low latency for time-sensitive operations, while virtual machine-based functions provide strong security isolation for critical functions. This segmentation allows the system to optimize latency for functions where it matters most without compromising security where it is most needed.
Solution Approach 2:
The patent applies different virtualization qualities locally based on functional requirements. Containers provide lightweight execution with minimal latency overhead for non-security-critical functions, while virtual machines provide strong isolation for security-critical functions. This local differentiation of virtualization quality resolves the contradiction by matching virtualization type to the specific security and performance requirements of each function.
Data Source
AI summary
Network devices may be configured to execute computer-executable instructions to instantiate a deployable unit based on the instructions. The instructions may include a virtual network function (VNF) template that includes: a virtualized deployment unit (VDU) template that describes the deployable unit that includes containers; and a connection point template bound to the VDU template. The deployable unit may provide services of a network function in an access network or a core network. The deployable unit may include an interface defined by the connection point template.