Proxy Virtual Network Function Script Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Network Functions Virtualization (NFV) environments, testing and characterizing Virtual Network Functions (VNFs) from outside their security zone is cumbersome and time-consuming due to the complexity of security zones and the need for cryptographic key exchanges, especially when using Virtual Private Networks (VPNs) or jump servers, which introduce security risks and coordination challenges.
Innovation Solution
A method and system for proxy scripting in NFV environments, where scripting instructions are sent from a virtual server to a proxy virtual network function, which opens a remote command execution session with the target VNF and executes the script, allowing secure and efficient interaction without direct access to the VNF's security zone, using protocols like SSH for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct access methods (VPN or jump server) are used to execute scripts on VNF from outside security zone, then script execution capability is achieved, but security complexity and operational burden increase significantly
Solution Approach 1:
The patent introduces a gateway function as an intermediary component that bridges the unsecured network and secured network zones. The gateway receives scripting instructions from external virtual servers, establishes secure sessions with target VNFs within the secured zone, and forwards execution requests. This intermediary approach eliminates the need for direct external access to VNFs, reducing security complexity while maintaining script execution capability.
2Reliability
If cryptographic key exchange and secure session establishment are required for external VNF access, then security is maintained, but time consumption and operational burden increase
Solution Approach 1:
The gateway function performs preliminary security setup by pre-establishing secure communication channels and session templates for accessing VNFs in the secured zone. When external script execution is requested, the gateway can quickly instantiate pre-configured secure sessions rather than performing full cryptographic key exchanges from scratch. This preliminary preparation significantly reduces setup time while maintaining security requirements.
3Reliability
If multiple security zones with distinct security policies are implemented, then security assurance is improved, but coordination complexity for external testing increases
Solution Approach 1:
The gateway function is designed as a universal access point that handles multiple security zones and policies through a single interface. It can authenticate and manage secure sessions to different VNFs across various security zones using standardized procedures. This multi-functional design simplifies coordination for external testing, as users interact with a single gateway rather than managing multiple security zone configurations directly.
Data Source
AI summary
A method and system for proxy scripting in a network functions virtualization environment is disclosed. The method comprises the step of sending scripting instructions from a server to a proxy virtual network function, the scripting instructions being indicative of a script to be executed on a target virtual network function. Then, in response to receiving the scripting instructions by the proxy virtual network function, opening a remote command execution session from the proxy virtual network function to the target virtual network function. Then, the method further includes sending the script from the proxy virtual network function to the target virtual network function, before executing the script on the target virtual network function.