Patent Application
20230038620
The present application claims priority to a K.R. application 10-2021-0103448, filed Aug. 5, 2021, the entire contents of which are incorporated herein for all purposes by this reference.
The present disclosure relates to virtualization technology and, more particularly, to technology for configuring and setting a virtual network.
Recently, software-defined wide-area network (SD-WAN) technology has been introduced to upgrade an enterprise network. SD-WAN enables safe and intelligent transmission of traffic between edge nodes located at the end of a WAN section by applying a centralized control function. This improves application performance and provides a high-quality user experience, thereby increasing business productivity and agility and reducing network construction cost.
The edge node of a conventional SD-WAN is located at an entry point of an enterprise network to configure a local area network (LAN) and to serve to connect LANs between headquarters and branches like a conventional virtual private network (VPN).
In general, in each edge node, a public IP is used without considering network address translation (NAT) and firewalls. Accordingly, it is impossible to apply edge nodes to an Internet router, an access point, a host device, a virtual machine (VM) or a container, which are close to an end user or service.
An object of the present disclosure is to provide a method and apparatus for realizing network virtualization by setting an edge node at a location closer to a user and service rather than a conventional network center.
An object of the present disclosure is to provide a method and apparatus for setting an edge node in an Internet router, an access point, a host device, a VM or a container close to an end user and service.
The technical problems solved by the present disclosure are not limited to the above technical problems and other technical problems which are not described herein will become apparent to those skilled in the art from the following description.
According to an embodiment of the present disclosure, a method of setting a user-defined virtual network is provided. The method includes configuring a virtual network including a controller, at least one network address translation (NAT) and at least one edge node, checking an operation type of the at least one edge node, setting a tunnel between the at least one edge node based on the operation type, and performing data transmission between the at least one edge node through the set tunnel.
The features briefly summarized above with respect to the present disclosure are merely exemplary aspects of the detailed description below of the present disclosure, and do not limit the scope of the present disclosure.
According to the present disclosure, since a “direct Tunnel” or “Detour Tunnel” can be set according to a connection condition between edge nodes and connectivity is provided based on tunneling, it is possible to realize direct communication between all services or devices respectively connected to the edge nodes.
According to the present disclosure, control messages transmitted and received between a controller and an edge and between an edge node and an edge node and IP-UDP-IP tunnel based data channels between an edge node and an edge node can support an AES encryption/decryption function and realize encryption for all application services operating in an edge node included in a corresponding virtual network.
According to the present disclosure, it is possible to set not only a gateway configuring a LAN but also an access point and end point device configuring a Wi-Fi network, that is, a host device, a virtual machine (VM) or a container, as an edge node.
According to the present disclosure, it is possible to measure and monitor quality of a control channel, system resources of an edge node and quality of a data channel between edge nodes, by connecting a central orchestrator and controller and each edge node.
Hereinafter, the embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so as to be easily implemented by those skilled in the art. However, the present disclosure may be implemented in various different forms, and is not limited to the embodiments described herein.
In describing the present disclosure, if it is determined that the detailed description of a related known function or construction renders the scope of the present disclosure unnecessarily ambiguous, the detailed description thereof will be omitted. In the drawings, parts not related to the description of the present disclosure are omitted, and similar reference numerals are attached to similar parts.
In the present disclosure, when a component is “connected”, “coupled” or “linked” to another component, it may include not only a direct connection relationship but also an indirect connection relationship in which an intervening component is present. In addition, when a component “includes” or “has” other components, it means that other components may be further included, rather than excluding other components unless otherwise stated.
In the present disclosure, components that are distinguished from each other are intended to clearly describe each feature, and do not mean that the components are necessarily separated. That is, a plurality of components may be integrated and implemented in one hardware or software unit, or one component may be distributed and implemented in a plurality of hardware or software units. Therefore, even if not stated otherwise, such embodiments in which the components are integrated or the component is distributed are also included in the scope of the present disclosure.
In the present disclosure, the components described in various embodiments do not necessarily mean essential components, and some components may be optional components. Accordingly, an embodiment consisting of a subset of components described in an embodiment is also included in the scope of the present disclosure. In addition, embodiments including other components in addition to components described in the various embodiments are included in the scope of the present disclosure.
Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings.
SD-WAN may include an orchestrator, a controller and edge nodes. The orchestrator and the controller may be located in a center or may be located in distributed branches.
The orchestrator and the controller may control the edge nodes through a “Secure Control Channel”, and the edge nodes may configure a “Secure Full Mesh Network” through a communication network such as “Broadband” or “4G LTE/5G”. The edge nodes may be located in any space requiring a network “Branch”, “Factory”, “Home” or “Office”. Since each edge node provides mutual direct communication, it is possible to minimize a backhaul to a hub or headquarter data center according to the application policy and to directly transmit and receive traffic through the “Secure Full Mesh Network”.
In addition, in the present disclosure, an IP-UDP-IP tunnel, to which “NAT Traversal” and “UDP Hole Punching” apply, is used to overcome a firewall or NAT environment, and the topology of each edge node is defined by a user to generate a virtual network and to provide encryption functions for transmitted and received control channels and data channels. In particular, the edge node may be not only a network device (router or switch) having a wired LAN but also a network device (access point) having a wireless LAN or a host, VM, container as an end point. Such a virtual network is centrally managed and includes a monitoring function to operational convenience.
In a network environment, there may be a limitation in a firewall or NAT. In general, the firewall is used to block access from an external network (e.g., the Internet) to protect a specific network, and NAT is used to use a private IP due to lack of public IP. The firewall may be installed in a network section with a different trust level to prevent traffic flowing from a network section with a low trust level to a network section with a high trust level. From the viewpoint of a network administrator, a section with high reliability may be referred to as an internal network section and a section with low reliability may be referred to as an Internet section or an external network section.
When terminals access a network, an assigned public IP or a private IP received from NAT may be used. In case of using NAT, SNAT used to solve insufficient IP or DNAT, which places a server to be operated inside a specific private network and allows access of only a specific user who knows it, is used. Such NAT enables communication, by connecting a public IP assigned from an ISP to an external network, assigning a private IP to each terminal connected to the NAT, and maintaining mapping information between the private IP/port and the IP/port of an external network. A typical example thereof includes an access point installed and used at home. NAT allows a user to simultaneously connect terminals Host-A and Host-B located in a private network thereof composed of 192.168.2.0 to an external network using 100.100.100.50 which is a public IP assigned from the ISP. To this end, when an NAT router which has received an IP packet transmitted from the terminal A and the terminal B, which have set the NAT router as a default gateway, to an external network is aware of the fact that a destination is in the external network by a routing function, the IP and port number of a transmission terminal is recorded in the mapping table. Thereafter, the IP address and port number of the transmission side of this packet are updated to 100.100.100.50 which is a public IP address and a new port number of 60000 or more (which differs between devices) and is transmitted to the ISP. The router of the ISP which has received this packet regards these packets as packets transmitted by the same terminal of 100.100.100.50 in two different processes and thus may transmit it to the other Internet without any problem. In addition, for all packets received from the ISP, since the NAT router may find and transmit the IP address and port number to the terminal by referring to the previously recorded port number and internal network address mapping table, several terminals may use a public network by sharing one IP address provided by the ISP.
Currently, as virtualization technology is developed, a degree of completion of technologies for efficiently using server resources or network resources by installing a plurality of virtual machines inside a server while a physical server is used as a virtualization server rather than being operated as one server.
A host may include hardware resources (e.g., CPU, Memory, NIC (Network Interface Card), Disk, etc.) and a hypervisor. The hardware resources may be shared among virtual machines through the hypervisor. In particular, in an embodiment of the present disclosure, a virtual NIC may be configured inside a virtual machine. The vNIC may include a bridge mode using a public IP and an NAT mode using a private IP. In the bridge mode, the vNIC may be directly accessed from outside and, in the NAT mode, vNIC may not be directly accessed from outside. This is possible because the hypervisor of the host assigns the public IP in the bridge mode and assigns the private IP in the NAT node. Accordingly, when the NAT mode is used, the host may set a port forwarding (DNAT) policy in the host and perform communication through a VM.
SD-WAN is technology for providing connectivity to an enterprise network and is used as a replacement for VPN. However, SD-WAN is configured to be located at an entry point of the enterprise network and may be network centric technology.
An embodiment of the present disclosure provides a method and apparatus capable of implementing an edge node at a location closer to a user and service in existing network-centric technology. To this end, each edge node may be configured to perform a “NAT Traversal” or “UDP Hole Punching” function to overcome limitations of the NAT and firewall.
In addition, an embodiment of the present disclosure provides a method and apparatus for enabling a user to define a virtual network and setting a topology of an edge node in connection with a central orchestrator, a controller and an edge node.
In particular, in an embodiment of the present disclosure, it is possible to set not only a gateway configuring a LAN but also an access point or an end point configuring a Wi-Fi network, such as a host, VM, container, etc., as an edge node.
In addition, in an embodiment of the present disclosure, it is possible to measure and monitor quality of a control channel and to measure and monitor quality of a data channel between edge nodes, by connecting a central orchestrator and controller and an edge node.
Referring to
The orchestrator may include a UI/UX management unit for managing a user interface for user registration or deletion, virtual network registration or deletion or edge node registration or deletion. The user interface for user registration or deletion, virtual network registration or deletion or edge node registration or deletion provided by the UI/UX management unit will be described in detail with reference to the following drawings. Furthermore, the user may use the user interface provided by the UI/UX management unit and register an edge node in a virtual network, and, based on this, the orchestrator may establish a virtual network, such as “VNET-GREEN”, “VNET-BLUE” or “VNET-RED”, including the registered edge node.
In addition, the orchestrator may include a controller which performs a “NAT/Traversal” function in connection with an edge node and distributes information on other edge nodes in the virtual network.
The edge node may include a gateway node functioning as a gateway of a wired/wireless LAN environment, a router node functioning as an Internet router, an AP node functioning as an access point, a VM node functioning as a VM and a container node functioning as a container.
The edge node may establish an IP-UDP-IP tunnel to the corresponding edge node, by performing a “UDP Hole Punching” function based on “NAT Traversal” information of another edge node. In this case, the IP-UDP-IP tunnel may be set as a “Direct Tunnel” or “Detour Tunnel”. A connection method of the “Direct Tunnel” and “Detour Tunnel” will be described with reference to
Referring to
The edge node may include an Internet router which is located at an entry point of an enterprise or located in an office or home. The edge node performs a “NAT Traversal” with the controller and performs a “UDP Hole Punching” with the edge node to set a “Direct Tunnel” or “Detour Tunnel”. In addition, after a plurality of LAN interfaces is connected to a bridge, a DHCP service function may be added to the bridge and an IP automatic assignment function may be performed with respect to the connected terminal. The edge node may generate a TNI and bridge interface as a virtual interface based on a virtual IP block assigned from the controller and connect the plurality of LAN interfaces to the bridge interface.
Referring to
The edge node may include an access point located in an office or home. The edge node may perform “NAT Traversal” function, a “UDP Hole Punching” function, and a “DHCP” process, and may additionally perform functions such as radio signal transmission and authentication. The edge node may generate TNI and bridge interfaces as a virtual interface based on a virtual IP block assigned from the controller and connect the wireless LAN interface to the bridge interface.
Referring to
The edge node may perform a “NAT Traversal” function and a “UDP Hole Punching” function, and generate TNI as a virtual interface based on a virtual IP assigned from the controller. In addition, the edge node may perform communication with another edge node through the TNI.
A method of performing communication by the edge node through the TNI will be described in detail with reference to
Referring to
Specifically,
The tunneling packet may include an outer IP header, an outer UDP header, a tunnel header, an inner IP header, and a data field. Here, the outer IP Header and the outer UDP Header include information on a source IP and a source port determined by “NAT Traversal”. The inner IP header may include information on a virtual IP set by a user through a user interface and may be assigned from a controller as an edge node is connected. The tunnel header may be used as an identifier for identifying a control packet and a tunnel packet. Furthermore, the tunnel header may be used as an identifier for identifying a packet, such as QoS.
Referring to
In a virtual network setting process, when edge nodes succeed in “UDP Hole Punching”, the edge nodes may perform communication by setting the “Direct Tunnel” and, in case of failure, the edge nodes may perform communication by setting the “Detour Tunnel”.
First, a controller and an edge node exchange control messages, extract IP information and port information converted by NAT, and distribute them (IP information and port information) to the edge node of the virtual network. Hereinafter, this operation is referred to as “NAT Traversal operation”.
In NAT Traversal operation, when a public network and a firewall are connected, IP information is not changed. For example, as shown in
The NAT Traversal information managed by the controller may include information on a TNI, a local IP, a local port, a public IP, a public port, a connection type and an operation type. Here, the local IP information and port information may mean IP information and port information set in the WAN interface of the edge node, and the public IP information and port information means source IP information and port information of an IP header in terms of the controller. Accordingly, the edge node connected to the NAT may change local IP information and port information and public IP information and port. The connection type indicates a connection type between the edge node and the network and may be set to “Public” or “NAT”. The operation type may represent a type of connectivity of the connected network and may include “Open” and “Restrict”.
Furthermore, the controller may determine the operation type according to success or failure of “UDP Hole Punching”. For example, the controller may check success or failure of “UDP Hole Punching” through operation shown in
As described above, the controller may check NAT Traversal information of a first edge node and a second edge node and respectively provide them to the first edge node and the second edge node. In response thereto, the first edge node may store and manage NAT Traversal information shown in
Referring to
When the controller configures and transmits the control message using the above-described method, it is possible to check the operation type (“Open” or “Restrict”) by relatively simple operation, without the need to perform a complicated STUN process.
For example, referring to
The first edge node is connected through the first NAT of “Restrict” type and thus cannot perform direct communication, and the second edge node is connected through the second NAT, but can perform direct communication because the second NAT is of an open type. In connection of the edge node, when one edge node is of “Open” type, direct communication is possible through “UDP Hole Punching”. Accordingly, the edge node may set the “Direct Tunnel” using operation type information.
In
UDP hole Punching operation may be performed after the above-described operation type checking operation of 14 is completed. In an embodiment of the present disclosure, it is assumed that the first NAT is of “Restrict” operation type and the second NAT is of “Open” operation type.
The first edge node and the second edge node may include and manage operation type information in NAT Traversal information.
The edge node (e.g., the first edge node) set to a “Restrict” type may check operation type information of a counterpart edge node (e.g., the second edge node), and transmit a Udp Hole Punching message to the edge node (e.g., the second edge node) when the operation type of the counterpart edge node (e.g., the second edge node) is “Open”. In this case, the Udp Hole Punching message may include an IP header, and the first edge node may perform transmission and reception by setting a Destination IP and Port of the IP header to a Public IP and Port by NAT Traversal. The packet of the “Udp Hole Punching message” transmitted by the first edge node is transmitted to the first NAT of the “Restrict” operation type and the first NAT changes and transmits a Public Port value. Since the second NAT is of an “Open” operation type, the packet may be transmitted to the second edge node. The second edge node may change the Source IP and Source Port of the “Udp Hole Punching message” to a Destination IP and Destination Port and transmit them to the first edge node. Thereafter, the second edge node may periodically transmit and receive the message using the changed IP and Port value as a destination. Through this operation, when “UDP Hole Punching” setting succeeds, the second edge node may set a “Direct” tunnel with the changed IP and Port as a destination and configure a communication channel between the virtual IP “10.1.1.10” of the first edge node and the virtual IP “10.1.1.20” of the second edge node.
Referring to
The first edge node transmits and receives a message to the DTR through the first NAT, and the second edge node transmits and receives a message to the DTR through the second NAT. In this case, the first edge node may store and manage a first tunnel table shown in
Meanwhile, the DTR may set tunnel information using the changed Public IP and Port based on the edge nodes and NAT Traversal information. Thereafter, the first edge node and the second edge node may perform communication through the DTR. In this case, the DTR may store and manage a DTR tunnel table shown in
For example, “10.0.0.0/8” is assigned when “USER-1” is registered, and “USER-1” assigns “10.1.0.0/16” when a virtual network “VNET-BLUE” is registered and registers “10.1.1.1/24” when “EDGE-1” is registered in “VNET-BLUE”. It is assumed that a virtual IP block assigned to a virtual network is assigned as “10.1.0.0/16 to 10.254.0.0/16”, and a virtual IP block assigned to an edge node may be assigned as “10.1.1.0/24 to 10.1.254.0/24”. Accordingly, virtual IPs of “10.1.1.2 to 10.1.1.254” may be assigned to network devices accessing “EDGE-1”. An edge node without a LAN, that is, an edge node operating as an End Point, may be assigned a Full Mask like “10.2.1.1/32” as in EDGE-1 of “VNET-RED”. A method of registering a new user “USER-2” and assigning it to a virtual network and edge node is equally applicable.
Although, in an embodiment of the present disclosure, a method of assigning a virtual IP address block is shown, the present disclosure is not limited thereto and the method of assigning the virtual IP address block may be variously changed according to individual policies.
Referring to
The orchestrator may perform user registration, virtual network registration, edge node registration, etc. and provide and store, to and in a DB, information input for user registration, virtual network registration, edge node registration, etc. For example, the orchestrator may provide user interfaces shown in
In addition, the orchestrator may transmit the information input for user registration, virtual network registration, edge node registration, etc. to the controller using “REST API”.
The controller manages information on the edge node received from the orchestrator, performs a “NAT Traversal” function with each edge node, and distributes information on each edge node included in a virtual network. Each edge node may store and manage IP information of the controller, Port information and setting values such as “Key” and “IV” values for encryption as information necessary for operation.
Since the edge node may be connected to a public network, a firewall, NAT, etc., the edge node may perform the “NAT Traversal” function through transmission and reception of messages to and from the controller and receive information on other edge nodes participating in the virtual network from the controller. When the operation type between edge nodes is “Open”, the edge node performs “UDP Hole Punching” operation to set the “Direct Tunnel”. In this case, when setting of “Direct Tunnel” fails in “UDP Hole Punching” operation, the edge node sets the “Detour Tunnel” using “DTR”. The set IP-UDP-IP tunnel performs Encryption and Decryption functions, to which “AES 256” encryption applies, in the Encapsulation and Decapsulation process and provides the encryption function of a data channel.
The edge node periodically transmits system resource information such as traffic, CPU or memory and RTT information between edge nodes. The controller may reflect it to the orchestrator and the DB through “REST API”. In addition, the orchestrator may visualize and provide system resource information such as traffic, CPU or memory.
For example, the controller may configure a topology based on the RTT value between the edge nodes received from the edge node and provide it to the orchestrator and the DB through the REST API. Therefore, the orchestrator may provide information on the edge node, information on the topology and network quality information. For example, the orchestrator may provide the information on the edge node as shown in
An IP-UDP-IP tunnel used in an embodiment of the present disclosure may support encryption. A key and IV used for encryption may be set when a user creates a virtual network, and copy and use this value in setting information necessary when each edge node is connected to the virtual network. A datagram of a packet input to an edge node is subjected to AES 246 encryption using the key and IV value predefined in an S/W module as parameters, a tunnel table is searched and an outer header and a UDP header are encapsulated to transmit a packet to a WAN section. An edge node which receives the encrypted packet decapsulates the outer header, decrypts the encrypted datagram and transmits it to a destination. A reverse packet thereof is subjected to the same procedure to provide an encrypted tunneling function.
By applying an encryption function to tunneling, it is possible to provide a security networking function between edge nodes. Referring to
In addition, this is applicable to various areas through an encryption tunnel based virtual network structure. For example, referring to
A virtual network setting method according to an embodiment of the present disclosure may be performed by a computing system.
The computing system may include at least one processor, memory, user interface input device, user interface output device, storage and network interface connected through a bus.
The processor may be a central processing unit (CPU) or a semiconductor device for processing instructions stored in a memory and/or a storage. The memory and the storage may include various types of volatile or non-volatile storage mediums. For example, the memory may include a read only memory (ROM) and a random access memory (RAM).
Accordingly, steps of a method or algorithm described in connection with the embodiments of the present disclosure may be directly implemented by hardware executed by the processor, a software module or a combination thereof. The software module may reside in a storage medium (that is, a memory and/or a storage) such as a RAM, a flash memory, a ROM, an EPROM, an EEPROM, a register, a hard disk, a removable disk, a CD-ROM. An exemplary storage medium is coupled to the processor, and the processor may read information from the storage medium and write information in the storage medium. As another method, the storage medium may be integral with the processor. The processor and the storage medium may reside in an application specific integrated circuit (ASIC). The ASIC may reside in a user terminal. As another method, the processor and the storage medium may reside in a user terminal as an individual component.
While the exemplary methods of the present disclosure described above are represented as a series of operations for clarity of description, it is not intended to limit the order in which the steps are performed, and the steps may be performed simultaneously or in different order as necessary. In order to implement the method according to the present disclosure, the described steps may further include other steps, may include remaining steps except for some of the steps, or may include other additional steps except for some of the steps.
The various embodiments of the present disclosure are not a list of all possible combinations and are intended to describe representative aspects of the present disclosure, and the matters described in the various embodiments may be applied independently or in combination of two or more.
In addition, various embodiments of the present disclosure may be implemented in hardware, firmware, software, or a combination thereof. In the case of implementing the present invention by hardware, the present disclosure can be implemented with application specific integrated circuits (ASICs), Digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), general processors, controllers, microcontrollers, microprocessors, etc.
The scope of the disclosure includes software or machine-executable commands (e.g., an operating system, an application, firmware, a program, etc.) for enabling operations according to the methods of various embodiments to be executed on an apparatus or a computer, a non-transitory computer-readable medium having such software or commands stored thereon and executable on the apparatus or the computer.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10-2021-0103448 | Aug 2021 | KR | national |
