![]() method for managing the thread of services on network equipment, and corresponding network equipment
专利摘要:
method for managing the thread of services on network equipment, and corresponding network equipment. it is a network equipment (100) comprising at least one access point interface (103) and configured to operate a plurality of network functions (107), said network equipment (100) being configured to be in communicating with at least one terminal (106) belonging to a network (105), wherein the network equipment (100) comprises at least one classifier (108a) configured to modify a data frame from said one terminal (106) and is received by the lit-point interface (103) by replacing a data frame address with processing information. 公开号:BR102017027297A2 申请号:R102017027297 申请日:2017-12-18 公开日:2018-10-30 发明作者:Bichot Guillaume;Onno Stephane;Legallais Yvon 申请人:Thomson Licensing; IPC主号:
专利说明:
(54) Title: METHOD FOR MANAGING THE CHAINING OF SERVICES IN A NETWORK EQUIPMENT, AND CORRESPONDING NETWORK EQUIPMENT (51) Int. Cl .: H04L 29/12; H04L 29/08 (30) Unionist Priority: 12/20/2016 EP 16306734.1 (73) Holder (s): THOMSON LICENSING (72) Inventor (s): GUILLAUME BICHOT; YVON LEGALLAIS; STEPHANE ONNO (85) National Phase Start Date: 12/18/2017 (57) Abstract: METHOD TO MANAGE THE CHAIN OF SERVICES IN A NETWORK EQUIPMENT, AND CORRESPONDING NETWORK EQUIPMENT. It is a network equipment (100) comprising at least one access point interface (103) and configured to operate a plurality of network functions (107), said network equipment (100) being configured to be in network. communication with at least one terminal (106) belonging to a network (105), wherein the network equipment (100) comprises at least one classifier (108A) configured to modify a data frame, from said one terminal (106) and received by the access point interface (103), by replacing a data frame address with processing information. 300 1/28 “METHOD FOR MANAGING THE CHAINING OF SERVICES IN A NETWORK EQUIPMENT, AND CORRESPONDING NETWORK EQUIPMENT” TECHNICAL FIELD [001] The present disclosure refers, in general, to network virtualization, and more particularly, to network virtualization services and functions associated with commodity cloud computing hardware. BACKGROUND OF THE INVENTION [002] This section aims to introduce the reader to various aspects of the technique, which may be related to various aspects of the present disclosure described and / or claimed below. This discussion is believed to be of great help in providing the reader with background information, helping him to better understand the various aspects of this revelation. Therefore, it must be understood that these statements must be read in the light of what has been said, and not as admissions of the prior art. [003] A residential or corporate network interconnection device (gateway) is network equipment that interfaces a LAN (Local Area Network) to the Internet. Such equipment can usually provide - in addition to being a cable, DSL (Digital Subscriber Line) or fiber modem - different features, such as routing, DNS proxy (Domain Name System), local DHCP server (Dynamic Host Configuration Protocol) ), wired access point, firewall, DynDNS, bridge, etc. [004] The development of cloud technologies (such as the virtualization of network functions) allows the emergence of a new architecture for Internet access, in which the services running at the residential gateway are moved in the NSP data center (Internet Service Provider). Network Services). By reducing the complexity of the residential gateway, NSPs hope to reduce time to market Petition 870170098958, of 12/18/2017, p. 10/74 2/28 to implement new services and facilitate troubleshooting operations. [005] Network Function Virtualization (NFV) allows the provision of network functions for residential or corporate gateways directly from the NSP installation in the form of cloud services. Residential Virtualized Client Equipment (vCPE) is part of the so-called Network Function Virtualization paradigm that concerns the execution of network functions (for example, Router, Deep Packet Inspection, DNS server, Firewall) on commoditized hardware hosting a virtual machine infrastructure (for example, public or private cloud infrastructure). To that end, the residential gateway acts as a bridge (BRG) and needs to connect to a virtual gateway (vG) in the cloud to reach hosts where network functions are provisioned and executed, even for basic functions, such as DHCP, Firewall, DNA and UI (User Interface). [006] A vCPE infrastructure is based on an NFV infrastructure in which the network functions are instances operating in a cloud infrastructure and interconnected through service paths. Within the vCPE infrastructure, several service paths can co-exist, depending on the subscriber / customer plan. Therefore, packets (for example, IP packets) corresponding to subscriber flows (such as TCP / UDP flows) - once they have reached the vCPE infrastructure - can be processed by a chain of network functions, depending on the description of the service. associated. [007] There is a need for a mechanism to establish such a chain of network functions (the so-called chain of services) in which packets, regardless of their destination, must be forwarded along their service path (crossing a set of functions network implementing a given processing). SUMMARY [008] The disclosure concerns a method to be implemented in a team 870170098958, of 12/18/2017, p. 11/74 3/28 network device comprising at least one access point interface and configured to operate a plurality of network functions, said network equipment being configured to be in communication with at least one terminal belonging to a network, [009] wherein said method comprises: [010] - receiving, through the access point interface, a data frame from said terminal; [011] - modify said data frame by replacing a data frame address with processing information. [012] Thus, the aforementioned method may allow establishing the chaining of network functions to forward data packets, received on a network equipment, along its associated service path, crossing a set of network functions, without creating a additional header to incorporate service chaining information. [013] In one embodiment, said method may comprise forwarding, based on said processing information, the modified data frame to a network function for processing. [014] In one embodiment, said processing information can comprise at least the following parameters: [015] - service path identifier, [016] - service index, [017] - customer identifier. [018] In one embodiment, said processing information may additionally comprise at least one of the following parameters: [019] - direction information, [020] - a context field. [021] In one embodiment, said method may comprise updating Item 870170098958, of 12/18/2017, p. 12/74 4/28 service index of the modified data frame after processing by a network function. [022] In one embodiment, the replaced address can correspond to either a data frame destination address or a data frame source address. [023] In one embodiment, said method may additionally comprise, before addressing a network function and when the substituted address is a destination address of the data frame: [024] - replace said data frame processing information with a destination address of said network function to be addressed; and [025] - replace a data frame source address with said processing information. [026] In this embodiment, the network function may be executing mode 1 of operation. [027] In one embodiment, said method may comprise storing, by a last network function in a chain of network functions, at least session information in a query table with the source address of said a terminal that generated the data frame. [028] In one embodiment, the destination address or the source address can be located in a header of the data frame. [029] In one embodiment, the destination address or the source address can be a MAC address of an Ethernet frame. [030] In the example of the Ethernet data frame, the 48 bits of a destination MAC address (or source MAC address) can be used to carry the service chaining information according to the following allocation: [031] - 8 bits for the SPI service path identifier (representing 256 different service paths); Petition 870170098958, of 12/18/2017, p. 13/74 5/28 [032] - bits for the SI service index (corresponding to 128 functions to be traversed); [033] - 24 bits for tenant identifier (tenant) CID (so that more than 16 million subscribers can be managed by the multi-tenant virtual network function (multi-tenants)); [034] - 1 bit for the direction indication. [035] In one embodiment, the device and the network equipment can be interconnected through a tunneling protocol. [036] The present principles also concern a network equipment comprising at least one access point interface and configured to operate a plurality of network functions, said network equipment being configured to be in communication with at least one terminal belonging to a network, [037] in which the network equipment comprises at least one memory and at least one set of processing circuits configured to modify a data frame, from said terminal and received by the access point interface, by replacing a data frame address with processing information. [038] In addition, the present principles additionally concern network equipment comprising at least one access point interface and configured to operate a plurality of network functions, said network equipment being configured to be in communication with at least at least one terminal belonging to a network, [039] in which the network equipment comprises at least one classifier configured to modify a data frame, from said terminal and received by the access point interface, by replacing an address of the data frame by processing information. Petition 870170098958, of 12/18/2017, p. 14/74 6/28 [040] In one embodiment, said processing information can comprise at least the following parameters: [041] - service path identifier, [042] - service index, [043] - customer identifier. [044] In one embodiment, a network function can be configured to update the service index of the modified data frame after processing. [045] In one embodiment, the replaced address can correspond to either a data frame destination address or a data frame source address. [046] In one embodiment, said network equipment may additionally comprise at least one router configured to forward the modified data frame to a network function for processing, based on its processing information. [047] In one embodiment, the router can be additionally configured to, before addressing a network function and when the substituted address is a data frame destination address: [048] - replace said data frame processing information with a destination address of the network function to be addressed; and [049] - replace a data frame source address with said processing information. [050] In this embodiment, the network function may be executing mode 1 of operation. [051] In one embodiment, the last network function in a chain of network functions can be configured to store at least session information in a lookup table with the source address of said terminal that generated the data frame. Petition 870170098958, of 12/18/2017, p. 15/74 7/28 [052] In one embodiment, the destination address can be a MAC address of an Ethernet frame. [053] In one embodiment, said network equipment can be adapted to be interconnected to the device through a tunneling protocol. [054] In addition, the present disclosure is additionally directed to a non-temporary program storage device, readable by a computer, tangibly incorporating a program of instructions executable by the computer to carry out a method on a network equipment comprising at least one access point interface and configured to operate a plurality of network functions, said network equipment being configured to be in communication with at least one terminal belonging to the network, [055] wherein said method comprises: [056] - receiving, through the access point interface, a data frame from said terminal; [057] - modify said data frame by replacing a data frame address with processing information. [058] The present disclosure also relates to a computer program product stored in a non-temporary computer-readable medium and comprising program code instructions executable by a processor to implement a method on network equipment comprising at least one access point interface and configured to operate a plurality of network functions, said network equipment being configured to be in communication with at least one device connected to a network, said at least one device being in communication with at least one terminal belonging to the network, [059] where said method comprises: [060] - receive, through the access point interface, a data frame proPetição 870170098958, of 12/18/2017, p. 16/74 8/28 coming from said a terminal; [061] - modify said data frame by replacing a data frame address with processing information. [062] The method according to the disclosure can be implemented in software or in a programmable device. It can be implemented only in hardware or in software, or in a combination of them. [063] Some processes implemented by the elements of the present invention can be implemented by computer. Therefore, such elements can take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining aspects of software and hardware, all of which can be called general form here of "circuit", "module" or "system". In addition, such elements may take the form of a computer program product embedded in any tangible expression medium containing program code usable by a computer incorporated in the medium. [064] Since the elements of the present disclosure can be implemented in software, the present disclosure can be incorporated as computer-readable code to provide a programmable device in any suitable carrier medium. A tangible carrier medium may comprise a storage medium, such as a floppy disk, a CD-ROM, a hard disk drive, a magnetic tape device or a solid state memory device, among others. [065] The disclosure thus provides a computer-readable program comprising instructions executable by computer to allow a computer to perform the aforementioned method. [066] Certain aspects according to the revealed embodiments are presented below. It should be understood that these aspects are presented to mePetition 870170098958, of 12/18/2017, p. 17/74 9/28 to provide the reader with a brief summary of certain forms that the revelation could take and that these aspects are not intended to limit the scope of the revelation. In fact, the disclosure may cover a variety of aspects that may not be presented below. BRIEF DESCRIPTION OF THE DRAWINGS [067] The disclosure will be better understood and illustrated by means of the following embodiment and examples of execution, in no way limiting, with reference to the attached figures, in which: [068] - Figure 1 is a schematic diagram of an example of a network infrastructure adapted to implement some embodiments of the present principles; [069] - Figure 2 is a flowchart of an illustrative method to manage the chaining of services in a network equipment, according to the present principles; [070] - Figure 3 shows a schematic diagram of an implementation of network equipment, in accordance with the present principles; [071] - Figure 4 shows an example of a hardware configuration for each terminal / device / host of the network equipment in Figure 1, according to the present principles. [072] Whenever possible, the same reference numerals will be used in all figures to refer to the same or similar parts. DETAILED DESCRIPTION [073] The following description illustrates the principles of the present disclosure. Therefore, it will be appreciated that those skilled in the art will be able to discover various combinations that, although not explicitly described or illustrated in this document, concretize the principles of disclosure and are included within its scope. Petition 870170098958, of 12/18/2017, p. 18/74 10/28 [074] All examples and conditional languages reported in this document are designed for educational purposes to assist the reader in understanding the principles of disclosure and the concepts contributed by the inventor to favor the technique, and must be interpreted without restrictions to such examples and conditions specifically reported. [075] In addition, all statements in this document, relating the principles, aspects and embodiments of the disclosure, as well as specific examples of it, should cover both structural and functional equivalents of the disclosure. In addition, it is intended that such equivalents include both equivalents currently known and equivalents developed in the future, that is, any developed elements that perform the same function, regardless of the structure. [076] Therefore, for example, it will be appreciated by those skilled in the art that the block diagrams presented in this document represent conceptual views of the illustrative circuit system that materializes the principles of disclosure. Similarly, it will be appreciated that any flowcharts, data flow diagrams, state transition diagrams, pseudocodes, among others, represent various processes that can be substantially represented in computer-readable media and, therefore, executed by a computer or processor , whether such a computer or processor is illustrated explicitly or not. [077] The functions of the various elements illustrated in the figures can be performed with dedicated hardware, as well as hardware capable of running software in association with appropriate software. When performed by a processor, functions can be performed by a single dedicated processor, by a single shared processor, or by multiple individual processors, some of which can be shared. In addition, the explicit use of the term processor or controller should not be interpreted as an exclusive reference to Petition 870170098958, of 12/18/2017, p. 19/74 11/28 hardware capable of running software and may implicitly include, without restriction, digital signal processor (DSP) hardware, read-only memory (ROM) for storing software, random access memory (RAM) and non-volatile storage. [078] In the claims of this document, any element expressed as a means and / or module to perform a specific function is intended to cover any form of performing that function, including, for example: a) a combination of circuit elements that perform such function or b) software in any form, including, therefore, firmwares, microcodes or the like, combined with the appropriate circuit system to execute such software to perform the function. The disclosure, as defined by such claims, consists in the fact that the functionalities offered by the various media reported are combined and united in the way that the claims prescribe. Thus, it is considered that any means capable of offering such functionalities is equivalent to those illustrated in this document. [079] Furthermore, it should be understood that the figures and descriptions of the present disclosure have been simplified to illustrate elements that are relevant to a clear understanding of the present disclosure, while eliminating, for the sake of clarity, many other elements found conventional methods, devices and systems for distributing digital multimedia content. However, given that such elements are well known in the art, a detailed discussion of such elements is not presented here. The disclosure disclosed herein is directed to all such variations and modifications known to those skilled in the art. [080] Figure 1 is a schematic diagram of an illustrative network infrastructure comprising network equipment 100, such as a virtual gateway (vG) or virtualized client residential equipment (vCPE) and local network equipment 104, such as a residential broadband gateway (BRG). Petition 870170098958, of 12/18/2017, p. 20/74 12/28 It is assumed that the functionality of the gateway is divided into two parts, interconnected through a tunnel 101, each part hosting a tunnel segment (TEP) 102, 103. This tunnel can be used to abstract from the physical network topology underlying at the same time interconnecting the residential broadband gateway (BRG) 104 (also called a bridge or switch) and the virtual gateway (vG) 100 at the link layer. [081] The left side (represented by the broadband residential gateway 104 (BRG)) can be considered, in one embodiment, as being on the client's premises, while the right side (represented by the virtual gateway 100) can be located in a data center hosted, for example, by a network operator. This data center can be distributed across multiple locations. On the virtual gateway side, network functions are being performed within virtual machines interconnected to the residential LAN abstraction, namely, a layer 2 virtual network overlay which is an extension of tunnel 101 and a residential LAN 105. [082] It should be understood that the virtual gateway can be hosted back on a physical gateway, which is the approach to enterprise vCPE. An enterprise vCPE is hosted on an on-premises device (such as one based on the X86 architecture) offering a virtualization environment equivalent to what is assumed to be present in the operator's cloud infrastructure. [083] In one embodiment, virtualized gateway functions can be shared (or mutualized), whenever possible, across a plurality of residential LANs to facilitate scheduling and maintenance. The BRG 104 can be connected to a home (or business) 105 network (for example, private network), such as a LAN (Local Area Network) or WLAN (Wireless Local Area Network). [084] The deployment of the virtual gateway can be managed by an orchestrator who coordinates the configuration of network computing from a gateway Petition 870170098958, of 12/18/2017, p. 21/74 13/28 broadband residential 104 to the data center hosting virtual gateway 100 to manage migration from the virtual gateway, network service and QoS policy addition / removal or adjustment functions. [085] As illustrated in Figure 1, virtual gateway 100 can perform network functions, such as UI (User Interface), DHCP server, DNS server, Firewall, NAT (Network Address Translation), etc. [086] For the sake of clarity and simplicity, some elements of gateway 100 are not illustrated in Figure 1. [087] In the illustrative embodiment of Figure 1, the virtual gateway 100 can be connected to one or more residential broadband gateways 104. Each BRG 104 can be connected to a local area network (LAN) 105 comprising one or more terminals 106. [088] At the entrance to the data center, a MUX multiplexing function for each virtual gateway 100 can be provided to ensure connectivity between a physical broadband residential gateway 104 and the associated virtual gateway functions. The multiplexing function can be configured by the orchestrator with the customer's settings. This function can be implemented, for example, by a programmable switch, which can also provide connectivity to the Wide Area Network (WAN) 300 and hosted cloud services. In one embodiment, it is assumed to be a large capacity switching arrangement, possibly aided by dedicated hardware. It is able to manage the tunnel termination towards each BRG 104 and can either re-encapsulate traffic towards vG peer services or tag traffic with a customer ID before passing it on to a shared service. As illustrated in the embodiment of Figure 1, the multiplexing function can implement a tunnel segment function / interface 103 (TEP) and can re-encapsulate traffic on a dedicated VxLAN (Virtual Extensible Local Area Network) for each client 104. Petition 870170098958, of 12/18/2017, p. 22/74 14/28 [089] Configuring the switching according to rules derived from specific customer preferences may allow the construction of a service chain, connecting services inputs and outputs. At a high level, traffic directed by the gateway can be switched to the appropriate network functions (DHCP, DNS, Firewall, parental control, etc.), while traffic directed by the WAN is switched towards NAT or services Firewall [090] Each BRG 104 can be built around its own switching fabric (for example, switching arrangement or configuration such as a switching matrix, which interconnects the different network ports. Each BRG 104 can implement, in particular, the logic to allow tunneling of Generic Routing Encapsulation (GRE) between BRG 104 and vG 100. GRE tunneling can be configured through an existing procedure (consecutively to a provisioning operation performed by the operator), as specified by the Broadband Forum: Once a BRG 104 is connected to the access network, after the physical connection (for example, xDSL), the BRG 104 can broadcast a DHCP request to obtain the network configuration. BRG IP address and the IP address of the GRE tunnel segment which is the IP address of the virtual machine hosting the virtual function the tunnel segment (TEP) of the virtual gateway 100. It should be noted that the tunneling can be based on protocols (such as VLAN, L2TP, VxLAN) other than GRE. [091] Once the network configuration is obtained, each BRG 104 can be configured to provide tunnel access 101 (for example, a GRE tunnel interface), while the corresponding virtual gateway 100 can be configured automatically in the infrastructure. virtual gateway host. [092] In one embodiment, the Tunnel Segment (TEP) function 103 can be configured to terminate tunneling to carry layer 2 Ethernet packets and thus extending the LAN broadcast domain to the Petition 870170098958, of 12/18/2017, p. 23/74 15/28 Data hosting the vG 100. The TEP 103 function can route the Ethernet frames through the virtual layer 2 network overlays (for example, based on the VxLAN protocol) based on different classification strategies (for example, a direct strategy with a mapping one to one between the VxLAN ID and the GRE / client tunnel ID, assuming one tunnel per client, or another strategy in which there are several tunnels / applications per client allowing one VxLAN per tunnel / application instead of one per client). The TEP 103 function is, in fact, managing the vG entry point for layer 2 packets coming from a LAN 104. Symmetrically, the TEP 103 function manages the exit point for the packet leaving towards the subscriber 105 LAN. [093] The virtual gateway service corresponds to a layer 3 (IP) gateway service. Packets from the LAN of subscriber 105 are routed to the WAN interface typically crossing a series of virtual network functions (VNF), such as firewall, NAT, QOS, DNS, Firewall, etc., according to a service path. Similar to the TEP 103 function, the NAT 107 virtual network function manages the entry point for layer 3 (ie IP) packets from the WAN 300. Symmetrically, the NAT function manages the vG exit point for outgoing packets for the WAN 300. [094] For the sake of brevity, it is assumed that the last function hosted by the vG infrastructure for all outbound service paths is the NAT 107 function. Of course, other different arrangements (such as service paths bypassing the NAT function to access operator's IP network) can be additionally covered. [095] As illustrated in the embodiment of Figure 1 and in illustrative method 400 in Figure 2, the vG 100 may additionally comprise an ingress classifier 108A configured to replace (step 402) the destination address (or origin) of each data frame - sent through a terminal 106 via a BRG Petition 870170098958, of 12/18/2017, p. 24/74 16/28 104 and received (step 401) through the TEP 103 interface - with service chaining information (also called processing information). As an illustrative but not limiting example, Ethernet data frames are considered hereinafter and their corresponding MAC address. [096] It should be understood that the ticket classifier 108A and TEP 103 can form a single entity, or, in one variant, two distinct entities, or, in another variant, the ticket classifier can be incorporated within the TEP . [097] Service thread information can comprise at least the following parameters: [098] - a service path identifier (SPI) that identifies a service chain (or path) of the network's functions among a plurality of service chains. A network function chain is an ordered list of network functions, [099] - a service index (SI) that provides the location within a service chain (namely, a network function in the service chain), [0100] - a customer (or tenant) identifier (CID) that can be used by “multitenant” (multi-tenant) functions to identify a BRG 104. [0101] It should be understood that the way in which service chains are associated by terminal can vary based on the subscription pattern. For example, a service chain can be associated with a subscriber 04 for all LAN terminals 106 for both incoming and outgoing traffic. Alternatively, a service chain may be different for some terminals 106 connected to the same LAN 105. In addition, the service chain may be different for incoming traffic and outgoing traffic related to a terminal 106 on the same LAN. VNFs can additionally be associated with different service chains associated with different customers. Petition 870170098958, of 12/18/2017, p. 25/74 17/28 [0102] Optionally, service chaining information can additionally comprise: [0103] - a direction indication used to differentiate incoming and outgoing traffic; [0104] - a context field used to exchange information between entities along the way. [0105] In the example of Ethernet data frames, the 48 bits of a destination or source MAC (Media Access Control) address can be used to carry the service chaining information according to the following allocation: [0106] - 8 bits for the SPI service path identifier (representing 256 different service paths); [0107] - 7 bits for the SI service index (corresponding to 128 functions to be traversed); [0108] - 24 bits for tenant identifier (tenant) CID (so that more than 16 million subscribers can be managed by VNF multi-tenant (multi-tenants)); [0109] - 1 bit for the direction indication; [0110] - 8 bits for the context field. [0111] Each original Ethernet frame generated by a terminal 106 belonging to a LAN 105 can incorporate the MAC address Ethernet terminal as the source MAC address, while its destination MAC address can be the default gateway (for example, both the MAC address of BRG 104 as well as the MAC address of vG 100 corresponding, for example, to the MAC address of physical host 1 or the MAC address of TEP 103, when BRG 104 behaves like a bridge). [0112] In an embodiment of the present principles, classifier 108A can be directly coupled to the TEP 103 interface in order to retrieve an identiPetition 870170098958, from 12/18/2017, p. 26/74 18/28 tunnel fication used to associate the CID client identifier. [0113] According to the present principles, the vG 100 may additionally comprise one or more SFF 109 Service Function Forwarders (for example, at least one SFF per host 200 operating VNFs). An SFF 109 can be configured to receive (step 403 in Figure 2) an Ethernet frame: [0114] - from classifier 108A once the Ethernet frame has been modified with service chaining information; [0115] - from a VNF after processing the Ethernet frame. An SFF 109 is configured to manage the Ethernet frame from a VNF; [0116] - from another SFF 109 (for example, belonging to another host 200). [0117] Each SFF 109 can be additionally configured to forward (step 405 in Figure 2) an Ethernet frame, received from classifier 108A, or from a VNF or another SFF 109, to an additional VNF according to the information of chaining of embedded services. Finally, an SFF 109 can be additionally configured to terminate a chain of network function services. [0118] Figure 3 provides an illustrative, but not limiting example, where virtual gateway 100 - implementing these principles - processes Ethernet frames from or distributed to an X1 terminal from an X 104 client and Ethernet frames from or distributed to a Y1 106 terminal of a Y 104 client (see Figure 1). For the sake of clarity, some elements of Figure 1 are not represented in Figure 3. [0119] In this example, service chaining information for an Ethernet frame from terminal X1 is defined as: [0120] - CID = 1, as Customer X's identifier; [0121] - SPI = 1, which identifies the SP1 service path (or chain of Petition 870170098958, of 12/18/2017, p. 27/74 19/28 network functions) defined by the three network functions VNF1.1, VNF2.1 and VNF2.3 (in that order); [0122] - SI = 3, initialized to 3 for the three network functions defining the SP1 service path. [0123] Service chaining information for an Ethernet frame from WAN 300 and directed to terminal X1 is defined as: [0124] - CID = 1, as Customer X's identifier; [0125] - SPI = 2, which identifies the SP2 service path defined by the VNF1.1 network function; [0126] - SI = 1, initialized to 1 for the single network function defining the SP2 service path. [0127] Service chaining information for an Ethernet frame from terminal Y1 is defined as: [0128] - CID = 2, as Customer Y's identifier; [0129] - SPI = 3, which identifies the SP3 service path defined by the two network functions VNF1.2 and VNF2.2 (in that order); [0130] - SI = 2, initialized to 2 for the two network functions defining the SP3 service path. [0131] Service chaining information for an Ethernet frame from the WAN 300 and directed to terminal Y1 is defined as: [0132] - CID = 2, as Customer Y's identifier; [0133] - SPI = 4, which identifies the SP4 service path defined by the two network functions VNF2.2 and VNF1.2 (in that order); [0134] - SI = 2, initialized to 2 for the two network functions defining the SP4 service path. [0135] When receiving an Ethernet frame from terminal X1 or Y1 after being processed by classifier 108A, a first SFF 109A transfers (step 405 in Petition 870170098958, of 12/18/2017, p. 28/74 20/28 Figure 2) the Ethernet frame for the correct VNF 110 network function according to the service chaining information contained in the destination MAC address. It should be understood that the classifier 108A and SFF 109A are configured in a coherent manner to ensure that the Ethernet frames follow the appropriate service path (SP1 for the Ethernet frames coming from terminal X1, SP3 for the Ethernet frame coming from terminal Y1 ). [0136] In the example in Figure 3, for the information of services chaining CID = 1, SPI = 1, SI = 3, the SFF 109A transfers the incoming Ethernet frame (from terminal X) to VNF1.1 In this case, the Ethernet frame forwarded by the SFF 109A can have the following format: __ MAC address of MAC address of Ethernet type Useful load Destiny Source 0x0800 ICD = 1 MAC address of SPI = 1 X1 device SI = 3 [0137] In accordance with these principles, each VNF 110 can support at least one of the following two modes of operation: [0138] - mode 1: listening on its MAC address. In Mode 1, the Ethernet-related interface associated with a VNF 110 is configured to only accept Ethernet frames having a destination MAC address corresponding to its interface configuration; [0139] - a mode 2 (standard mode): listening in promiscuous mode. In Mode 2, the Ethernet-related interface associated with a VND 110 is configured to not filter incoming Ethernet frames, and therefore accept all Ethernet frames, regardless of their destination MAC address. [0140] When an interface related to the Ethernet of a VNF 110 does not Petition 870170098958, of 12/18/2017, p. 29/74 21/28 support mode 2 (only mode 1 is available), the SFF 109A, 109B, in communication with this VNF 110 interface supporting mode 1 needs to modify (step 404 in Figure 2) the Ethernet frame header before forward the frame to that VNF 110 through the considered Ethernet interface. In particular, the SFF can replace the service chaining information located in the destination MAC address field of the Ethernet frame with the MAC address of this VNF 110 and can move the service information chaining information to the source MAC address of the Ethernet frame , so that the source MAC address of the terminal is removed from the Ethernet frame. [0141] In the example in Figure 3, for the information on service links CID = 1, SPI = 1, SI = 3, the SFF 109A transfers the incoming Ethernet frame (from terminal X) to VNF1.1 (assumed as operating in mode 1) after having modified the Ethernet frame header. In this case, the Ethernet frame forwarded by SFF 109A to the first SPN1 VNF1.1 can have the following format: MAC address MAC address of Ethernet type Useful load Destination Source 0x0800 MAC address ICD = 1 daVNF 11 SPI = 1 SI = 3 [0142] It is assumed that the VNFs 110 of the vF 100 are aware of the specific configuration (that is, mode 1 or 2) and are configured to interpret the header of the destination MAC address (respectively, the header of the source MAC address) understanding the format of the service thread information as specified above. [0143] With mode 1, a VNF 110 does not have the source MAC address Petition 870170098958, of 12/18/2017, p. 30/74 22/28 of the original terminal 106 that generated the Ethernet frame. When necessary, it can, for example, use an ARP protocol to retrieve the MAC address of said terminal 106 thanks to the source IP address present in the payload of the Ethernet frame comprising the IP packet. [0144] Thus, each VNF 110 can be configured to receive (step 406 of Figure 2) an Ethernet frame that is addressed to it (mode 1) or not (mode 2), depending on the operation mode, and to process the information service chaining. Having the CID customer identifier can allow a VNF 110 to be “multi-tenant” (multi-tenants). [0145] Once the Ethernet frame is processed, a VNF 110 can be additionally configured to send it back to SFF 109A after having updated (step 407 in Figure 2) the service chaining information (for example, decrementing it) if the SI value). The SFF 109A can receive (processed step 408 of Figure 2) the processed Ethernet frame and can adapt its packet header according to mode 2 by updating the source and destination MAC address headers when necessary (for example, when processing the VNF is in mode 1). When a VNF 110 supports mode 2, the processed Ethernet frame can be routed directly by the SFF 109A to an additional VNF 110 or to the SFF 109B. [0146] In the Example of Figure 3, after processing the Ethernet frame by VNF1.1, the SFF 109A transfers the Ethernet frame (from terminal X1) to the next VNF2.1 of the SPI1 service path after having modified the header of the Ethernet frame. In this case, the Ethernet frame sent by the SFF 109A can have the following format (the SI parameter is decremented by the VNF): _ MAC address MAC address of Ethernet type Useful load Destination Source 0x0800 Petition 870170098958, of 12/18/2017, p. 31/74 23/28 ICD = 1SPI = 1SI = 2 MAC address ofX1 device [0147] When the next SFF 109B is hosted on a separate machine (for example, host 2 of Figures 1 and 2), the two SFFs 109A and 109B can be interconnected using tunneling technology (for example, VxLAN) extending the layer 2 virtual overlay / network through physical switches and / or routers interconnecting the two hosts belonging to the vG infrastructure. Upon receiving a tunneled packet, the receiving SFF 109A, 109B can be configured to remove the header from the external packet to retrieve the internal Ethernet frame to be forwarded. [0148] It should be noted that, when receiving an Ethernet frame from a VNF operating in both mode 1 and mode 2, an SFF 109 can retain all parameters to identify the next VNF 110 or the next SFF 109, being service chaining information fully incorporated into the board. [0149] When an incoming Ethernet frame (from a terminal 106) is received by the last VNF in the service chain (which is the exit point of the vG 100 and which is presumed, in the example, to be the NAT 107 function), the latter VNF can store session information in a lookup table, such as source and destination IP addresses and source and destination TCP / UDP port numbers. In addition, the latest VNF can allocate a new source UDP / TCP port number and can translate the source IP address with a source WAN IP address. The NAT function 107 can also store the source MAC address (corresponding to the MAC address of terminal 106 that generated an Ethernet frame). [0150] As part of the incoming traffic, the Ethernet frames arriving at vG 100 from the WAN 300 and related to the same session of a previous processed Ethernet frame, a 108B egress classifier couplesPetition 870170098958, of 12/18/14 2017, p. 32/74 24/28 to the NAT 107 function (or last network function) you can modify the MAC Ethernet header of these frames from the WAN 300 according to the following process: [0151] - it replaces the source MAC address of an Ethernet frame from the WAN 300 with the MAC address of the target terminal 106 on the client LAN 105 (previously stored in the query table and retrieved from it); [0152] - it replaces the destination MAC address with the service thread information. [0153] In the example in Figure 3, for service chaining information CID = 1, SPI = 2, SI = 1, the egress classifier 108B transfers the egress Ethernet frame (from WAN 300 and directed to terminal X1) SFF 109A after having modified the Ethernet frame header. In this case, the Ethernet frame distributed by the classifier 108B to the SFF 109A can have the following format: MAC address MAC address of Ethernet type Useful load Destination Source 0x0800 ICD = 1 MAC address of SPI = 2 X1 device SI = 1 [0154] It should be understood that the egress classifier 108B and the NAT function 107 can form a single entity, or, in a variant, two distinct entities, or, in an additional variant, the NAT function can incorporate the egress classifier . It should also be noted that the inbound classifier 108A and the outbound classifier 108B can be supported, or not, by the same host 200. [0155] Once the Ethernet frame reaches the output point of the vF 100 Petition 870170098958, of 12/18/2017, p. 33/74 25/28 (ie TEP 103 when the frame comes from WAN 300), TEP 103 can be configured to: [0156] - Switch the destination MAC address and source MAC header fields of the Ethernet frame; [0157] - update the source MAC address field (which contains the service chaining information) with the virtual gateway MAC address (such as the MAC address of physical host 1 or the MAC address of TEP 103). [0158] When necessary, service chaining information can be recorded in the source address field as discussed above. An SFF 109 manages Ethernet frames in the same way, regardless of whether they come from a terminal 106 on a LAN 105 or WAN 300. [0159] In another embodiment according to the present principles, instead of replacing the destination address of a data frame with the information of services chaining in the ingress classifier or in the egress classifier, the origin address of the data frame can be replaced by said service chaining information in a similar mechanism. In other words, in this embodiment, the service chaining information is not loaded at the destination address of the header, but at the source address. The gateway or overlay can be used to distinguish packets having the service chaining information at the source MAC address from those that have it at the destination MAC address. [0160] Of course, in an additional embodiment, the ingress classifier can replace the destination address of a data frame with service chaining information, whereas the egress classifier can replace the origin address of a data frame for service chaining information, and vice versa. [0161] Thanks to the present disclosure, the chaining information of Petition 870170098958, of 12/18/2017, p. 34/74 26/28 services can be incorporated in the destination address (or source address) of the data frames without creating extra header consuming bandwidth. In addition, no adaptation is then required to support forwarding the data frame based on such an extra header. [0162] As illustrated in Figure 4 representing an example of a hardware configuration, each of the respective terminals 106, network devices 104 and hosts 200 of a vG 100 can comprise a Central Processing Unit (CPU) 500 (comprising one or more processors), a memory 501 and one or more interfaces 502, connected to each other via a bus 503. The CPU 500 is configured to process various data and to control various functions and components of each of the respective terminals 106 , network devices 104 and hosts 200. Memory 50 can represent either temporary memory, such as RAM, or non-temporary memory, such as ROM, a hard disk drive or flash memory, to process and store different files and information as needed, including computer program and software products. Some of the functions and / or applications mentioned above illustrated in Figure 1 can be implemented by computer-readable programs stored in memory 501. Interfaces 502 are used to communicate between the respective terminals 106, network devices 104 and hosts 200 through one or more wired or wireless connections. The 503 interfaces can additionally comprise user input and / or output elements (for example, a touch panel, a display screen, a keyboard, a remote control, etc.). [0163] In the Figures, it should be appreciated that the illustrated blocks or modules may correspond to functional modules, which may or may not correspond to distinguishable physical units. For example, a plurality of such modules can be associated in a single component or circuit, or correspond to functionalities Petition 870170098958, of 12/18/2017, p. 35/74 27/28 of software. In addition, a module can potentially be made up of separate physical entities or software functionality. [0164] The references disclosed in the description, claims and drawings could be presented independently or in any appropriate combination. Aspects can, as appropriate, be implemented in hardware, software or a combination of both. [0165] Any reference made here to an embodiment means that a specific aspect, structure or feature described in connection with the embodiment can be included in at least one implementation of the described method and device. The occurrences of the expression in one embodiment in different parts of the report do not necessarily refer to the same embodiment, and the separate embodiments are not necessarily mutually exclusive alternatives to the other embodiments. [0166] The reference numerals presented in the claims are only illustrative, and therefore have no limiting effect on the scope of the claims. [0167] Although certain embodiments of the disclosure alone have been described here, any person skilled in the art may understand that other modifications, variations and possibilities of the disclosure are possible. Such modifications, variations and possibilities, therefore, should be considered to be within the spirit and scope of the disclosure, and therefore constitute part of the disclosure as described and / or exemplified herein. [0168] The flowchart and / or block diagrams in the Figures illustrate the configuration, operation and functionality of possible implementations of computer program systems, methods and products in accordance with various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams can represent a module, segment or part of code, which comprises Petition 870170098958, of 12/18/2017, p. 36/74 28/28 one or more executable instructions to implement the specified logical function (s). It should also be noted that, in some alternative implementations, the functions observed in the block can occur outside the order observed in the figures. For example, two blocks presented in succession can, in fact, be executed substantially simultaneously, or the blocks can be executed in reverse order, or the blocks can be executed in an alternative order, depending on the functionality involved. It will also be noted that each block in the block diagrams and / or flowchart illustration, and combinations of the blocks in the block diagrams and / or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts , or combinations of special-purpose hardware and computer instructions. Although not explicitly described, the present embodiments can be used in any combination or subcombination. Petition 870170098958, of 12/18/2017, p. 37/74 1/4
权利要求:
Claims (15) [1] 1. Method to be implemented in a network equipment (100) comprising at least one access point interface (103) and configured to operate a plurality of network functions (107, 110), said network equipment being configured to be in communication with at least one terminal (106) belonging to a network (105), CHARACTERIZED by the fact that said method (400) comprises: - receiving, through the access point interface (103), a data frame from said terminal (106); - modifying (402) said data frame by replacing a data frame address with processing information. [2] 2. Method according to claim 1, CHARACTERIZED in that it comprises forwarding (405), based on said processing information, the data frame modified to a network function (107, 110) for processing. [3] 3. Method, according to claim 1 or 2, CHARACTERIZED by the fact that said processing information comprises at least the following parameters: - service path identifier, - service index, - customer identifier. [4] 4. Method, according to claim 3, CHARACTERIZED to comprise updating (407) the service index of the modified data frame after its processing by a network function (107, 110). [5] 5. Method, according to claims 1 to 4, CHARACTERIZED by the fact that the substituted address corresponds to both a destination address of the data frame and a source address of the data frame. Petition 870170098958, of 12/18/2017, p. 38/74 2/4 [6] 6. Method according to claim 5, CHARACTERIZED by additionally understanding, before addressing a network function (107, 110) and when the substituted address is a destination address of the data frame: - replacing (404) said data frame processing information with a destination address of said network function to be addressed; and - replace (404) a source address of the data frame with said processing information. [7] 7. Method according to claims 1 to 6, CHARACTERIZED to comprise, at least one network function (107) of a network function chain (107, 110), at least session information in a lookup table with the source address of said a terminal (106) that generated the data frame. [8] 8. Network equipment comprising at least one access point interface (103) and configured to operate a plurality of network functions (107, 110), said network equipment (100) being configured to be in communication with at least a terminal (106) belonging to a network (105), CHARACTERIZED by the fact that the network equipment (104) comprises at least one memory (501) and at least one set of processing circuits (500) configured to modify a data frame, from said one terminal (106) and received through the access point interface (103), by replacing a data frame address with processing information. [9] 9. Network equipment comprising at least one access point interface (103) and configured to operate a plurality of network functions (107, 110), said network equipment (100) being configured to be in communication with at least a terminal (106) belonging to a network (105), CHARACTERIZED by the fact that the network equipment (100) comprisesPetition 870170098958, of 12/18/2017, p. 39/74 3/4 addresses at least one classifier (108A) configured to modify a data frame, from said one terminal (106) and received by the access point interface (103), by replacing an address of the data frame with processing information. [10] 10. Network equipment, according to claim 9, CHARACTERIZED by the fact that said processing information comprises at least the following parameters: - service path identifier, - service index, - customer identifier. [11] 11. Network equipment according to claim 10, CHARACTERIZED by the fact that a network function (110) is configured to update the service index of the modified data frame after processing. [12] 12. Network equipment, according to claims 9 to 11, CHARACTERIZED by the fact that the substituted address corresponds to both a destination address of the data frame and an address of origin of the data frame. [13] Network equipment according to claims 9 to 12, CHARACTERIZED by additionally comprising at least one router (109) configured to forward the modified data frame to a network function (107, 110) for processing, based on its processing information. [14] 14. Network equipment according to claim 13, CHARACTERIZED by the fact that the router (109) is additionally configured to, before addressing a network function (107, 110) and when the substituted address is a destination address of the data frame: - replace said data frame processing information with Petition 870170098958, of 12/18/2017, p. 40/74 4/4 a destination address of the network function (107, 110) to be addressed; and - replace a data frame source address with said processing information. [15] 15. Network equipment according to claims 9 to 14, CHARACTERIZED by the fact that one last network function (107) of a network function chain (107, 110) is configured to store at least session information in a lookup table with the source address of said terminal (106) that generated the data frame. Petition 870170098958, of 12/18/2017, p. 41/74 1/3
类似技术:
公开号 | 公开日 | 专利标题 BR102017027297A2|2018-10-30|method for managing the thread of services on network equipment, and corresponding network equipment US11115375B2|2021-09-07|Interoperability between data plane learning endpoints and control plane learning endpoints in overlay networks US9838309B1|2017-12-05|Distributed network subnet US10171357B2|2019-01-01|Techniques for managing software defined networking controller in-band communications in a data center network US11271905B2|2022-03-08|Network architecture for cloud computing environments US10257162B2|2019-04-09|Method and system for providing “anywhere access” for fixed broadband subscribers US9130836B2|2015-09-08|Provisoning of a new node joining an existing cluster in a data center environment CN107210961B|2020-11-24|Method and apparatus for virtual routing and forwarding route leakage US8675519B2|2014-03-18|Evolution of ethernet networks US20190014040A1|2019-01-10|Edge network node and method for configuring a service therein US10931629B2|2021-02-23|Techniques for managing software defined networking controller in-band communications in a data center network WO2013098429A1|2013-07-04|Virtual customer premises equipment Lasserre et al.2014|Framework for data center | network virtualization US20180270084A1|2018-09-20|Technique for exchanging datagrams between application modules EP3301860A1|2018-04-04|Method for interconnecting virtual gateways and corresponding virtual gateway US20210144087A1|2021-05-13|Multi-protocol service chaining among devices of interconnected topology US11082259B1|2021-08-03|System and method for centralized policy enforcement for network segmentation US20210184970A1|2021-06-17|Disambiguating traffic in networking environments with multiple virtual routing and forwarding | logical routers Jain2019|LAN Extension and Network Virtualization in Cloud Data Centers Cardona2021|Encapsulating Layer 2 over Layer 3 with VXLAN Shahrokhkhani2021|An Analysis on Network Virtualization Protocols and Technologies US20200267051A1|2020-08-20|Remotely controlling network slices in a network Jain2013|LAN Extension and Virtualization using Layer 3 Protocols BR112013005905B1|2021-12-07|METHOD IN AN EDGE ROUTER TO FACILITATE COMMUNICATIONS BETWEEN A SUBSCRIBER TERMINAL RUNNING TCP AND A SECOND ELECTRONIC DEVICE AND EDGE ROUTER CONFIGURED TO USE AN MPTCP CONNECTION BR112013005905A2|2021-04-13|METHOD ON AN EDGE ROUTER TO FACILITATE COMMUNICATIONS BETWEEN A SUBSCRIBER TERMINAL STATION THAT RUNS TCP AND A SECOND ELECTRONIC DEVICE AND EDGE ROUTER CONFIGURED TO USE AN MPTCP CONNECTION
同族专利:
公开号 | 公开日 US10868795B2|2020-12-15| EP3340581A1|2018-06-27| US20180176177A1|2018-06-21| EP3340581B1|2022-02-23| CN108206860A|2018-06-26|
引用文献:
公开号 | 申请日 | 公开日 | 申请人 | 专利标题 KR100886550B1|2002-09-17|2009-03-02|삼성전자주식회사|Apparatus and method for allocating the ip address| FR2911742B1|2007-01-18|2009-04-17|Bouygues Telecom Sa|METHOD FOR CONNECTING A USER OF A MOBILE TELEPHONE NETWORK TO A DATA TRANSMISSION SERVICE| US8640220B1|2009-09-09|2014-01-28|Amazon Technologies, Inc.|Co-operative secure packet management| CN103179228B|2013-04-02|2015-08-19|杭州华三通信技术有限公司|Internet Protocol address analytic method and fringe node| EP3014819B1|2013-08-05|2018-03-14|Huawei Technologies Co., Ltd.|Method for packet tunneling through software defined networkmethod of intelligently controlling flow of a packet through software defined network and system| WO2015080634A1|2013-11-26|2015-06-04|Telefonaktiebolaget L M Ericsson |A method and system of supporting service chaining in a data network| US9398486B2|2014-06-10|2016-07-19|Cisco Technology, Inc.|Conveying subscriber information to service chain services using tunnel protocol header encapsulation for mobile network applications in a network environment| US9634936B2|2014-06-30|2017-04-25|Juniper Networks, Inc.|Service chaining across multiple networks| WO2016148001A1|2015-03-13|2016-09-22|日本電気株式会社|Communication device, system, and method, and allocation device and program| US9999178B2|2015-06-12|2018-06-19|Oxbo International Corporation|Cam for a windrow merger and pickup head having a variable radius| WO2017113231A1|2015-12-30|2017-07-06|华为技术有限公司|Packet transmission method, device and system| US11044203B2|2016-01-19|2021-06-22|Cisco Technology, Inc.|System and method for hosting mobile packet core and value-added services using a software defined network and service chains| US10187263B2|2016-11-14|2019-01-22|Futurewei Technologies, Inc.|Integrating physical and virtual network functions in a service-chained network environment|US10257095B2|2014-09-30|2019-04-09|Nicira, Inc.|Dynamically adjusting load balancing| US10348638B2|2017-05-30|2019-07-09|At&T Intellectual Property I, L.P.|Creating cross-service chains of virtual network functions in a wide area network| US11012420B2|2017-11-15|2021-05-18|Nicira, Inc.|Third-party service chaining using packet encapsulation in a flow-based forwarding element| US10797910B2|2018-01-26|2020-10-06|Nicira, Inc.|Specifying and utilizing paths through a network| US10805192B2|2018-03-27|2020-10-13|Nicira, Inc.|Detecting failure of layer 2 service using broadcast messages| US10944673B2|2018-09-02|2021-03-09|Vmware, Inc.|Redirection of data messages at logical network gateway| US11086654B2|2019-02-22|2021-08-10|Vmware, Inc.|Providing services by using multiple service planes| US11140218B2|2019-10-30|2021-10-05|Vmware, Inc.|Distributed service chain across multiple clouds| US11223494B2|2020-01-13|2022-01-11|Vmware, Inc.|Service insertion for multicast traffic at boundary| US11153406B2|2020-01-20|2021-10-19|Vmware, Inc.|Method of network performance visualization of service function chains| US20210314268A1|2020-04-06|2021-10-07|Vmware, Inc.|Using multiple transport mechanisms to provide services at the edge of a network| CN113660131B|2021-10-18|2022-01-07|武汉绿色网络信息服务有限责任公司|Virtual network function unit switching method, device, controller and storage medium|
法律状态:
2018-10-30| B03A| Publication of a patent application or of a certificate of addition of invention [chapter 3.1 patent gazette]| 2019-08-06| B25G| Requested change of headquarter approved|Owner name: THOMSON LICENSING (FR) | 2019-08-20| B25A| Requested transfer of rights approved|Owner name: INTERDIGITAL CE PATENT HOLDINGS (FR) |
优先权:
[返回顶部]
申请号 | 申请日 | 专利标题 EP16306734.1A|EP3340581B1|2016-12-20|2016-12-20|Method for managing service chaining at a network equipment, corresponding network equipment| 相关专利
Sulfonates, polymers, resist compositions and patterning process
Washing machine
Washing machine
Device for fixture finishing and tension adjusting of membrane
Structure for Equipping Band in a Plane Cathode Ray Tube
Process for preparation of 7 alpha-carboxyl 9, 11-epoxy steroids and intermediates useful therein an
国家/地区
|