Virtual network function virtual domain isolation

Patent metadata

Field	Value
Publication number	US-11520615-B1
Application number	US-202016836777-A
Country	US
Kind code	B1
Filing date	Mar 31, 2020
Priority date	Mar 31, 2020
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

Techniques for virtualized network functions (VNFs) that provide for domain isolation of networks coupled to the VNF are described. A virtual network function (VNF) includes a cloud virtual domain coupling the VNF to a cloud service, a management virtual domain coupling the VNF to a management service, and an external virtual domain having a public Internet Protocol (IP) address. The external virtual domain receives an authentication request providing access credentials for a VNF customer from a cloud client device, provides the authentication request to the management service via the management virtual domain, receives an authentication response from the management service, and, in response to determining that the VNF customer access credentials are valid, initiates application of a policy that allows the cloud client device to configure the cloud virtual domain or the cloud service and disallows configuration of the external virtual domain and the management virtual domain.

First claim

What is claimed is:

1. A computing device comprising:
processing circuitry coupled to a memory;
a virtual network function (VNF) configured for execution by the processing circuitry, wherein the VNF comprises:
a cloud virtual domain communicatively coupling the VNF to a cloud service;
a management virtual domain communicatively coupling the VNF to a management service; and
an external virtual domain having a public Internet Protocol (IP) address, the external virtual domain configured to:
receive, from a cloud client device on a public network, an authentication request providing access credentials for a VNF customer,
provide the authentication request to the management service via the management virtual domain,
receive an authentication response from the management service via the management virtual domain,
in response to a determination that the authentication response indicates the access credentials are valid credentials for the VNF customer, initiate application of a policy that allows the cloud client device to configure the cloud virtual domain or the cloud service and disallows configuration of the external virtual domain and the management virtual domain.

2. The computing device of claim 1 , wherein the authentication request comprises a secure shell (SSH) authentication request.

3. The computing device of claim 1 , wherein the management service comprises an authentication service.

4. The computing device of claim 3 , wherein the authentication service comprises a Terminal Access Controller Access-Control System (TACACS) service.

5. The computing device of claim 1 , wherein the external virtual domain is further configured to:
receive a second authentication request including second access credentials;
in response to a determination that a second authentication response to the second authentication request indicates the second access credentials are valid credentials for an administrator of a data center hosting the VNF, initiate application of a policy that allows the administrator to configure the external virtual domain and the management virtual domain.

6. The computing device of claim 1 , wherein the external virtual domain is further configured to determine if the cloud client device is allowed to access the VNF, and to reject the authentication request in response to a determination that the cloud client device is not allowed to access the VNF.

7. The computing device of claim 1 , wherein the external virtual domain comprises a virtual router function (VRF), and wherein the VRF performs network address translation to translate a source IP address to an IP address associated with the management virtual domain and translates the destination IP address to an IP address of the management service and relays the authentication request to the management service via the management virtual domain.

8. The computing device of claim 1 , wherein the external virtual domain comprises a virtual firewall, and wherein the management virtual domain further comprises a management agent configured to provide a proxy authentication request to the management service, the proxy authentication request having a source IP address of the management virtual domain.

9. The computing device of claim 1 , wherein the VNF is communicatively coupled to a public gateway, wherein the external virtual domain receives the network packet via the public gateway and wherein the public gateway isconfigured to determine that a source of the network packet is authorized to access the VNF.

10. A system comprising:
a private cloud network;
a private management network; and
a virtualized network function (VNF) communicatively coupled to a public network, the VNF comprising:
a cloud virtual domain communicatively coupling the VNF to a cloud service via the private cloud network,
a management virtual domain communicatively coupling the VNF to a management service via the private management network, and
an external virtual domain configured to:
receive, from a cloud client device via the public network, an authentication request providing access credentials for a VNF customer,
provide the authentication request to the management service via the management virtual domain,
receive an authentication response from the management service via the management virtual domain,
in response to a determination that the authentication response indicates the access credentials are valid credentials for the VNF customer, initiate application of a policy that allows the cloud client device to configure the cloud virtual domain or the cloud service and disallows configuration of the external virtual domain and the management virtual domain.

11. The system of claim 10 , wherein the authentication request comprises a secure shell (SSH) authentication request.

12. The system of claim 10 , wherein the management service comprises an authentication service.

13. The system of claim 12 , wherein the authentication service comprises a Terminal Access Controller Access-Control System (TACACS) service.

14. The system of claim 10 , wherein the external virtual domain is further configured to:
determine if the cloud client device is allowed to access the VNF; and
reject the authentication request in response to a determination that the cloud client device is not allowed to access the VNF.

15. The system of claim 10 , wherein the external virtual domain comprises a virtual router function (VRF), and wherein the VRF performs network address translation to translate a source IP address to an IP address associated with the management virtual domain and translates the destination IP address to an IP address of the management service and relays the authentication request to the management service via the management virtual domain.

16. The system of claim 10 , wherein the external virtual domain comprises a virtual firewall, and wherein the management virtual domain further comprises a management agent configured to provide a proxy authentication request to the management service, the proxy authentication request having a source IP address of the management virtual domain.

17. The system of claim 10 , further comprising a public gateway having an access control list (ACL) specifying one or more customer network devices permitted to provide network traffic to the VNF.

18. A method comprising:
receiving, by an external virtual domain of a virtualized network function (VNF) executable by one or more processors, an authentication request from a cloud client device on a public network, the authentication request including access credentials for a VNF customer;
providing the authentication request to a management service via a management virtual domain of the VNF;
receiving an authentication response from the management service via the management virtual domain; and
in response to determining that the authentication response indicates the access credentials are valid credentials for the VNF customer, initiating application of a policy that allows the cloud client device to configure a cloud virtual domain or a cloud service and disallows the cloud client device from configuration of the external virtual domain and the management virtual domain.

19. The method of claim 18 , wherein the external virtual domain comprises a virtual router function (VRF), and wherein providing the authentication request to the management service via the management virtual domain of the VNF comprises:
performing network address translation to translate a source IP address to an IP address associated

Assignees

• Equinix Inc

Inventors

• Iqbal Syed Hashim
• Durrani Muhammad
• Achladi Janardhana
• Jamal Rizwan

Classifications

• H04L61/2514

  between local and global IP addresses · CPC title

• H04L41/28

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title