Virtual network function virtual domain isolation

Patent metadata

Field	Value
Publication number	US-11880705-B2
Application number	US-202218061731-A
Country	US
Kind code	B2
Filing date	Dec 5, 2022
Priority date	Mar 31, 2020
Publication date	Jan 23, 2024
Grant date	Jan 23, 2024

Abstract

Techniques for virtualized network functions (VNFs) that provide for domain isolation of networks coupled to the VNF are described. A virtual network function (VNF) includes a cloud virtual domain coupling the VNF to a cloud service, a management virtual domain coupling the VNF to a management service, and an external virtual domain having a public Internet Protocol (IP) address. The external virtual domain receives an authentication request providing access credentials for a VNF customer from a cloud client device, provides the authentication request to the management service via the management virtual domain, receives an authentication response from the management service, and, in response to determining that the VNF customer access credentials are valid, initiates application of a policy that allows the cloud client device to configure the cloud virtual domain or the cloud service and disallows configuration of the external virtual domain and the management virtual domain.

First claim

What is claimed is:

1. A computing device comprising:
processing circuitry coupled to a memory;
a virtual network function (VNF) configured for execution by the processing circuitry, wherein the VNF comprises:
a cloud virtual domain communicatively coupling the VNF to a cloud service;
a management virtual domain; and
an external virtual domain having a public Internet Protocol (IP) address, the external virtual domain configured to receive, from a cloud client device on a public network, an authentication request providing access credentials for a VNF customer,
wherein the VNF is configured to, in response to a determination that the access credentials are valid credentials for the VNF customer, allow the cloud client device to configure the cloud virtual domain and disallow the cloud client device from configuring the external virtual domain and the management virtual domain.

2. The computing device of claim 1 , wherein the authentication request comprises a secure shell (SSH) authentication request.

3. The computing device of claim 1 , wherein the management virtual domain communicatively couples a management service to the VNF, and wherein the management service comprises an authentication service.

4. The computing device of claim 3 , wherein the authentication service comprises a TACACS service.

5. The computing device of claim 1 ,
wherein the external virtual domain is further configured to receive a second authentication request comprising second access credentials,
wherein the VNF is configured to, in response to a determination that the second access credentials are valid credentials for an administrator of a data center hosting the VNF, allow the administrator to configure the external virtual domain and the management virtual domain.

6. The computing device of claim 1 , wherein the external virtual domain is further configured to determine if the cloud client device is allowed to access the VNF, and to reject the authentication request in response to a determination that the cloud client device is not allowed to access the VNF.

7. The computing device of claim 1 , wherein the external virtual domain comprises a virtual router function (VRF), and wherein the VRF is configured to perform network address translation to translate a source IP address to an IP address associated with the management virtual domain and translate a destination IP address to an IP address of a management service communicatively coupled to the VNF by the management virtual domain, and wherein the VRF is configured to relay the authentication request to the management service via the management virtual domain.

8. The computing device of claim 1 , wherein the external virtual domain comprises a virtual firewall, and wherein the management virtual domain further comprises a management agent configured to provide a proxy authentication request to a management service communicatively coupled to the VNF by the management virtual domain, the proxy authentication request having a source IP address of the management virtual domain.

9. The computing device of claim 1 , wherein the VNF is communicatively coupled to a public gateway, wherein the external virtual domain receives a network packet via the public gateway and wherein the public gateway configured to determine that a source of the network packet is authorized to access the VNF.

10. A system comprising:
a private cloud network;
a private management network; and
a virtualized network function (VNF) communicatively coupled to a public gateway, the VNF comprising:
a cloud virtual domain communicatively coupling the VNF to a cloud service via the private cloud network,
a management virtual domain, and
an external virtual domain configured to receive, from a cloud client device via a public network, an authentication request providing access credentials for a VNF customer,
wherein the VNF is configured to, in response to a determination that the access credentials are valid credentials for the VNF customer, allow the cloud client device to configure the cloud virtual domain and disallow the cloud client device from configuring of the external virtual domain and the management virtual domain.

11. The system of claim 10 , wherein the authentication request comprises a secure shell (SSH) authentication request.

12. The system of claim 10 , wherein the management virtual domain communicatively couples a management service to the VNF via the private management network, and wherein the management service comprises an authentication service.

13. The system of claim 12 , wherein the authentication service comprises a TACACS service.

14. The system of claim 10 , wherein the external virtual domain is further configured to:
determine if the cloud client device is allowed to access the VNF; and
reject the authentication request in response to a determination that the cloud client device is not allowed to access the VNF.

15. The system of claim 10 , wherein the external virtual domain comprises a virtual router function (VRF), and wherein the VRF is configured to perform network address translation to translate a source IP address to an IP address associated with the management virtual domain and translate a destination IP address to an IP address of a management service communicatively coupled by the management virtual domain to the VNF via the private management network, and wherein the VRF is configured to relay the authentication request to the management service via the management virtual domain.

16. The system of claim 10 , wherein the external virtual domain comprises a virtual firewall, and wherein the management virtual domain further comprises a management agent configured to provide a proxy authentication request to a management service communicatively coupled by the management virtual domain to the VNF via the private management network, the proxy authentication request having a source IP address of the management virtual domain.

17. The system of claim 10 , further comprising a public gateway having an access control list (ACL) specifying one or more customer network devices permitted to provide network traffic to the VNF.

18. A method comprising:
receiving, by an external virtual domain of a virtualized network function (VNF) executable by one or more processors, an authentication request from a cloud client device on a public network, the authentication request include access credentials for a VNF customer;
by the VNF, in response to determining that the access credentials are valid credentials for the VNF customer, configuring the VNF to allow the cloud client device to configure a cloud virtual domain of the VNF and to disallow the cloud client device from configuring the external virtual domain and a management virtual domain of the VNF.

19. The method of claim 18 , wherein the external virtual domain comprises a virtual router function (VRF), wherein the management virtual domain communicatively couples a management service to the VNF,
the method further comprising providing the authentication request to the management service via the management virtual domain of the VNF, wherein providing the authentication request comprises:
performing, by the VRF, network address translation to translate a source IP address to an IP address associated with the management virtual domain and translate a destination IP address to an IP address of the management service; and
relaying the authentication request to the management service via the management virtual domain.

20. The

Assignees

• Equinix Inc

Inventors

• Iqbal Syed Hashim
• Durrani Muhammad
• Achladi Janardhana
• Jamal Rizwan

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L61/2591

  Identification of devices behind NAT devices · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L41/0803

  Configuration setting · CPC title