WO2019237683A1

WO2019237683A1 - Protocol packet, and method for managing virtual client terminal device

Info

Publication number: WO2019237683A1
Application number: PCT/CN2018/119058
Authority: WO
Inventors: 李和松; 许赛群; 王晔; 王颖
Original assignee: 烽火通信科技股份有限公司
Priority date: 2018-06-14
Filing date: 2018-12-04
Publication date: 2019-12-19
Also published as: CN108964985A; CN108964985B

Abstract

Disclosed are a protocol packet, and a method for managing a virtual client terminal device, which are used for communication between a network controller and the virtual client terminal device VCPE, and relate to the technical field of communications. A payload part of the protocol packet has a common header, wherein the common header comprises a field for indicating a universally unique identifier (UUID) of the VCPE, and the UUID is generated when the VCPE is started for the first time. In the present invention, the UUID of the VCPE serves as a unique identifier for the network controller to remotely manage the VCPE and is a basis for online and later service configuration management of the VCPE, such that large-scale deployment of the VCPE can be quickly and reliably realized.

Description

Protocol message and management method of virtual client terminal equipment

Technical field

The present invention relates to the field of communication technologies, and in particular, to a method for managing protocol messages and virtual client terminal equipment.

Background technique

Driven by Software Defined Network (SDN) / Network Function Virtualization (NFV) technology, the communications industry has ushered in a wave of cloudification. By decoupling the hardware and software of traditional communication equipment, and using SDN to achieve centralized management and service provisioning, the network operator's operation and maintenance costs can be greatly increased, while maximizing the value-added of the network. Figure 1 shows the deployment of a virtual customer premise equipment (VCPE) on the existing network, including a service orchestrator, network controller, and VCPE for virtual customer terminal equipment connected to multiple users. The service orchestrator performs services. Policy release and management, unified management of the network controller, network controller to VCPE online management and identity authentication management. Among them, VCPE is the most compelling business model in Software-Defined-Wide Area Network (SD-WAN) solutions, which can enable network operators to further extend services to user exits, while also bringing users, especially Small and medium-sized enterprises are freed from tedious network management, which is a typical win-win model. However, due to the decentralized nature of users, how to achieve remote management and service provisioning of large-scale VCPE is a key issue that VCPE needs to solve in order to be practical.

Summary of the Invention

In view of the shortcomings in the prior art, the purpose of the present invention is to provide a method for managing protocol packets and virtual client terminals. The UUID of the VCPE is used as the unique identifier for remote management of the VCPE by the network controller. The basis for later service configuration management, so as to quickly and reliably realize the large-scale deployment of VCPE.

The present invention provides a protocol message for communication between a network controller and a virtual client terminal device VCPE:

The payload part of the protocol message has a common header, and the common header includes a field for indicating a universal unique identifier UUID of the VCPE, and the UUID is generated when the VCPE is first started.

On the basis of the above technical solution, the common header is a type length value TLV, including a protocol version number, a message type, a total message length, and an authentication encryption field.

On the basis of the above technical solution, the message types include an authentication request, an authentication response, a heartbeat, and reporting of node information.

Based on the above technical solution, the message type further includes a service port announcement and a session close. The service port announcement message includes an IP type, an IP address of a network controller, and service port information, and is used to notify the VCPE to the network control The controller actively initiates a control connection.

Based on the above technical solution, the authentication encryption field includes an authentication type and corresponding password information, the authentication type includes simple password authentication and MD5 authentication, and the password information is a plain text password or all 0s.

Based on the above technical solution, the common header further includes a reserved field for a custom function, and the custom function includes alarm reporting and automatic topology discovery.

Based on the above technical solution, the protocol message is a TCP message or a UDP message.

The present invention also provides a method for managing a virtual client terminal device using the foregoing protocol message, which includes:

The network controller performs user identity verification according to the user authentication request sent by the VCPE. After the authentication is passed, the service configuration information delivered by the service orchestrator is forwarded to the VCPE. The user authentication request and the service configuration message are both It is carried by a protocol message of the UUID of the VCPE.

On the basis of the above technical solution, the common header is a type length value TLV, including a protocol version number, a message type, a total message length, and an authentication encryption field. Based on the message type, the protocol message includes an authentication request message. Message, authentication response message, heartbeat message, and node information report message;

When the VCPE is started for the first time and the IP address of the VCPE is changed, an authentication request message with the user authentication request is sent to a network controller, where the user authentication request includes a user name, a password, and the VCPE IP address

The network controller extracts the user authentication request and performs authentication, and returns an authentication response message with an authentication result.

Based on the above technical solution, the protocol message further includes a service port announcement message, and the service port announcement message includes an IP type, an IP address of the network controller, and service port information, and is used to notify the VCPE to the network control Controller initiates a control connection actively;

When the network controller receives the authentication request message sent by the VCPE, it compares the IP address of the VCPE and the source IP address of the protocol message, and if it is not consistent, sends the service port to the VCPE. Notification message.

Compared with the prior art, the advantages of the present invention are as follows:

(1) Realization of VCPE equipment online management: Since VCPE is essentially a software function entity, the UUID of VCPE is adopted, so that the network controller remotely manages VCPE needs a serial number similar to the physical device as the unique identifier of VCPE, and goes online as VCPE And the basis for later business configuration management. Based on this, a complete set of VCPE management protocol messages is formulated to quickly and reliably implement large-scale deployment of VCPE. It has low cost, good scalability, strong adaptability, and easy Implementation and deployment advantages.

(2) Identification of VCPE equipment: VCPE equipment security certification is a key measure of product maturity. Due to the decentralized and open nature of VCPE deployment, identity authentication of VCPE is a key issue involving business security. A reasonable authentication scheme greatly improves the availability of VCPE and prevents the entire business network from being down.

(3) Solve the re-authentication problem of VCPE migration: In the actual application of NFV, software migration is the most common requirement. The embodiments of the present invention can perform reliable re-authentication of VCPE in the case of VCPE migration and IP address change And re-authentication can be initiated by VCPE or network controller to further improve the availability and management efficiency of VCPE.

(4) Solve the problem of NAT traversal: In the deployment scenario of the existing network, many small and medium-sized enterprises have no public network address at the exit, but are behind the NAT gateway of the operator, and the private network address is dynamically obtained. Embodiments of the present invention The VCPE can actively initiate a control connection, thereby effectively solving this special problem in the practical process of VCPE.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a schematic diagram of a VCPE live network deployment;

2 is a schematic structural diagram of a protocol message according to the first embodiment of the present invention;

3 is a schematic diagram of a common header of a protocol message according to the first embodiment of the present invention;

4 is a message type of a protocol message according to the first embodiment of the present invention;

5 is protocol data corresponding to each message type of a protocol message according to a second embodiment of the present invention;

6 is a flowchart of online management of a VCPE in a third embodiment of the present invention;

7 is a network controller protocol state machine according to a third embodiment of the present invention;

8 is a flowchart of establishing a command line channel under NAT traversal according to a sixth embodiment of the present invention.

detailed description

The present invention is described in further detail below with reference to the drawings and specific embodiments.

The present invention provides a protocol message for communication between a network controller and a virtual client terminal device VCPE. The payload portion of the protocol message has a common header, and the common header includes a universal unique identifier for indicating the VCPE. (Universally Unique Identifier, UUID) field. The UUID is generated when the VCPE is first started, and stored in the VCPE configuration file as the unique identifier of the VCPE. Uuidgen.exe and other tools can be used to generate the UUID.

Since VCPE is essentially a software function entity, the UUID of VCPE is used, so that the network controller remotely manages VCPE needs a serial number similar to the physical device as the unique identifier of VCPE, as the basis for VCPE going online and the subsequent service configuration management. Based on this, a complete set of VCPE management protocol messages is formulated to quickly and reliably achieve large-scale deployment of VCPE, which has the advantages of low cost, good scalability, strong adaptability, and easy implementation and deployment.

Referring to FIG. 2, a first embodiment of the present invention provides a protocol message. The protocol message includes a message header and a payload part. The payload part of the protocol message has a common header and protocol data. The format of the header is shown in Figure 3. The common header is the type length value TLV (Type, Length, Value). The common header includes the protocol version number (Version), message type (Type), total message length (Length), And a field for indicating the universal unique identifier UUID of the VCPE, which is generated when the VCPE is first started.

The public header also includes an authentication encryption field. The authentication encryption field includes an authentication type (Auth Type) and corresponding password information (Authentication). The authentication type includes simple password authentication and MD5 authentication. The password information is a plain text password or all 0s.

The public header also includes a Reserved field for custom functions. The custom functions include alarm reporting and automatic topology discovery.

Referring to FIG. 3, the fields are described as follows:

(1) Protocol version number Version: customizable, 1 byte;

(2) Message type: 1 byte. See Figure 4 for the defined message types, including authentication request (Type1), authentication response (Type2), heartbeat (connection keepalive, Type3), node information reporting (Type4), Service port announcement (Type 5) and session close (Type 6). Can be expanded according to actual needs;

(3) Total message length: The message includes the common header and data part;

(4) UUID: 16 bytes, the unique identifier of VCPE;

(5) Reserved field: 3 bytes, reserved for actual needs for expansion;

(6) Authentication type: 0 means no authentication, 1 means simple password authentication, and 2 means Message Digest Algorithm 5 (MD5) authentication;

(7) Password information Authentication: For simple password authentication, the password is in plain text, and it is all 0 when no authentication or MD5;

When AuthType is 2, it indicates MD5 authentication. There is an extra 16 bytes of MD5 check field at the end of the protocol data of the message.

It can be known from the above description that the payload part of the protocol message has a common header and adopts the format of TLV, so it has good scalability and can meet the needs of later diversification.

The second embodiment of the present invention provides a protocol message. On the basis of the first embodiment of the present invention, the specific definition of the message type Type can be shown in FIG. 5. The content described in FIG. 5 are all protocol data. The Type values in the ministry are distinguished as follows:

Authentication request (Type1) includes user name length (UserName), user name (UserName), password length (Password), password (Password), VCPE IP address length (IP Len), and VCPE IP address (My IP) .

The authentication response (Type 2) includes an authentication result (Result) and a reserved character (Reserved). The network controller sends the VCPE to respond to the VCPE user authentication request. When the authentication is successful, the Result field is 0. When the authentication fails, the Result field returns 1; when re-authentication is required, the Result field is filled with 2.

The heartbeat (connection keep-alive, Type3) includes the magic word (Magic number). The magic word is used for checking the heartbeat message, and can also be used as a reserved field for extended purposes.

The node information report (Type 4) includes a sub type, a sub length, and a sub value.

Service port announcement (Type 5) is used by the network controller to notify the VCPE to actively initiate a control connection to the network controller, including the IP type (IP Type), the network controller's IP address length (IP, Len), and the network controller's IP address (IP ) And service port information. The service port information includes a port type (Port Type), a port length (Port), and a port number (Port).

When IP type = 1, IPv4; when IP type = 2, IPv6. Port type = 1: TCP; port type = 2: UDP.

The session close (Type 6) includes closing the connection (close) and the reserve word (Reserve). The close is 1 byte, and the reserve word (Reserve) is 7 bytes, which is used for other function extensions.

The protocol message is a Transmission Control Protocol (TCP) message or a User Datagram Protocol (UDP) message. As shown in Figure 2, the packet header of a protocol packet includes an IP header and a TCP / UDP header. The definition of the common header does not mandate the use of TCP or UDP for the bearer protocol, but considering the resource consumption of TCP itself And to maximize the management capability of the network controller, UDP is preferred. Practice has shown that using UDP to carry the authentication protocol defined above has the characteristics of short development cycle and low resource consumption.

VCPE supports IPv4 / IPv6 dual stack, which can be deployed in IPv4 and IPv6 networks.

Achieve identity authentication of VCPE equipment: VCPE equipment security certification is a key measure of product maturity. Due to the decentralized and open nature of VCPE deployment, identity authentication of VCPE is a key issue involving business security and reasonable authentication. The scheme greatly improves the availability of VCPE and prevents the entire service network from being paralyzed.

A third embodiment of the present invention provides a method for managing a virtual client terminal device using the protocol message of the second embodiment, which includes:

The network controller performs user identity verification according to the user authentication request sent by the VCPE. After the authentication is passed, the service configuration information delivered by the service orchestrator is forwarded to the VCPE. The user authentication request and the service configuration message are both based on the VCPE UUID protocol. Message bearer.

Based on the message type, protocol messages include authentication request messages, authentication response messages, heartbeat messages, and node information reporting messages.

When the VCPE is started for the first time, it sends an authentication request packet with a user authentication request to the network controller. The user authentication request includes the user name, password, and IP address of the VCPE.

The network controller extracts a user authentication request and performs authentication, and returns an authentication response packet with an authentication result.

Refer to Figure 6 for the online management process of VCPE. Each VCPE can be used as an example. The authentication server and the network controller can be integrated or separated. In order to improve the network scale managed by the network controller, it is preferable to use an independent authentication, authorization, and accounting (AAA) server as the authentication server, and the network controller uses Remote User Authentication Service (Remote Authentication) Dial In User Service (Radius) or Terminal Access Controller Access Control System (TACACS) protocol interacts with the authentication server, which can meet the needs of large-scale commercial use.

The S1 administrator assigns a username, password, and location code to the VCPE to be opened and stores it in the authentication server database;

The S2 administrator notifies the user of the device through email or text message of the user name, password, and location code.

The S3 provisioning staff writes the user name, password, and location code to the VCPE configuration file through the configuration file or the WEB client. The location code is a unique number assigned by the network controller to the entire network VCPE. The location code can be used to obtain the VCPE geographic location. location information;

S4VCPE generates a UUID when it is first started and saves it in the configuration file; VCPE communicates with the controller through Dynamic Host Configuration Protocol (DHCP) or a statically assigned IP address, and integrates the user name, password, location code, and local management The IP address is sent to the network controller through a private authentication message, and data encryption or integrity check is performed if necessary.

The S5 network controller extracts the user name, password, UUID, and location information in the VCPE authentication request message and sends it to the authentication server for authentication. The authentication server performs user identity verification according to the local database and returns the authentication result to the controller;

The S6 network controller receives the authentication result returned by the authentication server. If the authentication is successful, it is a legitimate VCPE and reports the VCPE information to the scheduler. If the authentication fails, the VCPE authentication request is discarded and recorded by the log.

The S7 service orchestrator issues service configuration data to the authenticated VCPE through the interface;

The S8 network controller uses the UUID as an identifier to convert the configuration issued by the service orchestrator into a device protocol and deliver it to each VCPE instance.

During VCPE authentication, the network controller protocol state machine is shown in Figure 7.

Init state: The network controller receives the VCPE authentication request message and sends an authentication request to the AAA server.

Unauthorized: The AAA server fails the authentication, returns the result, and waits for authentication again.

Authentication status (Authorized): The AAA server is authenticated, obtains topology information, and works with packets.

After the session times out, it transitions from the authenticated state to the unauthorized state; after the authentication times out, it transitions from the unauthorized state to the init state.

The embodiment of the present invention implements identity authentication of VCPE devices: VCPE device security authentication is a key measure of product maturity. Due to the decentralized and open nature of VCPE deployment, identity authentication on VCPE is a key issue that involves business security The reasonable authentication scheme greatly improves the availability of VCPE and avoids the paralysis of the entire business network.

The fourth embodiment of the present invention provides a method for managing a virtual client terminal device. Based on the third embodiment of the present invention, it is used for re-authenticating the migrated VCPE, and specifically includes:

When the VCPE's IP address changes, repeat the process in Figure 6 above to re-send an authentication request message with a user authentication request to the network controller. The network controller extracts the user authentication request and performs authentication, and returns the authentication request with authentication. The resulting authentication response message.

A fifth embodiment of the present invention provides a method for managing a virtual client terminal device. Based on the third embodiment of the present invention, it is used for a network controller to actively request VCPE to perform re-authentication, and specifically includes: the network controller sends an authentication response message to VCPE Message, the message type in the authentication response message is authentication response (Type 2), where the Result field is filled with 2, indicating that re-authentication is required.

The fourth embodiment and the fifth embodiment of the present invention solve the re-authentication problem of VCPE migration: In the actual application of NFV, software migration is the most common requirement. The embodiments of the present invention can be used in the case of VCPE migration and IP address changes. Reliable re-authentication of VCPE, and re-authentication can be initiated by VCPE or network controller to further improve the availability and management efficiency of VCPE.

The sixth embodiment of the present invention provides a method for managing a virtual client terminal device. Based on the third embodiment of the present invention, it is used to solve the problem of NAT traversal, including:

When the network controller receives the authentication request message from the VCPE, it compares the IP address of the VCPE with the source IP address of the protocol message. If it is not the same, it sends a service port announcement message to the VCPE.

According to the description of the Type1 message above, when the controller receives the authentication request message, compare the management IP of the payload part of the message with the source IP of the message. If the two IPs do not match, the VCPE is behind the NAT gateway and the network control The controller cannot actively initiate a control connection. At this time, the network controller will start a random port as the listening server, and notify the VCPE of the port information through this message. After receiving the message, the VCPE can initiate a control connection to the designated port of the network controller. It can be known from the structure of the message that IPv4 and IPv6, and TCP / UDP compatibility issues have been fully considered.

As shown in Figure 8, VCPE includes a UDP authentication module and a command line interface (CLI). During the establishment of a command line channel under NAT traversal, the interaction process between the network controller, authentication module, and command line interface CLI is as follows: :

The S201UDP authentication module sends an authentication request message to the network controller.

The S202 network controller compares the source IP of the UDP header with the IP field of the VCPE in the payload part according to the authentication request message. If they are not consistent, the VCPE is behind the NAT gateway, and the network controller dynamically allocates a TCP port number to start the server. VCPE is notified by sending a Type 5 service port notification message.

The S203UDP authentication module initiates a connection to the service port of the network controller.

The S204UDP authentication module dynamically establishes a TCP connection to the command line interface CLI.

The S205 network controller sends command line data to the established TCP connection.

The S206UDP authentication module transparently transmits command line data to the command line interface CLI.

S207 CLI returns data.

The S208UDP authentication module transparently transmits the returned data to the network controller.

After the S209 network controller sends the command line, it sends a Type 6 close connection packet to the UDP authentication module.

The S210UDP authentication module closes the connection.

As can be seen from the figure, in the context of NAT traversal, the UDP authentication module actually functions as a proxy controlling the connection.

In the deployment scenario of the existing network, many small and medium-sized enterprises have no public network address at the exit, but are behind the NAT gateway of the operator, and the private network address is dynamically obtained. The control connection of VCPE is generally initiated by the controller. For example, in the case of a typical command line configuration channel, VCPE is often used as the server of the remote terminal protocol Telnet / Secure Shell (SSH), and the network controller actively connects through the client. VCPE. However, when the VCPE is behind a NAT gateway, the network controller cannot actively initiate a control connection to the VCPE. The embodiment of the present invention enables a VCPE to actively initiate a control connection, thereby effectively solving this special problem in the practical process of VCPE.

The present invention is not limited to the above embodiments. For those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and retouches can be made. These improvements and retouches are also considered to be the protection of the present invention. Within range. What is not described in detail in this specification belongs to the prior art known to those skilled in the art.

Claims

A protocol message is used for communication between the network controller and the virtual client terminal equipment VCPE, which is characterized by:

The payload part of the protocol message has a common header, and the common header includes a field for indicating a universal unique identifier UUID of the VCPE, and the UUID is generated when the VCPE is first started.
The protocol message according to claim 1, wherein the common header is a type length value TLV, including a protocol version number, a message type, a total message length, and an authentication encryption field.
The protocol message according to claim 2, wherein the message type includes an authentication request, an authentication response, a heartbeat, and reporting of node information.
The protocol message according to claim 2, wherein the message type further comprises a service port announcement and a session close, and the service port announcement message includes an IP type, an IP address of a network controller, and service port information, and is used for: The VCPE is notified to initiate a control connection to the network controller.
The protocol message according to claim 2, wherein the authentication encryption field includes an authentication type and corresponding password information, the authentication type includes simple password authentication and MD5 authentication, and the password information is a plain text password or a full password. 0.
The protocol message according to claim 1, wherein the common header further comprises a reserved field for a custom function, and the custom function includes an alarm report and an automatic topology discovery.
The protocol message according to claim 1, wherein the protocol message is a TCP message or a UDP message.
A method for managing a virtual client terminal device using the protocol message according to any one of claims 1 to 7, characterized in that it comprises:

The network controller performs user identity verification according to the user authentication request sent by the VCPE. After the authentication is passed, the service configuration information delivered by the service orchestrator is forwarded to the VCPE. The user authentication request and the service configuration message are both It is carried by a protocol message of the UUID of the VCPE.
The method for managing a virtual client terminal device according to claim 8, wherein the common header is a type length value TLV, including a protocol version number, a message type, a total message length, and an authentication encryption field, based on the message Type, the protocol message includes an authentication request message, an authentication response message, a heartbeat message, and a node information reporting message;

When the VCPE is started for the first time and the IP address of the VCPE is changed, an authentication request message with the user authentication request is sent to a network controller, where the user authentication request includes a user name, a password, and the VCPE IP address

The network controller extracts the user authentication request and performs authentication, and returns an authentication response message with an authentication result.
The method for managing a virtual client terminal device according to claim 9, wherein the protocol message further comprises a service port announcement message, and the service port announcement message includes an IP type, an IP address of a network controller, and a service port Information for notifying the VCPE to actively initiate a control connection to the network controller;

When the network controller receives the authentication request message sent by the VCPE, it compares the IP address of the VCPE and the source IP address of the protocol message, and if it is not consistent, sends the service port to the VCPE. Notification message.