Enabling enterprise segmentation with 5G slices in a service provider network

An enterprise controller of an enterprise network sends to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network. Responsive to the sending, the enterprise controller receives from the service gateway the network slice information including identifiers of and properties associated with the network slices. Responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, the enterprise controller sends the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers to the data plane of the service provider network.

TECHNICAL FIELD

The present disclosure relates to enabling enterprise network segmentation with 5G slices in a service provider network.

BACKGROUND

Today an enterprise, i.e., an enterprise network, increasingly offloads its infrastructure into the public cloud. With the arrival of 5G networks, it is predicted that billions of devices will be added to network edges, which are part of fixed or mobile networks. The devices will be operating across multiple network domains, all which may be segmented for services of the network domains, not only across the 5G networks but also extended through to the enterprise network.

Due to these changes, major services or applications running on public or private clouds, such as machine-to-machine (m2m) and data in-and-data out of data centers, are projected to grow. This will bring scalability limitations for m2m communication and for mission critical applications due to the lack of service policy enforcement and segmentation. Some of these applications require differentiated transport services, e.g., packet latency, packet loss, packet jitter, packet disjointedness, packet replication, and packet segmentation. As devices are connected across heterogeneous networks, transport and segmentation services for the devices should be provided end-to-end (e2e) across the network domains.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

An enterprise controller of an enterprise network sends to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network. Responsive to the sending, the enterprise controller receives from the service gateway the network slice information including identifiers of the network slices and properties associated with the network slices. Responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, the enterprise controller sends the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers of the ones of the network slices to the data plane of the service provider network.

Example Embodiments

Third (3rd) Generation Partnership Project (3GPP) 5G (hereinafter “5G”) holds the promise of “network slicing” to provide 5G network slices (referred to simply as “slices”), which may be applied to a level of granularity of an enterprise network. Therefore, there is an opportunity to extend enterprise network segments of the enterprise network to service provider 5G slices, so that the enterprise network can leverage service provider 5G infrastructure, to extend enterprise network segments to remote sites and cloud environments, end-to-end across the heterogeneous networks. Embodiments presented herein provide ways to extend enterprise transport services and segmentation over the service provider 5G slices.

Before delving into how the enterprise network segments are mapped/carried using service provider 5G slices, 5G network slicing is described briefly. Service provider 5G network slicing enables a service provider to build virtual end-to-end networks tailored to application requirements. At the service provider, a network core that supports 5G virtualization uses 5G network slicing to support multiple virtual networks over a physical infrastructure or data plane. The data plane, also referred as the forwarding plane, is the part of a network that carries/routes/forwards user traffic. 5G network slicing permits a logical separation of a physical network into distinct (virtualized) 5G slices so that each slice provides unique connectivity characteristics, but all 5G slices run on the same shared physical network infrastructure. A given 5G slice supports a communication service of a particular connection type with a specific way of handling the data plane and the control plane for the service. Thus, 5G network slicing creates unique services that are customized for various use cases such as Internet of Things (IoT), automated cars, streaming video, remote health care, and so on. 5G network slicing creates virtual networks for applications that require separate blends of performance, capacity, latency, security, reliability, and coverage, for example.

With reference toFIG. 1, there is a conceptualized illustration of 5G network slicing that may be applied to different types of enterprise network traffic (simply referred to as “traffic”). The 5G network slicing supports multiple concurrent protocol data unit (PDU) connections or sessions102(1)-102(4) (collectively, “PDU sessions102”). The distribution of PDU sessions102is driven by enterprise end-service and service application function requirements. PDU Sessions102may be used when separate network anchor points are used. Each PDU session102(i) may support multiple quality of service (QoS) flows of traffic. Each QoS flow may be associated with a distinct level of QoS. Thus PDU sessions102expose granularity of QoS management and traffic segmentation to the enterprise network. 5G network slicing may apply a unique 5G slice for a given enterprise network customer for complete control of QoS flows, network anchor points, and traffic characteristics.

With reference toFIG. 2, there is a block diagram of an example enterprise 5G network as a service (NaaS)200(more simply referred to as a “network environment”200) in which embodiments presented herein may be implemented.FIG. 2shows extensions of services and functions of an enterprise network202(shown primarily on the left-hand side ofFIG. 2) to a service provider (SP) network204(shown primarily in the middle and on the right-hand side ofFIG. 2) that supports 5G network slicing.

Enterprise network202includes an access network206, an enterprise data plane208(also referred to as a “forwarding plane208”), and an enterprise controller210to perform overall control of the enterprise network, generally, and to control the access network and the data plane. Access network206provides a mobile device212with access to data plane208. Access network206includes an access point (AP)214through which mobile device212accesses or attaches to the access network, and a wireless local area network (LAN) controller (WLC)216to control the access point. In practice, access network206includes many mobile devices many APs, and many WLCs, although only one of each is shown inFIG. 2for the sake of clarity. In practice, a fixed or mobile device is attached to an enterprise access network, e.g., the mobile device may be wirelessly attached or wired to access network206.

Enterprise data plane208carries (user) traffic in the form of Internet Protocol (IP) packets to and from access network206. Generally, data plane208includes network devices, such as switches and routers. Data plane208includes a switch fabric218comprising a fabric of interconnected switches (not specifically shown inFIG. 2), a fabric edge (FE) switch220connected to an edge of the switch fabric and access network206, and a fabric border (FB) router222connected to an edge of the switch fabric (i.e., connected to a border of data plane208) and to service provider network204. FE switch220switches the traffic between access network206and switch fabric218, switch fabric218routes the traffic in data plane208, and FB router222forwards the traffic between the switch fabric and service provider network204through a network228, as described below. Network228may include one or more wide area networks (WANs), such as the Internet, and one or more LANs.

Enterprise controller210may be implemented as a Cisco digital network architecture (DNA)-center (DNA-C), for example. Enterprise controller210includes control plane applications, shown generally at cloud234, configured to communicate with and assert control over access network206and data plane208. For example, control plane applications230may select segment routing (SR) services in data plane208for enterprise network202.

SP network204includes an SP data plane231, an SP service gateway232(also referred to simply as a “service gateway232” of the SP network), and an SP SR controller, shown generally at cloud234(also referred to simply as an “SR controller234” of the SP network). SP service gateway232performs access and session management operations for SP network204, communicates with enterprise controller210of enterprise network202over a network, and communicates with other components and applications of SP network204, such as SP SR controller234. SP service gateway232acts as a conduit for messages, e.g., request and responses, between enterprise controller210and the other components and applications of SP network204, such as SP SR controller234.

SP SR controller234manages 5G network slicing on SP data plane231. For example, SP SR controller234provisions 5G slices on the SP data plane231and maintains configuration information about the 5G slices that are provisioned, such as identifiers of the 5G slices and properties associated with the 5G slices. Distinct properties of the 5G slices may include latency, bandwidth, virtualized network function (VNF) service, and high quality service, to name a few. Thus, SP SR controller234manages SR for network service slices in SP data plane231. The VNF includes any function implemented by a dedicated systems (e.g., as shown inFIG. 12, described below) or virtualized on a general compute system (e.g., as shown inFIG. 13).

SP data plane231generally includes network devices, such as switches and routers, to carry traffic received from and destined for data plane208of enterprise network202. SP data plane231implements 5G slices under control of SP SR controller234, and applies the 5G slices to the traffic as appropriate, as described below. SP data plane231may be extended to include a transport router236that communicates with a cloud-based data center238. SP data plane231includes an provider edge or peer router240connected to network228, a firewall242connected to the provider edge router, and a core SP network244connected to the firewall and network228and configured to implement 5G slices and segment routing in the 5G slices.

Enterprise controller210and SP service gateway232employ distributed enterprise 5G service controller application specific interfaces (APIs) provided by an API engine250for (i) inter-network communication (e.g., between enterprise network202and SP network204), (ii) intra-network communication (e.g., between SP service gateway232and SP SR controller234, and between SP service gateway232and transport router236), and (iii) programming of functions in the SP network to support/extend enterprise network services across the SP network. More specifically, enterprise controller210employs an enterprise controller-to-SP gateway (GW) API252(also labeled “DNA-C to SP API GW,” inFIG. 2) to communicate with SP service gateway232. SP service gateway232employs an API254(also labeled “SP API-GW”) to communicate with API252of enterprise controller210, an API256(also labeled “SP core API-GW”) to communicate with SP SR controller234, and an API258(also labeled “SP transport API-GW”) to communicate with transport router236. APIs254,256, and258communicate with each other. As indicated inFIG. 2, SP service gateway232may employ API254to configure/program provider edge router240and firewall242as an SP/enterprise (ENT) (“SP/ENT”) demilitarized (network) zone (DMZ). Components/services/applications designated with the label “SP/ENT” inFIG. 2indicates that those components/services/applications are extended across enterprise network202and SP network204. SP service gateway232may employ API256to provision/program 5G slices on core network244to implement SP/ENT virtual sessions and SP/ENT virtualization. SP service gateway232may employ API258to configure/program transport router236with an SP/ENT slice virtual topology.

Embodiments presented herein create different network constructs and applications between control planes of enterprise network202and SP network204to satisfy enterprise network requirements to be imposed on traffic traversing SP data plane231of the SP network. The control planes include, for example, applications and protocols between network devices that determine paths in the data plane. At a high-level, the constructs and applications include the following:a. Network slice creation and enterprise use:i. Creates a network association between enterprise network202and SP network204.b. User group to policy distribution from the enterprise network to the SP network:i. Performs management of profiles for enterprise user groups and mapping of the user groups to network services.ii. Maintains enterprise user group sessions in the SP network to carry and apply enterprise user group specific policy to traffic in the SP network.iii. Maintains enterprise user group sessions in the SP network for monitoring and billing of network usage by traffic.c. Mobile device identity distribution from the enterprise network to the SP network:i. Performs mobile device identity authentication between the enterprise network and the SP network.

The embodiments that implement the above-listed constructs and applications are presented in the context of 5G slicing and 5G slices by way of example, only. It is understood that the embodiments apply equally to other types of network slicing and network slices besides 5G slicing and 5G slices, such as network slicing and network slices defined according to standards other than the 5G standards. For example, the embodiments apply, generally, to network slicing and network slices that support communication services of particular connection types with specific ways of handling a data plane and a control plane for the services. Generally, the network slicing creates unique services customized for various use cases, and creates virtual networks for applications that require separate blends of performance, capacity, latency, security, reliability, and coverage, for example.

Each of the above-listed constructs and applications are described in series below. First, network slice creation and enterprise use is described with reference toFIGS. 3-5.

FIG. 3is a block diagram that shows components of enterprise network202and SP network204, and various messages exchanges between the components, employed to create 5G slices and use the 5G slices between the enterprise network and the SP network.FIG. 3is also annotated to indicate various ones of operations of method400(i.e.,402-420) described below in connection withFIG. 4.

Enterprise controller210includes network service manager (NSM)302and an SP SR profile database (DB)304managed by the network service manager. Network service manager302may implemented as a virtual machine (VM) or Linux container (LXC). FB router222includes a network service layer306configured with an SR service profile database, a forwarding information base308, and forwarding logic310, which may be implemented in an application specific integrated circuit (ASIC), for example.

SP data plane231may include a physical network infrastructure of interconnected switches and routers312configured to implement segment routing for 5G slices under control of SP SR controller234.

FIG. 4shows example operations of a method400(also designated inFIG. 3) directed to network slice creation and enterprise use performed by the components shown inFIG. 3, according to an embodiment.FIG. 4is now described with continued reference toFIG. 3. According to operations of method400, SP network204provisions/creates 5G slices on SP data plane231in real-time responsive to requests for the 5G slices from/originated by enterprise controller210, as described below.

At402, in an a priori operation, enterprise controller210is provisioned to request a 5G slice from SP network204.

At404, enterprise controller210(e.g., NSM302) sends to SP service gateway232a network segment request for a 5G slice. The request may specify properties for the 5G slice that satisfy/match enterprise network requirements for traffic.

At406, SP service gateway232receives the network segment request and, responsive thereto, sends a get/create network segment request to SP SR controller234. The get network segment request may also specify the properties of the 5G slice. Accordingly, at operations402and404, enterprise controller210sends the network segment request to SP SR controller234through SP service gateway232.

At408, SP SR controller234receives the get network segment request and, responsive thereto, provisions on SP data plane231a 5G slice having the properties as specified in the get network segment request. SP SR controller234also generates an identifier of the 5G slice that is understood by the SP SR controller. The identifier represents an SR binding segment/slice identifier (ID) (BSID) or “token” that references the 5G slice, and binds the 5G slice to traffic in enterprise network202(see operation420described below) and to segment routing used for the 5G slice in SP data plane231.

At410, once SP SR controller234has provisioned the 5G slice on SP data plane231, the SP SR controller generates, and sends to SP service gateway232, a get network service response that includes the identifier of the 5G slice and the properties of the 5G slice.

At412, SP service gateway232receives the get network segment response, and forwards the response to enterprise controller210. Enterprise controller210saves the identifier of the 5G slice and the properties associated with the 5G slice in a network service profile in SP SR profile DB304. Over time, multiple repetitions of operations404through412store information for multiple 5G slices in the network service profile, including identifiers of the multiple 5G slices and the properties of the 5G slices.

At414, FB router222sends to enterprise controller210a network service request for the network service profile.

At416, enterprise controller210receives from FB router222the network service request and, responsive thereto, sends to FB router222a network service response including the network service profile.

At420, FB router222receives the network service response including the network service profile, and configures data plane208based on the 5G slice information in the network service profile. Specifically, FB router222configures traffic traversing data plane208with particular ones of the identifiers of the 5G slices that match the traffic. To configure the traffic, FB router222first determines the particular ones of the 5G slices that match the traffic based on a comparison of traffic policies (e.g., level of QoS) associated with the traffic, as defined in the enterprise network, and the properties associated with the 5G slices (e.g., low latency, high bandwidth, VNF service, and so on). In other words, FB router222maps the 5G slices to the traffic based on the properties of the 5G slices and the traffic policies. Then, FB router222applies the identifiers of the 5G slices to the traffic based on results of the determining/mapping. For example, FB router inserts the identifiers for the 5G slices into packet headers of IP packets in the traffic. FB router222then forwards the traffic configured with the identifiers to SP data plane231.

With reference toFIG. 5, there are shown example operations of method500directed to network slice creation and enterprise use performed by the components shown inFIG. 3, according to another embodiment. Operations of method500are similar to operations of method400, except that according to operations of method500, SP network204provisions/creates 5G slices on SP data plane231in an a prior operation, and then returns information about the 5G slices to enterprise controller210responsive to a request for that information from the enterprise controller, as described below. Operations502-520correspond, more or less, with operations402-420, respectively.FIG. 5is now described also with continued reference toFIG. 3.

At501, in an a priori operation, SP SR controller234provisions multiple 5G slices on SP data plane231. The 5G slices have respective identifiers and properties associated with the 5G slices. In an example, the 5G slices may include a first slice configured to impose low latency on traffic, a second slice configured for high bandwidth traffic, a third slice configured to provide VNF service for traffic, and a fourth slice configured to provide high quality service for traffic. That is, the low latency, the high bandwidth, the VNF service, and the high quality service represent the respective properties of the first, second, third, and fourth 5G slices, respectively. The 5G slices have respective identifiers, i.e., 5G slice identifiers.

At502, in an a priori operation, enterprise controller210is provisioned to request information about the 5G slices from SP network204.

At504, enterprise controller210sends to SP service gateway232a network segment request for the 5G slices provisioned on SP data plane231, i.e., for information about the 5G slices.

At506, SP service gateway232receives the network segment request and, responsive thereto, sends a get network segment request to SP SR controller234.

At508, SP SR controller234receives the get network segment request.

At510, responsive to the get network segment request, SP SR controller234sends to SP service gateway232, a get network service response that includes the respective identifiers of the 5G slices and their properties.

At512, SP service gateway232receives the get network segment response (i.e., the information about the 5G slices that was previously requested), and forwards the response to enterprise controller210. Enterprise controller210saves the respective identifiers of the 5G slices and their properties in the network service profile of SP SR profile DB304.

At514, FB router222sends to enterprise controller210a network service request for the network service profile.

At516, enterprise controller210receives from FB router222the network service request and, responsive thereto, sends to FB router222a network service response including the network service profile.

At520, FB router222receives the network service response including the network service profile, and configures data plane208based on the 5G slice information in the network service profile, as described above in connection with operation420. FB router222may configure different types of traffic for the different types of 5G slices. For example, FB router222may configure (i) first QoS traffic (i.e., a first QoS traffic flow) with a first identifier of a 5G slice that matches the first QoS traffic, (ii) second QoS traffic with a second identifier of a 5G slice that matches the second QoS traffic, and so on.

User group to policy distribution from enterprise network202to SP network204is now described with reference toFIGS. 6 and 7.

FIG. 6is a block diagram that shows components of enterprise network202and SP network204, and various message exchanges between the components, employed to implement user group to policy distribution from enterprise network202to SP network204.FIG. 6is also annotated with indicators of various ones of operations of method700(i.e.,702-708) described below in connection withFIG. 7.

As shown inFIG. 6, enterprise controller210includes user group profile manager (UGPM)602(also referred to as a “policy and assurance manager”) in addition to network service manager302and an SP SR profile DB304, described above. User group profile manager602is primarily responsible for user group to policy distribution, as described below. Also, SP network204includes a policy, monitoring, and billing manager604to map user group sessions to 5G slices and store resulting mappings in a local database606.

With reference toFIG. 7, there are shown example operations of method700(also indicated inFIG. 6) directed to user group to policy distribution from enterprise network202to SP network204performed by the components shown inFIG. 6, according to an embodiment. Operations of method700assume that SP SR profile DB304stores information about 5G slices provisioned on SP network204. Such information may include first, second, third, and fourth 5G slice identifiers for latency, bandwidth, VNF service, and quality slices, acquired from operations502-512described above.FIG. 7is now described with continued reference toFIG. 6.

At702, enterprise controller210(e.g., UGPM602) identifies enterprise network user groups for groups users in enterprise network202, and traffic policies associated with the user groups. The traffic policies are to be applied traffic associated with the user groups. The user groups and the traffic policies may be provisioned on/defined by enterprise network202and stored in an enterprise network database accessible to UGPM602. The user groups are identified by respective user group identifiers, e.g., security group tags (SGTs), and may be linked to respective ones of the traffic policies via respective identifiers of the traffic policies. Enterprise controller210determines user group-to-traffic policy mappings of the user groups to the respective traffic polices associated with the user groups, and stores the user group-to-traffic policy mappings locally. In other words, enterprise controller210maps the user groups to the traffic policies associated with the user groups. The user group-to-traffic policy mappings may take the form of tuples [user group, traffic policy], for example. In this way enterprise controller210binds/associates the user groups to/with their associated traffic policies.

At704, enterprise controller210determines user group-to-5G slice mappings of (i.e., maps) the user groups to those 5G slices that match the user groups based on the traffic policies associated with the user groups and the properties of the 5G slices. The user group-to-5G slice mappings may take the form of (identifier) tuples [user group, 5G slice], for example. To perform the mapping, enterprise controller210may compare the properties of the 5G slices provisioned on SP network204, as stored in SP SR profile DB304, to the traffic policies, and then perform the mapping based on results of the compare. For example, a low latency 5G slice would be deemed a match to a traffic policy that requires low latency, as indicated in a QoS value, and so on.

At706, enterprise controller210sends to SP service gateway232a user group register request that includes the user group-to-traffic policy mappings (i.e., first mappings [user group, traffic policy]) and the user group-to-5G slice mappings (i.e., second mappings [user group, 5G slice]). In response, SP service gateway232forwards to policy, monitoring, and billing (PMB) manager604a user group session create request accompanying the user group-to-traffic policy mappings (i.e., first mappings) and the user group-to-5G slice mappings (i.e., second mappings).

At708, in response to receiving the mappings from SP service gateway232sent at706, PMB manager604stores the mappings in local database606, and configures/programs the associations indicated by the second mappings [user group, 5G slice] into SP data plane231, to ensure traffic traversing SP network204experiences end-to-end consistent network characteristics and performance. PMB manager604also uses the first mappings [user group, traffic policy] to establish enterprise user group sessions that monitor the traffic (e.g., traffic usage) traversing SP network204and apply billing services to the traffic consistent with the user group and traffic policy associations, e.g., based on the first mappings. PMB manager604also sends a user group session response to enterprise controller210through SP service gateway232.

At710, SP service gateway232sends to SP SR controller234the user group-to-traffic policy mappings (i.e., first mappings [user group, traffic policy]) and the user group-to-5G slice mappings (i.e., second mappings [user group, 5G slice]). In response, at712, SP SR controller234programs/configures network devices of data plane231with information from the first and second mappings to enable/cause the data plane to handle traffic from enterprise network202according to the mappings. For example, SP service gateway232may program a provider edge router in data plane231(see, e.g., provider edge router PE1ofFIG. 11, described below) with the first mappings and the second mappings, so that the provider edge is able to (i) examine traffic from enterprise network202for various indicators configured in the traffic by the enterprise network, e.g., for identifiers of user groups (e.g., SGTs) and identifiers of 5G slices, and (ii) apply to the traffic the traffic policies that correspond to the identifiers of the user groups found in the traffic according to the first mappings, (ii) and steer the traffic to the 5G slices that correspond to the identifiers of the 5G slices found in the traffic.

Thus, in operations700, enterprise controller210sends to the first mappings and the second mappings to control functions (e.g., SP SR controller234and PMB manager604) of service provider network204through/via SP service gateway232. The control functions are responsible for controlling and monitoring the network traffic (from enterprise network202) traversing data plane208of service provider network204. The control functions perform the controlling and monitoring based on the first mappings and the second mappings, i.e., the first mappings and the second mappings cause the control functions to perform the controlling and monitoring according to the first mappings and the second mappings.

Mobile device (MD) identity distribution from enterprise network202to SP network204is now described with reference toFIGS. 8 and 9.

FIG. 8is a block diagram that shows components of enterprise network202and SP network204, and various message exchanges between the components, employed to implement mobile device identity distribution from enterprise network202to SP network204.FIG. 8is also annotated to indicate various ones of operations900(i.e.,902-906) described below in connection withFIG. 9. As shown inFIG. 8, enterprise network202includes an identity services engine (ISE)801configured with a mobility identity manager (also referred to as a “mobility identity register”) that acquires mobile device identities from mobile devices, e.g., mobile device212, and registers the mobile device identities locally. Enterprise controller210includes a mobility identity manager802, peered with the mobility identity manager of ISE801, in addition to other components described above. Mobility identity manager802maintains respective user mobile device identities for mobile devices and also respective SP contexts associated with the mobile device identities. Also, SP network204includes an identity-and-authentication service function/server (AUSF) (identity-and-AUSF)804to perform authentication of mobile devices and to register the mobile devices in SP network204.

With reference toFIG. 9, there are shown example operations900(also indicated inFIG. 8) directed to mobile device identity distribution from enterprise network202to SP network204performed by the components shown inFIG. 8.FIG. 9is described with continued reference toFIG. 8.

At902, the mobile identity manager of ISE801learns a mobile device identity of mobile device212at the location of enterprise network202, registers the mobile device identity in the enterprise network, and passes the mobile device identity to symmetric/peer mobility identity manager802of enterprise controller210. The mobile device identity is a unique identifier of the mobile device.

At904, enterprise controller210(e.g., mobility identity manager802) receives the mobile device identity. Enterprise controller210forwards to identity-and-AUSF804, through SP service gateway232, a device identity register request including the mobile device identity. Responsive to the request, identity-and-AUSF804authenticates mobile device212based on its mobile device identity, and registers the mobile device in SP network204.

At906, once the mobile device identity is registered in SP network904, identity-and-AUSF804sends to mobility identity manger802, through SP service gateway232, a device identity register response indicating the mobile device identity was authenticated successfully and registered in SP network204. Mobility identity manager802stores/maintains locally the authenticated, registered device identity linked to an SP context associated with the identity, e.g., the indication that the identity was successfully authenticated.

With reference toFIG. 10, there is a block diagram of enterprise network202and SP network204that shows a combination of components and message transactions described above in connection withFIGS. 3-9. In other words,FIG. 10shows components and message transactions of enterprise network202and SP network204employed to implement (i) network slice creation and enterprise use, (ii) user group to traffic policy distribution from the enterprise network to the SP network, and (iii) mobile device identity distribution from the enterprise network to the SP network.

FIG. 11is a diagram of detailed message flows or transactions1100(collectively referred to as transactions1100) between enterprise network202and the SP network204. Transactions1100include various ones of the messages/transactions described above, primarily in connection with the real-time provisioning and reporting of 5G slices of method400ofFIG. 4, with further details added to the messages/transactions. InFIG. 11, mobile device212has a source IP address A, and a device identity ID, and originates traffic destined for an endpoint device (i.e., “endpoint”)1102(shown at the lower right-hand side ofFIG. 12) having a destination IP address Z. FB router222has an IP address designated as FB. FE220of data plane208is also designated FE1. Also, SP data plane231includes a provider edge (PE) router PE1, a physical “SP network”1106corresponding to components242and/or244ofFIG. 2, and a provider edge router PE2to communicate with endpoint1102. SP network204includes a segment route comprising network devices S1, S2, and S3configured to implement a provisioned 5G slice having an identifier X, referred to inFIG. 11as a binding segment ID (BSID) X.

Transactions1106,1108, and1109implement mobile device identity distribution from enterprise network202to SP network204, as described above in connection withFIGS. 8 and 9. In transactions1106,1108, and1109, “register: ID” represents the device identity register request described above, and “res” represents the device identity response described above. The request and response include the mobile device identity ID.

Transaction1110A,1110B, and1110C collectively represent a 5G slice request from FB router222to SP SR controller234that includes mobile device identity ID, source IP address FB, destination IP address Z, and an App designator. In an example, the App designator may include a QoS value for traffic to be handled by the requested 5G slice. The App designator may be translated to an attribute designator Attr at enterprise controller210. Transactions1110A,1110B, and1110C correspond generally to transactions414,404, and410described above, but in a permuted order.

Responsive to the 5G slice request, SP SR controller234performs function f (FB, Z, “Color”), which returns SR Policy (i.e., list of segment identifiers to visit) <BSID=X: S1, S2, S3, PE2>, in which S1is the first segment identifier to visit, S2is the second segment identifier to visit, and S3is the last segment identifier to visit. The designator “Color” represents a transformation of the attribute Attr, which represents the designator App. In other words, the designator Color maps back to the QoS value to be supported by the 5G slice. The function determines/establishes the segment routing policy <X: S1, S2, S3> for the 5G slice. SP SR controller234configures the 5G slice having identifier BSID=X with segment route S1, S2, S3, exiting at PE2on SP data plane231, to implement the required segment routing policy translated from App. The configured routing may include, for example, Border Gateway Protocol (BGP) Link State (LS) (BGP-LS). SP SR controller234configures provider edge router PE1with 5G slice identifier BSID=X and forwarding information to enable/cause PE1to forward traffic to segment route S1, S2, S3. Also, using transactions1114A,1114B, and1114C, which correspond generally to transactions410,412, and416described above, SP SR controller234forwards to fabric border router222a response to the 5G slice request. The response includes information for the 5G slice, such as identifier BSID=X and properties associated with the 5G slice.

Responsive to receiving the 5G slice response including BSID=X, FB router222configures data plane208with BSID=X. To do this, FB router222applies the following function to traffic traversing data plane208:

where the control variables A, FB, Z, and App may be accessed from headers of IP packets in the traffic, and ID may be accessed from enterprise controller210.

The function returns BSID=X (i.e., the identifier of the 5G slice provisioned on SP data plane231) responsive to the control variables ID, A, FB, Z, and App (e.g., QoS value) in the traffic. The function matches App (e.g., QoS value) in the traffic to the properties of the 5G slice.

Armed with the identifier X of the 5G slice, FB router222configures traffic according to the following rule: Traffic (A, BSID:X) (Z; Segments Left (SL)=1). In other words, FB router222inserts BSID=X into packet headers of IP packets having source IP address A, and destined for endpoint Z. FB router222then forwards the configured traffic to SP network204.

Provider edge router PE1receives the configured traffic from FB router222, and applies the following function to the traffic:

In other words, the provider edge router PE1accesses the BSID (which has value X) from the packet headers of the traffic, and plugs the BSID into the function. In this case, BSID=X is mapped to segment router S1, S2, S3, exiting at PE2. Accordingly, provider edge router PE1steers the traffic to the segment route for the 5G slice with BSID=X, based on the BSID, according to the rule:

In other words, traffic with source IP address A and destination IP address Z is routed from PE1to next hop S1; from there, the traffic reaches PE2via S2and S3.

While the transactions ofFIG. 11correspond primarily to the real-time provisioning and reporting of 5G slices of method400, by way of example, slight modifications to the transactions may be made to implement the a priori provisioning of 5G slices and then reporting of the 5G slices as described above in connection with method500ofFIG. 5. For example, SP SR controller234configures multiple 5G slices on SP data plane231in an a prior operation, that preserves multiple corresponding identifiers BSIDs, one per 5G slice, as described above. Then, responsive to a request “REQ” originated from FB router222, and forwarded to SP SR controller234, the SP SR controller returns the identifiers BSIDs of the pre-provisioned 5G slices to the FB router, which applies the BSIDs to corresponding traffic flows destined from the 5G slices.

With reference toFIG. 12, there is a block diagram of an example network device1200representative of a router or a switch (e.g., any of the routers and switches in enterprise network202and SP network204), for example. Network device1200comprises a network interface unit having a plurality of network input/output (I/O) ports1242(1)-1242(M) to send traffic to and receive traffic from a network, and to forward traffic in the network, a packet forwarding/processing unit1243, a network processor1244(also referred to simply as “processor”), and a memory1246. The packet forwarding/processing unit1243is, for example, one or more application specific integrated circuits (ASICs) that include packet buffers, packet queues, and other control logic for performing packet forwarding operations. The processor1244may include multiple processors, which may be implemented as software or hardware processors. For example, processor1244may include a microcontroller or microprocessor that is configured to perform higher level controls of network device1200. To this end, the memory1246stores software instructions that, when executed by the processor1244, cause the processor1244to perform a variety of operations including operations described herein. For example, the memory1246stores instructions for control logic1250to perform operations described herein. Control logic1250may also include logic components in packet forwarding unit1243.

Memory1246also stores data1260used and generated by logic1250, including packet loss information, for example.

With reference toFIG. 13, there is a block diagram of an example computer device1300representative of controller devices (i.e., controllers) or service gateways in enterprise network202and SP network204, such as enterprise controller210, SP service gateway232, SP SR controller234, identity-and-AUSF408, PMB manager604, and so on. More generally, computer device1300may host control application and APIs, such as API engine250. Computer device1300includes network interface unit1305to communicate with a wired and/or wireless communication network, and to control network devices over the network. Computer device1300also includes a processor1354(or multiple processors, which may be implemented as software or hardware processors), and memory1356. Network interface unit1305may include an Ethernet card with a port (or multiple such devices) to communicate over wired Ethernet links and/or a wireless communication card with a wireless transceiver to communicate over wireless links.

Memory1356stores instructions for implementing methods described herein. Memory1356may include read only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical/tangible (non-transitory) memory storage devices. The processor1354is, for example, a microprocessor or a microcontroller that executes instructions stored in memory. Thus, in general, the memory1356may comprise one or more tangible computer readable storage media (e.g., a memory device) encoded with software comprising computer executable instructions and when the software is executed (by the processor1354) it is operable to perform the operations described herein. For example, memory1356stores control logic1358to perform operations for controllers as described herein.

The memory1356may also store data1360used and generated by logic1358.

With reference toFIG. 14, there is a flowchart of an example method1400performed primarily by enterprise controller210. Method1400includes operations described above.

At1402, enterprise controller210sends to service gateway232of service provider network204a request for 5G slice information about 5G slices provisioned on data plane231of the service provider network.

At1404, responsive to the sending, enterprise controller210receives, from service gateway232the 5G slice information including identifiers of and properties associated with the 5G slices.

At1406, responsive to receiving a request for the 5G slice information from a network device (e.g., FB router222) at a border of forwarding plane208of enterprise network202, enterprise controller210sends the 5G slice information to the network device to cause the network device to perform configuring network traffic in forwarding plane208with the identifiers of particular ones of the 5G slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers to data plane231of service provider network204.

With reference toFIG. 15, there is an illustration of an example IP packet1500of traffic forwarded from forwarding plane208to SP data plane231, after enterprise controller210has configured the IP packet according to embodiments presented herein. IP packet1500includes one or more headers1502. The one or more headers include a QoS value1504, an identifier1506of a 5G slice (i.e., a 5G slice identifier (ID)1506), and an identifier1508of a user group (i.e., a user group ID1508, which may be an SGT).

In summary, conventionally, in an enterprise network, enterprise segmentation and transport services are limited to an enterprise overlay. Extending those services end-to-end across the enterprise network and software defined (SD) WAN (SDWAN) is critical to the enterprise network for service assurance, and to a service provider for differentiation of their network offerings. To overcome the above-mentioned limitation, embodiments presented herein extend the enterprise segmentation and transport services from the enterprise network into a service provider network through automation of provisioning 5G slices by the enterprise network, and define an implementation in a segment routing underlay for 5G slices. Thus, the embodiments combine the provisioning and deployment of enterprise segmentation policy, service layer agreement (SLA), and 5G slices across the heterogeneous enterprise and SP networks, end-to-end. This extends enterprise network service provisioning to the SP network, for consistent quality of experience, regardless of access method (SP 5G or enterprise access). The embodiments provide a process for automating provisioning of SP 5G slices using an SR underlay, a process for distribution of user group association to policy and network slice, and a process for distribution of endpoint device identity between the enterprise network and the SP network to map identity to group policy to provide consistent quality of experience.

In summary, in one form, a method is provided comprising: by an enterprise controller of an enterprise network: sending to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network; responsive to the sending, receiving, from the service gateway the network slice information including identifiers of the network slices and properties associated with the network slices; and responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, sending the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers of the ones of the network slices to the data plane of the service provider network.

In another form, an apparatus is provided comprising: a network interface unit; and a processor of an enterprise controller of an enterprise network coupled to the network interface unit and configured to perform: sending to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network; responsive to the sending, receiving, from the service gateway the network slice information including identifiers of the network slices and properties associated with the network slices; and responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, sending the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers of the ones of the network slices to the data plane of the service provider network.

In a further form, a non-transitory computer readable storage medium is provided. The One or more non-transitory computer readable media are encoded with instructions that, when executed by one or more processors, cause the one or more processors to perform, by an enterprise controller of an enterprise network: sending to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network; responsive to the sending, receiving, from the service gateway the network slice information including identifiers of the network slices and properties associated with the network slices; and responsive to receiving a request for the network slice information from a network device at a border of a forwarding plane of the enterprise network, sending the network slice information to the network device to cause the network device to perform configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic, and to perform forwarding the network traffic configured with the identifiers of the ones of the network slices to the data plane of the service provider network.

In yet another form, a system is provided comprising: a network device at a border of a forwarding plane of an enterprise network; and an enterprise controller of the enterprise network and configured to perform: sending to a service gateway of a service provider network a request for network slice information about network slices provisioned on a data plane of the service provider network; responsive to the sending, receiving, from the service gateway the network slice information including identifiers of the network slices and properties associated with the network slices; and responsive to receiving a request for the network slice information from the network device, sending the network slice information to the network device; wherein the network device is configured to perform: responsive to the network slice information, configuring network traffic in the forwarding plane with identifiers of ones of the network slices that match the network traffic; and forwarding the network traffic configured with the identifiers of the ones of the network slices to the data plane of the service provider network.

Although the techniques are illustrated and described herein as embodied in one or more specific examples, it is nevertheless not intended to be limited to the details shown, since various modifications and structural changes may be made within the scope and range of equivalents of the claim.