Edge network virtualization

A virtual edge router network for providing managed services to distributed remote office locations can include routing components that are capable of being autonomously deployed at the network edge, as well as remotely managed, thereby obviating the need for on-site technical support in remote offices of the a small and medium business (SMB) client. Autonomous deployment and remote management is achieved through abstraction of the control and management planes from the data plane. Virtual edge routers may include virtual forwarding units and virtual remote agents instantiated on host devices in each remote office location, as well as a virtual network controller instantiated on a host device in a head-office location. A data plane of the virtual edge router communicatively couples the virtual forwarding units to one another, while a control plane communicatively couples the virtual network controller to each virtual data forwarding unit.

TECHNICAL FIELD

The present invention relates generally to telecommunications, and in particular embodiments, to techniques and mechanisms for edge network virtualization.

BACKGROUND

Small and medium businesses (SMBs) are becoming increasingly data intensive as industries adapt to the information age. This has created a demand for cost-effective network solutions capable of efficiently delivering services across distributed locations in a secure and reliable manner. Notably, conventional enterprise networks are designed primarily for large corporations, and may be ill-suited for many SMB applications. Specifically, conventional enterprise networks typically require technical support at the network edge in order to deploy and service network equipment in remote office locations. Since many SMB clients do not employ on-site information technology (IT) personnel, the deployment and maintenance of conventional enterprise network equipment in SMB remote offices may require service calls by certified technicians, which may significantly increase the up-front and/or operational expenses of providing conventional enterprise networks to SMB clients. Accordingly, techniques and systems for providing affordable, yet capable, network solutions to SMB clients are desired.

SUMMARY OF THE INVENTION

Technical advantages are generally achieved, by embodiments of this disclosure which describe edge network virtualization.

In accordance with an embodiment, a virtual edge router is provided. In this example, the virtual edge router includes a plurality of virtual data forwarding units, and a data plane communicatively coupling the plurality of virtual data forwarding units with one another. Each virtual forwarding unit is instantiated on a different one of a plurality of host devices, and the data plane includes data tunnels extending between WAN interfaces of the host devices. The virtual edge router further includes a virtual controller instantiated on a central host device, and a control plane communicatively coupling the virtual controller to each of the virtual data forwarding units. The control plane includes control tunnels interconnecting a WAN interface of the central host device to WAN interfaces of the plurality of host devices.

In accordance with another embodiment, a local host device is provided. In this example, the local host device includes a wide area network (WAN) interface, a processor, and a memory adapted to store programming for execution by the processor. The programming including instructions to send a beacon message to a virtual network commander instantiated on a server. The beacon message is configured to establish a management tunnel between the WAN interface of the local host device and the virtual network commander on the server. The management tunnel is adapted to carry signaling over a management plane of a virtual edge router. The programming further includes instructions to trigger establishment of a control tunnel between the WAN interface of the local host device and a WAN interface of a first remote host device. The control tunnel is adapted to carry signaling over a control plane of the virtual edge router. The programming further includes instructions to trigger establishment of a data tunnel adapted to carry signaling over a data plane of the virtual edge router. Each of the data plane, the control plane, and the management plane have a distinct communication plane topology.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

The making and using of embodiments of this disclosure are discussed in detail below. It should be appreciated, however, that the concepts disclosed herein can be embodied in a wide variety of specific contexts, and that the specific embodiments discussed herein are merely illustrative and do not serve to limit the scope of the claims. Further, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of this disclosure as defined by the appended claims. While much of this disclosure discusses virtual networking solutions for SMB clients, those of ordinary skill in the art will recognize that the underlying concepts are scalable to any size system, including (but not limited to) large enterprise networks. Various concepts are disclosed in U.S. Provisional Patent Application 62/018,350, U.S. Provisional Patent Application 62/018,389, U.S. Provisional Patent Application 62/018,398, U.S. Provisional Patent Application 62/018,408, U.S. Provisional Patent Application 62/018,421, U.S. Provisional Patent Application 62/018,433, U.S. Provisional Patent Application 62/018,443 are, each of which are incorporated by reference herein as if reproduced in their entireties.

Disclosed herein is a virtual edge router network for providing managed services to distributed SMB remote office locations. Advantageously, embodiment virtual edge router networks allow distributed host devices to be autonomously deployed at the network edge, as well as remotely managed, thereby obviating the need for on-site technical support in remote offices of the SMB client. Embodiment virtual edge router networks achieve autonomous deployment and remote management capabilities through abstraction of the control and management planes from the data plane. Briefly, an embodiment virtual edge router includes virtual machines instantiated on host devices positioned at remote office locations of an SMB client. The virtual machines include virtual forwarding units and virtual remote agents instantiated on host devices in each remote office location, as well as a virtual network controller instantiated on a host device in a head-office location of the SMB client. The data plane of the virtual edge router communicatively couples the virtual forwarding units to one another and includes data tunnels interconnecting each host device with every other host device in the virtual edge router, thereby providing a direct data path connection between each pair of virtual forwarding units. The control plane communicatively couples the virtual network controller to each virtual data forwarding unit and includes control tunnels interconnecting the host device positioned at the head-office location to host devices positioned at each branch-office location. The management plane interconnects each of the virtual remote agents with a virtual network commander instantiated on a server, which is maintained by a managed service provider (MSP). Embodiment virtual edge router architectures, as well as embodiment techniques for establishing, operating, and modifying said architectures, are described in greater detail below.

FIGS. 1A-1Dillustrate a virtual edge router100comprising a plurality of virtual data forwarding units110,120,130, a virtual controller140, and a plurality of virtual remote agents116,126,136,146. The virtual forwarding units110,120,130, the virtual controller140, and the virtual remote agents116,126,136,146(referred to collectively as “virtual components”) may comprise any hardware, software, or combinations thereof within the host devices101-104. For example, one or more of the virtual components110-146may be a virtual machine instantiated on a corresponding one of the host devices101-104. As another example, one or more of the virtual components110-146may be a dedicated hardware component (e.g., application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), etc.) housed by a corresponding one of the host devices101-104. For purposes of this disclosure, an object “instantiated” on a host device refers to any instance of software and/or hardware installed-on and/or housed-by the host device. The virtual edge router100may be managed by a virtual commander160, which may be instantiated on a server106. As used herein, the term “server” may refer to any component or collection of components maintained by a managed service provider. For example, the server106may correspond to a network of computing devices in a cloud computing data center or in a network of distributed data centers. As shown inFIG. 1A, the host devices101,102,103,104and the server106comprise wide area network (WAN) interfaces115,125,135,145,165(respectively) configured to communicate over a wide area network190.

The virtual forwarding units110-130are data plane entities of the virtual edge router100. The terms “virtual forwarding unit,” “virtual data forwarding unit,” and “virtual forwarding switch” (vFS) are used interchangeably throughout this disclosure. As shown inFIG. 1B, the virtual forwarding units110,120,130are interconnected to one another via data tunnels112,113,123extending between WAN interfaces115,125,135of the host devices101-103. The data tunnels112,113,123collectively form a data plane of the virtual edge router100, and correspond to virtual data pathways through the WAN190that are secured by a network tunneling protocol. The virtual forwarding units110,120,130may be configured to forward data packets over the data tunnels112,113,123. Data packets forwarded over the data tunnels112,113,123may be transported over the WAN190without exiting the data plane of the virtual edge router100. In embodiments, the virtual forwarding units110,120,130and/or or the host devices101-103may include LAN interfaces for communicating over a local area network with devices (e.g., computers, printers, etc.) in a remote office of an SMB client. The LAN interfaces of the virtual forwarding units110,120,130and/or or the host devices101-103may collectively represent LAN interfaces (or local/private interfaces) of the virtual edge router100.

The virtual controller140is a control plane entity of the virtual edge router100. The terms “virtual controller,” “virtual network controller,” and “virtual flow controller” (vFC) are used interchangeably throughout this disclosure. As shown inFIG. 1C, the virtual controller140is connected to each of the virtual forwarding units110,120,130via control tunnels141,142,143extending from the WAN interface145of the host device104to each of the WAN interfaces115,125, and135of the host devices101-103. The control tunnels141,142,143collectively form a control plane of the virtual edge router100. The virtual controller140may be configured to forward control packets over the control tunnels141,142,143. Control packets forwarded over the control tunnels141,142,143may be transported over the WAN190without exiting the control plane of the virtual edge router100. The virtual controller140may update and/or manage tables (e.g., routing, egress, etc.) in the virtual data forwarding units110,120,130via control signaling communicated over the control tunnel141,142,143.

The virtual remote agents116,126,136,146are management plane entities of the virtual edge router100. The terms “remote agent” and “virtual remote agent” (vRA) are used interchangeably throughout this disclosure. The virtual commander160may be an internal management plane entity within the virtual edge router100, or an external management device configured to manage the virtual edge router100. The terms “virtual commander” and “virtual network commander” (vNetComm) are used interchangeably throughout this disclosure to refer to management applications in a management server. As shown inFIG. 1D, the virtual commander160is connected to each of the virtual remote agents116,126,136,146via management signaling, which is transported over management tunnels161,162,163extending from the WAN interface165of the server106to each of the WAN interfaces115,125,135,145of the host devices101-104. The virtual remote agents116,126,136,146and the virtual commander160may be configured to forward management packets over the management tunnels161,162,163. Management packets forwarded over the management tunnels161,162,163may be transported over the WAN190without exiting the management plane of the virtual edge router100.

In some embodiments, a virtual controller may be co-located with a virtual forwarding unit in a common host device.FIG. 1Eillustrates an embodiment virtual edge router109in which the virtual controller140and is co-located with a virtual forwarding unit150in a host device105. The host device105includes a virtual remote agent136configured to manage the virtual controller140and the virtual forwarding unit150. As shown, the virtual controller140and the virtual forwarding unit150share a common WAN interface155of the remote device, and an internal control path145extends between the virtual controller140and the virtual forwarding unit150. While the virtual edge router109includes data, control, and management tunnels, those tunnels have been omitted fromFIG. 1Efor purposes of clarity and concision.

The data tunnels112,113,123, control tunnels141,142,143, and management tunnels161,162,163(referred to collectively as “tunnels”) correspond to virtual pathways through the WAN190that are secured through one or more network tunneling protocols. In one embodiment, the same tunneling protocol is used for each of the tunnels112-113,123,141-143,161-163. In another embodiment, different tunneling protocols are used for different tunnel classifications. For example, a different tunneling protocol may be used for the data tunnels112-113,123than for the control tunnels141-143. In yet other embodiments, different tunneling protocols are used for tunnels within the same tunnel classification. For example, a different tunneling protocol may be used for the data tunnel112than for the data tunnel123. Tunneling protocols may use data encryption to securely transport payloads over the WAN190. The WAN190may include any wide area network or collection of wide area networks. In an embodiment, the WAN190corresponds to a public internet. In another embodiment, the WAN190corresponds to a private internet protocol (IP) network. In yet other embodiments, the WAN190includes a collection of public and private IP networks. The WAN190is not limited to IP networks, and may include networks operating under any other network delivery protocol. Unless otherwise specified, the term “wide area network” is used loosely throughout this disclosure to refer to any network (or collection of networks) that serve to interconnect two or more local area networks (LANs).

In some embodiments, a virtual commander may be positioned in a management facility (or network of facilities) maintained by a managed service provider (MSP), while virtual components (e.g., virtual forwarding units, virtual controller, virtual remote agent, etc.) may be instantiated on host devices distributed across multiple remote office locations of an SMB client.FIG. 2illustrates a virtual edge router200comprising a virtual data forwarding unit210, a virtual remote agent216, and a virtual controller240instantiated on a host-device201in a remote office281, and a virtual data forwarding unit220and a virtual remote agent226instantiated on a host-device202in a remote office282. The remote offices281,282are interconnected with one another, as well as with a server206in a managed service provider data center286, via a public internet290. As discussed herein, remote office locations housing a virtual controller are referred to as head-office locations, while remote office locations housing a virtual forwarding switch (but not a virtual network controller) are referred to as branch-office locations.

Embodiments of this disclosure provide virtual architectures for distributed host devices.FIG. 3illustrates an embodiment virtual architecture300for a distributed host device301positioned in a branch office of a SMB client. As shown, the host device301includes a primary WAN interface302and a secondary WAN interface303configured to communicate over the internet390, a LAN interface304configured to communicate with internal destinations via a virtual LAN (VLAN) Ethernet switch395, and a supplemental interface305configured to communicate over a private network, e.g., a multi-protocol label switching (MPLS) network392, etc. The host device301includes a virtual flow switch310, a virtual remote agent320, a plurality of virtual machines340, and a virtualization host service350, which are collectively referred to as virtual components310-350. The virtual components310-350and a host operating system360are interconnected via links and virtual switches371-376. These links are classified as combined links, data links, virtual network (VN) management links, and application management links, as indicated by the legend. Other link classifications may also be included in the virtual architecture300.

FIG. 4illustrates an embodiment virtual architecture400for a distributed host device401positioned in a head office of an SMB client. As shown, the host device401includes a primary WAN interface402and a secondary WAN interface403configured to communicate over the internet490, a LAN interface404configured to communicate with internal destinations via a virtual LAN (VLAN) Ethernet switch495, and a supplemental interface405configured to communicate over a private network492, e.g., a multi-protocol label switching (MPLS) network, etc. The host device401includes a virtual flow switch410, a virtual remote agent420, a virtual controller430, a plurality of virtual machines440, and a virtualization host service450, which are collectively referred to as virtual components410-450. The virtual components410-450and a host operating system460are interconnected via links and virtual switches471-476. The links interconnecting the virtual components410-460and the host operating system460are classified as combined links, data links, control links, VN management links, and application management links, as indicated by the legend. Other link classifications may also be included in the virtual architecture400.

The combined data links in the virtual architectures300,400may include each of the other link classifications. For example, the combined data links in the virtual architectures300,400may include a multiplexed combination of data links, control links, virtual network (VN) management links, and application management links. The data links may carry data in the virtual edge network. The data may include incoming data communicated from an external source (e.g., from the internet390,490) to an internal destination (e.g., device connected to Ethernet switch395,495), as well as outgoing data communicated from an internal source to an external destination. The data may also include internal data communicated from an internal source to an internal destination. The control links may carry control signaling in the virtual edge network. Control signaling may include signaling communicated from the virtual controller430to other virtual machines in the virtual edge network, e.g., the virtual flow switches310,410, etc., and vice-versa. The VN management links and application management links may carry management signaling in the virtual edge network. Management signaling may include signaling communicated from a virtual commander to one of the virtual remote agents320,420, as well as signaling instructions communicated from the virtual remote agents320,420to other virtual machines in the virtual edge network.

The virtual edge routers provided herein can be embodied in a cloud computing network architecture.FIG. 5illustrates a virtual edge router500embodied in a cloud computing network architecture. As shown, the virtual edge router500comprises an SMB headquarter cloud501, an SMB MicroCloud502, and an MSP cloud506. The SMB HQ cloud501includes a virtual flow switch510, a virtual remote agent516, and a virtual flow controller540. The virtual flow switch510, the virtual remote agent516, and the virtual flow controller540may be instantiated on the same host device. Alternatively, the virtual flow switch510, the virtual remote agent516, and/or the virtual flow controller540may be instantiated on different host devices communicating via a local area network of the SMB HQ cloud501. The SMB MicroCloud502includes a virtual flow switch520and a virtual remote agent526. The virtual flow switch520and the virtual remote agent526may be instantiated on the same or different host devices within the SMB MicroCloud502. The MSP cloud506includes a virtual network commander560instantiated on an MSP server. Components within the SMB headquarter cloud501, the SMB MicroCloud502, and the MSP cloud506may communicate via a public internet590. In some embodiments, components within the SMB headquarter cloud501and the SMB MicroCloud502may communicate over a private network595.

The management and control planes may be abstracted from the data plane in embodiment virtual edge routers architectures.FIG. 6illustrates a diagram depicting abstracted communications planes600in the virtual edge router architecture500. As shown, the abstracted communications planes600include a data plane, a control plane, and a management plane. The management plane interconnects management plane entities640to one another, as well as connecting management plane entities640to both control plane entities670and data plane entities. The control plane interconnects control plane entities640to data plane entities610, while the data plane interconnects data plane entities610to one another. Management plane entities660include the virtual network commander560, the virtual remote agents516,526, and management applications, e.g., a session manager, etc. Control plane entities640include the virtual controller540as well as control plan applications, while the data plane entities include the virtual flow switches510,520as well as data plane applications. As shown inFIG. 6, each of the data plane, the control plane, and the management plane have a distinct communication plane topology.

FIG. 7illustrates communications planes of a virtual edge router embodied in a cloud computing network architecture700. As shown, the cloud computing network architecture700comprises an SMB headquarter cloud701, an SMB MicroClouds702,703and an MSP cloud706. The SMB HQ cloud701includes a virtual flow switch710, a virtual remote agent716, and a virtual flow controller740. The virtual flow switch710, the virtual remote agent716, and the virtual flow controller740may be virtual machines instantiated on the same host device, or on different host devices communicating via a local area network of the SMB HQ cloud701. The SMB MicroCloud702includes a virtual flow switch720and a virtual remote agent726. The virtual flow switch720and the virtual remote agent726may be virtual machines instantiated on the same host device, or on different host devices communicating via a local area network of the SMB MicroCloud702. The SMB MicroCloud703includes a virtual flow switch730and a virtual remote agent736, which may be virtual machines instantiated on the same host device, or on different host devices communicating via a local area network of the SMB MicroCloud703. The MSP cloud706includes a virtual net commander760, which may correspond to a management controller on a server. Components within the SMB headquarter cloud701, the SMB MicroClouds702,703and the MSP cloud706may communicate via a public internet790. In an embodiment, a client graphical user interface (GUI)770may interact with the virtual network commander760to configure/re-configure components of the virtual edge router.

FIG. 8illustrates an embodiment host device800configured to be deployed in a virtual edge routing network. As shown, the embodiment host device800comprises hardware that includes one or more processors810, a hard drive820, and random access memory830, as well as software that includes virtual machines850, a virtual machine monitor840, and a virtualization manager860. The processors810may include any hardware components configured to execute programming instructions. In an embodiment, the processors810are configured to perform parallel processing, e.g., massively parallel processing (MPP). The hard drive820may include any hardware components configured to permanently or statically store digital information. In an embodiment, the hard drive820is a solid state drive (SSD). The random access memory830may include any hardware components configured to temporarily or dynamically store digital information. The virtual machines840may be software-based emulations of machines (e.g., computers) configured to execute programs. The virtual machine monitor850may include any component configured to create and run the virtual machines840, and the virtualization manager860may be any component configured to manage the virtual machines840. While typically embodied as software, the virtual machine monitor850and the virtualization manager860may include firmware and/or hardware in some implementations.

Aspects of this disclosure provide methods for establishing communications planes of a virtual edge router.FIG. 9illustrates a method900for establishing abstracted communications planes in a virtual edge router, as might be performed by a local host device housing a virtual network controller. Within the context ofFIG. 9, steps performed by the “local host device” may include any step performed by a virtual machine (or component) of the local host device. As shown, the method900begins at step910, where the local host device sends a beacon message to a virtual network commander on an MSP server. The beacon is configured to prompt the virtual network commander to establish a management tunnel between the MSP server and the local host device. Next, the method900proceeds to step920, where the local host device receives a message from a first virtual data forwarding unit instantiated on a first remote host device. The message may be a control tunnel establishment message configured in accordance with management signaling communicated to the first remote host device from the virtual network commander during initial power-up of the remote host device. For example, the control tunnel establishment message may be encrypted in accordance with a control tunnel password (e.g., private or public key) carried by the management signaling. Moreover, the control tunnel establishment message may be addressed to an IP address (e.g., IP address of local host device) carried by the management signaling. Next, the method900proceeds to step930, where a network controller determines whether the message is valid. If not, the message is dropped at step940. If the message is valid, then the method900proceeds to step950, where the virtual controller establishes a control tunnel between the virtual controller and the first virtual data forwarding unit. Thereafter, the method900proceeds to step960, where the virtual controller prompts the first virtual data forwarding unit to establish a data plane tunnel with a second virtual data forwarding unit. Additional details concerning the establishment of management, control, and data tunnels of virtual edge routers are provided by U.S. Patent Application [Atty. Dock. No. NET-008].

FIG. 10illustrates a block diagram of a processing system that may be used for implementing the devices and methods disclosed herein. Specific devices may utilize all of the components shown, or only a subset of the components, and levels of integration may vary from device to device. Furthermore, a device may contain multiple instances of a component, such as multiple processing units, processors, memories, transmitters, receivers, etc. The processing system may comprise a processing unit equipped with one or more input/output devices, such as a speaker, microphone, mouse, touchscreen, keypad, keyboard, printer, display, and the like. The processing unit may include a central processing unit (CPU), memory, a mass storage device, a video adapter, and an I/O interface connected to a bus.

The bus may be one or more of any type of several bus architectures including a memory bus or memory controller, a peripheral bus, video bus, or the like. The CPU may comprise any type of electronic data processor. The memory may comprise any type of system memory such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), read-only memory (ROM), a combination thereof, or the like. In an embodiment, the memory may include ROM for use at boot-up, and DRAM for program and data storage for use while executing programs.

The mass storage device may comprise any type of storage device configured to store data, programs, and other information and to make the data, programs, and other information accessible via the bus. The mass storage device may comprise, for example, one or more of a solid state drive, hard disk drive, a magnetic disk drive, an optical disk drive, or the like.

The video adapter and the I/O interface provide interfaces to couple external input and output devices to the processing unit. As illustrated, examples of input and output devices include the display coupled to the video adapter and the mouse/keyboard/printer coupled to the I/O interface. Other devices may be coupled to the processing unit, and additional or fewer interface cards may be utilized. For example, a serial interface such as Universal Serial Bus (USB) (not shown) may be used to provide an interface for a printer.

The processing unit also includes one or more network interfaces, which may comprise wired links, such as an Ethernet cable or the like, and/or wireless links to access nodes or different networks. The network interface allows the processing unit to communicate with remote units via the networks. For example, the network interface may provide wireless communication via one or more transmitters/transmit antennas and one or more receivers/receive antennas. In an embodiment, the processing unit is coupled to a local-area network or a wide-area network for data processing and communications with remote devices, such as other processing units, the Internet, remote storage facilities, or the like.

FIG. 11illustrates a block diagram of an embodiment of a communications device1100, which may be equivalent to one or more devices discussed above. The communications device1100may include a processor1104, a memory1106, and a plurality of interfaces1110,1112,1114, which may (or may not) be arranged as shown inFIG. 11. The processor1104may be any component capable of performing computations and/or other processing related tasks, and the memory1106may be any component capable of storing programming and/or instructions for the processor1104. The interfaces1110,1112,1114may be any component or collection of components that allows the communications device1100to communicate with other devices.