Patent Description:
Along with popularization of SDN (Software-Defined Network) and the like, a technique of virtualizing a network has attracted increasing attention. Especially, a technique of virtualizing the functions of the network appliances of a carrier network, which is called NFV (Network Functions Virtualization), has been considered.

In the above technical field, patent literature <NUM> discloses a technique in which a virtualization apparatus creates a virtual appliance on a virtual machine for each dedicated appliance.

In the above-described NFV environment, it is predicted that a specific vender performs, for a carrier, so-called system integration in which products for a carrier network such as a router, switch, and gateway are developed and produced, and delivered by implementing software virtual appliances (= VNFs: Virtual Network Functions) on a general-purpose server.

It is hardly considered that a specific vender develops all virtual appliances forming a carrier network, and software of a third party may be delivered with respect to a specific function. If a VNF produced by a third party is to be incorporated in a system, a carrier operating a network needs to consider the validity (correctness) of the VNF produced by the third party.

However, the technique described in patent literature <NUM> is merely a technique of creating a virtual appliance on the virtual machine, and virtually providing the same service as that of the dedicated appliance, and does not assume that a third party different from a vender which creates the overall system joins. Therefore, in the technique described in patent literature <NUM>, if an operator is to create a virtual network system including a virtual network function produced by a third party, it is impossible to prevent unauthorized registration, alteration, or occurrence of erroneous registration.

The present invention enables to provide a technique of solving the above-described problem.

The paper entitled "<NPL> notes that software validation of VNFs should be considered when VNFs are booted and during a launching phase to avoid malicious attacks such as forging and tampering. Validation provides assurance that the code loaded into the VNF execution environment is authentic and has not been tampered with. Technology using a digital signature based on a public key infrastructure provides a solution to this issue. The software vendors sign the signatures using the private keys to the software they developed, and the VNF related entity verifies the signatures using the corresponding public keys.

The papers published by <NPL>, and <NPL> identify potential security vulnerabilities of NFV, provides a reference framework in which the vulnerabilities are to be defined, and provides security and trust guidance for NFV deployment.

The invention is defined by the claims to which reference should now be made. Advantageous features of the invention are set out in the dependent claims.

According to the present invention, even if an operator is to create a virtual network system including a virtual network function produced by a third party, it is possible to prevent unauthorized registration, alteration, or occurrence of erroneous registration.

Example embodiments of the present invention will now be described in detail with reference to the drawings. It should be noted that the relative arrangement of the components, the numerical expressions and numerical values set forth in these example embodiments do not limit the scope of the present invention unless it is specifically stated otherwise.

A virtual network system <NUM> according to the first example embodiment of the present invention will be described with reference to <FIG>. The virtual network system <NUM> is a system that manages a virtual network service.

As shown in <FIG>, the virtual network system <NUM> includes an instructor <NUM>, an authenticator <NUM>, and a setting unit <NUM>. The instructor <NUM> instructs to activate or change a virtual network function <NUM> (to be also referred to as a VNF in the drawings or specification) of providing a virtual network service <NUM>. Based on authentication information <NUM> for authenticating the provider of the virtual network function <NUM> at the time of registration of the virtual network function <NUM>, the authenticator <NUM> authenticates whether the virtual network function <NUM> instructed to be activated or changed has been validly registered or updated. If the authenticator <NUM> authenticates the virtual network function, the setting unit <NUM> sets the instructed virtual network function <NUM> (<NUM>) as the virtual network service <NUM>.

According to this example embodiment, since a virtual network function instructed to be activated or changed is authenticated, even if an operator is to create a virtual network system including a virtual network function produced by a third party, it is possible to prevent unauthorized registration, alteration, or occurrence of erroneous registration.

A virtual network system according to the second example embodiment of the present invention will be described next. In the virtual network system according to this example embodiment, when an operator terminal instructs to activate or change an already registered virtual network function, authentication is performed to confirm that the target virtual network function has not been unauthorizedly registered, altered, or erroneously registered. Activation of the virtual network function is to newly activate the already registered virtual network function in a target virtual network. Change of the virtual network function is to replace the virtual network function used for a target virtual network service.

In this example embodiment, the virtual network service may be defined for, for example, each operator who uses the network system or each service provided by the operator to the user.

Note that in this example embodiment, authentication is performed based on the digital signature of a provider (to be also referred to as a third party hereinafter) who has supplied the virtual network function. An authentication method is not limited to a digital signature. An authentication method of preventing the virtual network function from being unauthorizedly registered, altered, or erroneously registered can be used. For example, a combination of encryption and decryption and the like may be used. As virtual network functions (VNFs), GW (gateway), FW (firewall), LB (Load Balancer), DPI (Deep Packet Inspection), and the like are known, and every function that creates a carrier network may be included. Furthermore, the VNF may be defined for each dedicated appliance such as GW or FW in a general network, or defined for each function of each dedicated appliance. In addition, each apparatus according to this example embodiment may be integrated into one hardware component, or implemented by software components for implementing respective functions. In this case, each apparatus need not indicate the boundary as hardware.

The virtual network system according to this example embodiment will be described in detail below with reference to <FIG>.

<FIG> is a view showing an outline of the operation of a virtual network system <NUM> according to this example embodiment. <FIG> shows display examples of an operator terminal <NUM> operated by an operator <NUM> who instructs to activate or change a virtual network function during the operation according to this example embodiment.

A display screen <NUM> is a screen for authenticating whether the operator <NUM> has authority to operate the virtual network system <NUM> of this example embodiment. The operator <NUM> is authenticated by inputting an operator ID and a password.

If the operator <NUM> is authenticated, he/she inputs, to a display screen <NUM>, a service ID (or carrier ID) as a target of VNF activation or change, a function (VNF) to be activated or changed, and setting of a route that connects VNFs. Note that the route that connects the VNFs may be automatically set based on the relationship between the functions, instead of inputting the setting by the operator <NUM>.

According to this example embodiment, whether the target VNF may be activated or changed in the target virtual network service, that is, the target VNF is not a VNF that has been unauthorizedly registered, altered, or erroneously registered is authenticated based on authentication information. In this example embodiment, as the authentication information, a digital signature that authenticates the VNF based on provider information is used. A pre-registered target VNF with a digital signature is read out from a virtual network function database (to be referred to as a VNF database hereinafter), and the digital signature is authenticated using a corresponding verification key (public key) saved in an authentication server.

If the identity of the operator is accepted in authentication of the digital signature, the VNF read out from the VNF database is set in the target virtual network, and information indicating the VNF activation completion or VNF change completion is displayed on a display screen <NUM> of the operator terminal <NUM>. On the other hand, if the identity of the operator is rejected in authentication of the digital signature, it is determined that the VNF read out from the VNF database may have been unauthorizedly registered, altered, or erroneously registered. As a result, the VNF activation or change processing is terminated, and information indicating that an activation or change error has occurred and its factor is invalidity of the digital signature is displayed on a display screen <NUM> of the operator terminal <NUM>.

<FIG> is a block diagram showing the arrangement of the virtual network system <NUM> according to this example embodiment. Note that in the virtual network system <NUM>, an arrangement related to VNF activation or change processing is shown, and no arrangement related to VNF registration or update processing is shown by assuming that the VNF is already registered in the VNF database.

In the virtual network system <NUM>, a control apparatus <NUM> controls authentication in the VNF activation or change processing according to this example embodiment, and VNF setting based on the result. An authentication server <NUM> holds authentication information for authentication in the VNF activation or change processing according to this example embodiment. Note that the authentication server <NUM> may be provided in the control apparatus <NUM>. A VNF database <NUM> stores a pre-registered VNF with a digital signature to be searchable by provider information, a VNF identifier, or the like. A search key is not limited to the provider information or VNF identifier, and is variously selected to prevent the VNF from being unauthorizedly registered, altered, or erroneously registered. The control apparatus <NUM>, the authentication server <NUM>, and the VNF database <NUM> function as the authenticator <NUM> and the setting unit <NUM> in <FIG>.

A virtual network service <NUM> is a service that is provided by connecting a plurality of VNFs to the virtual network system <NUM> according to this example embodiment. Note that the number of virtual network services <NUM> is not limited to one, and a plurality of different network services may be provided. The virtual network service <NUM> includes a physical server <NUM> that executes a VNF in a virtual machine (VM), and a physical switch <NUM> that switches packet transfer with the physical server <NUM>. The physical server <NUM> includes a plurality of VMs that execute various processes, and a controller <NUM> that implements the virtual network service <NUM> by setting a plurality of VNFs in accordance with a route. As the controller <NUM>, "Open vSwitch", "VMM (Virtual Machine Manager)", or the like is used, and a detailed description thereof will be omitted.

An operation management apparatus <NUM> is connected to the operator terminal <NUM>, and transmits a VNF activation or change instruction to the control apparatus <NUM>. The operation management apparatus <NUM> or the operation management apparatus <NUM> and operator terminal <NUM> function as the instructor <NUM> of <FIG>.

In the arrangement of <FIG>, the VNF database <NUM> stores a VNF with a digital signature to be searchable, and the authentication server <NUM> holds a verification key (public key) corresponding to the VNF with the digital signature. If the operator authenticated by the system instructs to activate or change the VNF stored in the VNF database <NUM> from the operator terminal <NUM>, the operation management apparatus <NUM> sends a VNF activation or change instruction to the control apparatus <NUM>. The VNF activation or change instruction is added with an identifier (for example, ID: <NUM>, ID: abc, or the like) for identifying the VNF.

The identifier for identifying the VNF is desirably converted, in the operator terminal <NUM> or the operation management apparatus <NUM>, from a function name (for example, firewall or the like) input or selected by the operator. That is, the operator inputs or selects, from the operator terminal <NUM>, a name from which the operator can readily grasp the function, such as a firewall, load balancer, or DPI (Deep Packet Inspection). Then, in the operator terminal <NUM> or the operation management apparatus <NUM>, the input or selected name is desirably converted into an identifier (for example, ID: <NUM>, ID: abc, or the like) for identifying the VNF.

Upon receiving the VNF activation or change instruction, the control apparatus <NUM> searches for the target VNF with the digital signature from the VNF database <NUM>, and reads out the corresponding verification key (public key) from the authentication server <NUM>. The control apparatus <NUM> then authenticates the digital signature. Note that in this example embodiment, the control apparatus <NUM> performs calculation for authentication of the digital signature. However, the authentication server <NUM> may perform all processes related to authentication, and return the result to the control apparatus <NUM>.

If authentication of the digital signature is OK, that is, the digital signature is accepted, the control apparatus <NUM> implements VNF activation or change by instructing the controller <NUM> of the physical server <NUM> to set the VNF found from the VNF database <NUM>. Note that the route of the activated or changed VNF in the controller <NUM> may be input by the operator from the operator terminal <NUM> or automatically set by the operation management apparatus <NUM> or the control apparatus <NUM>.

On the other hand, if authentication of the digital signature is not OK, that is, the digital signature is rejected, the control apparatus <NUM> terminates the VNF activation or change processing, and the operator terminal <NUM> notifies the operator of a VNF activation or change error.

Examples of the service chain of the virtual network service <NUM> will be described below with reference to <FIG>. Note that the service chain is not limited to examples of <FIG>, and a combination of components of <FIG> may be used.

<FIG> is a view showing service chains of the virtual network service <NUM> according to this example embodiment. Referring to <FIG>, in the one physical server <NUM>, VNFs are executed by VMs. Note that examples of VNFs providable by the physical server <NUM> are MME (Mobility Management Entity), different GW-A and GW-B, DPI, different FW-A and FW-B, and LB. <FIG> shows two different service chains (a solid line and a broken line). These service chains may be services for individual users or carriers.

In the service chain indicated by the solid line, based on VNF information and path control information set in the controller <NUM> by the control apparatus <NUM>, GW-B, DPI, and FW-B are sequentially executed by the VMs managed by the controller <NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>. A packet as an execution result is returned from the physical server <NUM> to the physical switch <NUM>, thereby providing the virtual network service <NUM>.

In the service chain indicated by the broken line, based on the VNF information and path control information set in the controller <NUM> by the control apparatus <NUM>, MME, GW-A, and FW-A are sequentially executed by the VMs managed by the controller <NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>. A packet as an execution result is returned from the physical server <NUM> to the physical switch <NUM>, thereby providing the virtual network service <NUM>.

In this example embodiment, if authentication by the control apparatus <NUM> is valid, the control apparatus <NUM> sends a VNF activation or change instruction to the controller <NUM>, and makes settings.

<FIG> is a view showing other service chains of the virtual network service <NUM> according to this example embodiment. Referring to <FIG>, in a plurality of physical servers <NUM>-<NUM> and <NUM>-<NUM>, VNFs are executed by VMs. Note that examples of VNFs providable by the physical server <NUM>-<NUM> are MME, different GW-A and GW-B, and DPI. Examples of VNFs providable by the physical server <NUM>-<NUM> are different FW-A and FW-B and LB. <FIG> shows two different service chains (a solid line and a broken line). These service chains may be services for individual users or carriers.

In the service chain indicated by the solid line, based on VNF information and path control information set in a controller <NUM>-<NUM> by the control apparatus <NUM>, GW-B and DPI are sequentially executed by the VMs managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>. Next, based on VNF information and path control information set in a controller <NUM>-<NUM> by the control apparatus <NUM>, FW-B is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>, thereby providing the virtual network service <NUM>.

In the service chain indicated by the broken line, based on the VNF information and path control information set in the controller <NUM>-<NUM> by the control apparatus <NUM>, MME and GW-A are sequentially executed by the VMs managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>. Based on the VNF information and path control information set in the controller <NUM>-<NUM> by the control apparatus <NUM>, FW-A is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>, thereby providing the virtual network service <NUM>.

In this example embodiment, if authentication by the control apparatus <NUM> is valid, the control apparatus <NUM> sends a VNF activation or change instruction to the controllers <NUM>-<NUM> and <NUM>-<NUM>, and makes settings.

<FIG> is a view showing still other service chains of the virtual network service <NUM> according to this example embodiment. Referring to <FIG>, in each of a plurality of physical servers <NUM>-<NUM> to <NUM>-<NUM>, each VNF is executed by a VM. Note that an example of a VNF providable by the physical server <NUM>-<NUM> is MME, an example of a VNF providable by the physical server <NUM>-<NUM> is GW, an example of a VNF providable by the physical server <NUM>-<NUM> is DPI, and an example of a VNF providable by the physical server <NUM>-<NUM> is FW. <FIG> shows two different service chains (a solid line and a broken line). These service chains may be services for individual users or carriers.

In the service chain indicated by the solid line, GW set in a controller <NUM>-<NUM> by the control apparatus <NUM> is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>. Next, DPI set in a controller <NUM>-<NUM> by the control apparatus <NUM> is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>. Then, FW set in a controller <NUM>-<NUM> by the control apparatus <NUM> is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>, thereby providing the virtual network service <NUM>.

In the service chain indicated by the broken line, MME set in a controller <NUM>-<NUM> by the control apparatus <NUM> is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>. Next, GW set in a controller <NUM>-<NUM> by the control apparatus <NUM> is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>. Then, FW set in a controller <NUM>-<NUM> by the control apparatus <NUM> is executed by the VM managed by the controller <NUM>-<NUM> for a packet transferred from the physical switch <NUM> to the physical server <NUM>-<NUM>. A packet as an execution result is returned from the physical server <NUM>-<NUM> to the physical switch <NUM>, thereby providing the virtual network service <NUM>.

In this example embodiment, if authentication by the control apparatus <NUM> is valid, the control apparatus <NUM> sends a VNF activation or change instruction to the controllers <NUM>-<NUM> to <NUM>-<NUM>, and makes settings.

<FIG> is a sequence chart showing the operation procedure of the virtual network system <NUM> according to this example embodiment. In the sequence of <FIG>, the control apparatus <NUM> generates a digital signature, and determines validity/invalidity.

In step S401, operator authentication processing is performed between the operator terminal <NUM> and the operation management apparatus <NUM>. If operator authentication is OK, the operator terminal <NUM> instructs, in step S403, the operation management apparatus <NUM> to activate or change a desired VNF of a target virtual network service.

In step S409, the operation management apparatus <NUM> instructs the control apparatus <NUM> to activate or change the target VNF. If the operator performs route setting, this VNF activation or change instruction may include networking information indicating the route of the VNF. The instruction to activate or change the target VNF is also transmitted from the control apparatus <NUM> to the authentication server <NUM> and the VNF database <NUM>.

In step S411, the VNF database <NUM> extracts VNF data with a digital signature of the target VNF, and transmits it to the control apparatus <NUM>. In step S413, the control apparatus <NUM> acquires the VNF data with the digital signature. In step S415, the authentication server <NUM> extracts a verification key (public key) corresponding to the target VNF or a VNF provider (when one provider provides one VNF), and transmits it to the control apparatus <NUM>. In step S417, the control apparatus <NUM> acquires the verification key (public keys). Then, in step S419, using the acquired VNF data with the digital signature and the acquired verification key (public key), the control apparatus <NUM> determines whether the digital signature is valid or invalid.

If it is determined that the digital signature of the VNF data with the digital signature is valid, the control apparatus <NUM> sets, in step S421, the acquired VNF in the controller <NUM> of the physical server <NUM>, and notifies the operator terminal <NUM> of activation or change completion of the VNF. In step S423, the controller <NUM> of the physical server <NUM> executes activation or change processing of the set VNF. In step S425, the operator terminal <NUM> displays, on the screen, information indicating that the activation or change processing of the VNF by the operator is complete, thereby notifying the operator of it. On the other hand, if it is determined that the digital signature of the VNF data with the digital signature is invalid, the control apparatus <NUM> notifies, in step S427, the operator terminal <NUM> of an error by determining that the acquired VNF may be a VNF that has been unauthorizedly registered, altered, or erroneously registered, and terminating the activation or change processing. In step S429, the operator terminal <NUM> displays a VNF activation or change error on the screen, thereby notifying the operator of it.

<FIG> is a sequence chart showing another operation procedure of the virtual network system <NUM> according to this example embodiment. In the sequence of <FIG>, the authentication server <NUM> generates a digital signature and determines validity/invalidity. Note that in <FIG>, the same step numbers as those in <FIG> denote the same steps and a description thereof will be omitted.

If a VNF activation or change instruction is received, the control apparatus <NUM> requests, in step S451, the authentication server <NUM> to determine whether the VNF is valid or invalid. In step S453, the authentication server <NUM> acquires a VNF with a digital signature from the VNF database <NUM>. In step S455, the authentication server <NUM> extracts a verification key (public key) corresponding to the VNF or a VNF provider. In step S457, the authentication server <NUM> determines, using the verification key, whether the VNF with the digital signature is valid or invalid, and returns the determination result to the control apparatus <NUM>.

In step S459, the control apparatus <NUM> acquires the VNF validity/invalidity determination result. If the VNF is valid, the control apparatus <NUM> executes step S421; otherwise, the control apparatus <NUM> executes step S427.

<FIG> is a block diagram showing the functional arrangement of the control apparatus <NUM> according to this example embodiment.

The control apparatus <NUM> includes an interface <NUM>, a route manager <NUM>, a VNF manager <NUM>, an activation/change controller <NUM>, and a management database <NUM>. Note that the management database <NUM> may be provided outside the control apparatus <NUM>.

The interface <NUM> communicates with other components forming the virtual network system <NUM>. In this example embodiment, the interface <NUM> is connected to the authentication server <NUM> to communicate the verification key (public key), and communicates with the VNF database <NUM> to communicate the VNF with the digital signature. Furthermore, the interface <NUM> receives a VNF activation or change instruction including VNF information from the operator terminal <NUM> via the operation management apparatus <NUM>. The interface <NUM> is connected to the controller <NUM> of the physical server <NUM> to transmit VNF control information and path information. The interface <NUM> is also connected to the physical switch <NUM> to transmit route control information.

The route manager <NUM> performs route control for the controller <NUM> of the physical server <NUM> via the interface <NUM>. For example, if the digital signature authentication result is valid, the route manager <NUM> instructs the controller <NUM> of the physical server <NUM> to perform route setting corresponding to the acquired VNF. For example, Neutron or the like that controls a virtual network via a virtual hypervisor in OpenStack is used as the route manager <NUM>. Note that the route manager <NUM> may instruct the physical switch <NUM> outside the physical server <NUM> to perform route setting, in accordance with route management information. With reference to VNF management information by the operation management apparatus <NUM>, the VNF manager <NUM> performs VM control for the controller <NUM> of the physical server <NUM> via the interface <NUM>. For example, if the digital signature authentication result is valid, the VNF manager <NUM> instructs the controller <NUM> of the physical server <NUM> to set a VM corresponding to the acquired VNF. Setting of the VM includes, for example, activation, change, and deletion of the VM. For example, NOVA Compute or the like that controls the operation of the virtual machine (VM) via the virtual hypervisor in OpenStack is used as the VNF manager <NUM>.

In response to the VNF activation or change instruction, the activation/change controller <NUM> controls activation or change of the VNF based on the result of determining, by authentication, whether the VNF is valid or invalid. The management database <NUM> stores information for managing the controller <NUM> of the physical server <NUM> and the physical switch <NUM> by the route manager <NUM> and the VNF manager <NUM>.

<FIG> is a block diagram showing the functional arrangement of the controller <NUM> that controls the physical server <NUM> according to this example embodiment.

The controller <NUM> includes an interface <NUM>, a path controller <NUM>, and a VM controller <NUM>.

The interface <NUM> communicates with other components forming the virtual network system <NUM>. In this example embodiment, the interface <NUM> is connected to the control apparatus <NUM> to receive VNF control information and path control information. The interface <NUM> is also connected to the physical switch <NUM> to transmit/receive packet information. In addition, the interface <NUM> receives an authenticated VNF from the VNF database <NUM>.

Based on the path control information received from the control apparatus <NUM>, the path controller <NUM> controls paths in which VMs execute VNFs. Based on the VNF control information received from the control apparatus <NUM>, the VM controller <NUM> controls the VNFs and the VMs that execute the VNFs.

Note that a VNF to be activated or changed may be directly installed from the VNF database <NUM> or installed via the control apparatus <NUM>.

<FIG> is a view showing the structure of the management database <NUM> according to this example embodiment. The management database <NUM> is used by the route manager <NUM> and the VNF manager <NUM> to manage the controller <NUM> of the physical server <NUM> and the physical switch <NUM>. Note that the structure of the management database <NUM> is not limited to that shown in <FIG>.

The management database <NUM> includes a management table <NUM> for managing the controller <NUM> of the physical server <NUM>, and a management table <NUM> for managing the physical switch <NUM>.

The management table <NUM> stores an identification condition <NUM> for identifying a virtual network service, and VNF control information and path control information <NUM> corresponding to the identification condition <NUM>. The identification condition <NUM> includes, for example, a carrier ID for identifying a carrier, and a packet header for identifying a packet. The VNF control information and path control information <NUM> include VNFs and their path order (route).

The management table <NUM> stores an identification condition <NUM> for identifying a virtual network service, and route control information <NUM> corresponding to the identification condition <NUM>. The identification condition <NUM> includes, for example, a carrier ID for identifying a carrier, and a packet header for identifying a packet. The route control information <NUM> includes a physical server and its route.

<FIG> is a block diagram showing the functional arrangement of the operation management apparatus <NUM> according to this example embodiment.

The operation management apparatus <NUM> includes an interface <NUM>, an operator manager <NUM>, and a VNF manager <NUM>.

The interface <NUM> communicates with other components forming the virtual network system <NUM>. In this example embodiment, the interface <NUM> is connected to the operator terminal <NUM> to receive a VNF activation or change instruction input by the operator, VNF information, and operator authentication information, and to transmit the VNF activation or change result to the operator terminal <NUM>. The interface <NUM> is connected to the control apparatus <NUM> to transmit a VNF activation or change request and receive a VNF activation or change result corresponding to a digital signature authentication result from the control apparatus <NUM>.

The operator manager <NUM> registers an operator, and performs authentication processing of approving access by the operator from the operator terminal <NUM>. The VNF manager <NUM> includes a management table <NUM> for managing VNFs, and manages the current VNF registration state based on VNF information from the operator terminal <NUM>, VNF control information of VNF activation/change by the control apparatus <NUM>, or the like.

<FIG> is a table showing the structure of the management table <NUM> according to this example embodiment. The management table <NUM> is used for an operation associated with a VNF from the operator terminal <NUM>. Note that the structure of the management table <NUM> is not limited to that shown in <FIG>.

The management table <NUM> stores a VNF name <NUM>, a VNF function <NUM>, a version <NUM>, a registrant <NUM>, a registration date <NUM>, a valid period <NUM>, and the like in association with a VNF-ID <NUM> as a VNF identifier.

Various structures of the authentication data and the VNF data held in the VNF database according to this example embodiment will be described below with reference to <FIG>. However, the structures of the authentication data and VNF data are not limited to them. To prevent a virtual network function from being unauthorizedly registered, altered, or erroneously registered, it is possible to add other information to the provider information of the virtual network function. Note that authentication may be performed by combining <FIG>. Note that a digital signature as authentication data of this example embodiment may be calculated from the VNF data or calculated by adding search data to the VNF data to improve the confidentiality.

<FIG> is a view showing the structures of the authentication data and VNF data according to this example embodiment. <FIG> shows the structure of the authentication data held in the authentication server <NUM> and that of the VNF data stored in the VNF database <NUM> when provision of one function is simply contracted for one VNF provider (third party).

The authentication server <NUM> stores a verification key (public key) <NUM> in association with VNF information <NUM>. Note that the VNF information <NUM> may be function information (function A or function B in <FIG>) input by the operator or provider information (company X or company Y in <FIG>) input by a VNF provider.

The VNF database <NUM> stores VNF data <NUM> with a digital signature in association with VNF information <NUM>. Note that the VNF information <NUM> may be function information (function A or function B in <FIG>) input by the operator or provider information (company X or company Y in <FIG>) input by a VNF provider.

In <FIG>, a digital signature is generated in association with the provided function or the VNF provider, and verified.

<FIG> is a view showing other structures of the authentication data and VNF data according to this example embodiment. <FIG> shows the structure of the authentication data held in the authentication server <NUM> and that of the VNF data stored in the VNF database <NUM> when provision of a plurality of functions to one VNF provider (third party) is contracted.

The authentication server <NUM> stores a verification key (public key) <NUM> in association with VNF information <NUM>. Note that the VNF information <NUM> includes function information (function A or function B) and VNF provider information (company X or company Y).

The VNF database <NUM> stores a VNF <NUM> with a digital signature in association with VNF information <NUM>. Note that the VNF information <NUM> includes function information and VNF provider information.

In <FIG>, a digital signature is generated in association with each pair of a provided function and a VNF provider, and verified.

<FIG> is a view showing still other structures of the authentication data and VNF data according to this example embodiment. <FIG> shows the structure of the authentication data held in the authentication server <NUM> and that of the VNF data stored in the VNF database <NUM> when function provision by a plurality of VNF providers (third parties) for one function is contracted.

The authentication server <NUM> stores a verification key (public key) <NUM> in association with VNF information <NUM>. Note that the VNF information <NUM> includes function information and VNF provider information, and a plurality of VNF providers (companies X to Z) may provide one function (function A).

The VNF database <NUM> stores a VNF <NUM> with a digital signature in association with VNF information <NUM>. Note that the VNF information <NUM> includes function information and VNF provider information, and a plurality of VNF providers may provide one function.

In <FIG>, a digital signature is generated in association with one provided function and a plurality of VNF providers, and verified.

<FIG> is a view showing still other structures of the authentication data and VNF data according to this example embodiment. <FIG> shows the structure of the authentication data held in the authentication server <NUM> and that of the VNF data stored in the VNF database <NUM> when an operator who instructs to activate or change a VNF is considered.

The authentication server <NUM> stores a verification key (public key) <NUM> in association with an operator <NUM> and VNF information (function or company) <NUM>.

The VNF database <NUM> stores a VNF <NUM> with a digital signature in association with an operator <NUM> and VNF information <NUM>.

In <FIG>, a digital signature is generated in consideration of an operator who instructs to activate or change a VNF, and verified.

<FIG> is a view showing still other structures of the authentication data and VNF data according to this example embodiment. <FIG> shows the structure of the authentication data held in the authentication server <NUM> and that of the VNF data stored in the VNF database <NUM> when a difference in version of the same VNF is considered.

The authentication server <NUM> stores a verification key (public key) <NUM> in association with a version <NUM> and VNF information (function or company) <NUM>.

The VNF database <NUM> stores a VNF <NUM> with a digital signature in association with a version <NUM> and VNF information <NUM>.

In <FIG>, a digital signature is generated in consideration of a difference in version of the same VNF, and verified.

<FIG> is a view showing still other structure of the authentication data according to this example embodiment. In <FIG>, each VNF and the verification key (public key) are directly associated with each other in the authentication data of the authentication server <NUM>. To the contrary, in <FIG>, each VNF and a verification key (public key) are indirectly associated with each other by a random identifier to improve the confidentiality. Note that a method of improving the confidentiality of the verification key (public key) is not limited to this.

The authentication server <NUM> stores a random identifier <NUM> in association with VNF information (function and company) <NUM>. The authentication server <NUM> stores a verification key (public key) <NUM> in association with a random identifier <NUM>. Note that the random identification may be used for authentication by the operator or VNF provider.

<FIG> is a view showing still other structures of the authentication data and VNF data according to this example embodiment. <FIG> shows the structure of the authentication data that is held in the authentication server <NUM> and is used in an authentication method different from a digital signature.

The authentication server <NUM> stores a decryption key <NUM> in association with VNF information (function or company) <NUM>. The VNF database <NUM> stores an encrypted VNF <NUM> in association with VNF information <NUM>.

In <FIG>, encryption corresponding to VNF information is performed, and then decryption is performed.

<FIG> is a flowchart illustrating the procedure of VNF activation/change processing as the virtual network control of the control apparatus <NUM> according to this example embodiment.

In step S801, the control apparatus <NUM> determines whether a VNF activation or change instruction has been received from the operator terminal <NUM>. If it is determined that the VNF activation or change instruction has been received, the control apparatus <NUM> receives, in step S803, a VNF identifier corresponding to function information input from the operator terminal <NUM>. Note that in <FIG> described above, the function information may be received as VNF provider information. Next, in step S805, the control apparatus <NUM> receives information indicating whether the operator instruction is a VNF activation instruction or a VNF change instruction. If the information is received, the control apparatus <NUM> receives the selection input of the operator indicating VNF activation or change, or a determination result based on a target virtual network service and a target VNF in the operation management apparatus <NUM>. In step S805, based on the target virtual network service and the target VNF, the control apparatus <NUM> may determine whether the operator instruction is a VNF activation instruction or a VNF change instruction. In the processing of determining whether the operator instruction is a VNF activation instruction or a VNF change instruction, whether a new VNF is to be activated or the VNF is to be changed (replaced) is determined with reference to a VNF currently operating as the target virtual network service, its route, and the like.

In step S807, the control apparatus <NUM> requests the following data transmission by transmitting the VNF identifier or VNF provider identifier to the authentication server <NUM> and the VNF database <NUM>. In response to the transmission of the VNF identifier or VNF provider identifier, in step S809, the control apparatus <NUM> acquires a VNF with a digital signature associated with the VNF identifier or VNF provider identifier from the VNF database <NUM>. In response to the transmission of the VNF identifier or VNF provider identifier, in step S811, the control apparatus <NUM> acquires a verification key (public key) associated with the VNF identifier or VNF provider identifier from the authentication server <NUM>. In step S813, based on the acquired VNF with the digital signature and the verification key (public key), the control apparatus <NUM> executes processing of determining whether the digital signature is valid or invalid.

In step S815, the control apparatus <NUM> braches the processing based on the result of determining whether the digital signature is valid or invalid. If the digital signature is valid, the control apparatus <NUM> sets, in step S817, the VNF acquired from the VNF database <NUM> in the controller <NUM> of the target physical server <NUM>. In step S819, the control apparatus <NUM> sends, to the operator terminal <NUM>, a completion notification of activation or change of the target VNF in the target virtual network service. On the other hand, if the digital signature is invalid, in step S821 the control apparatus <NUM> discards the VNF acquired from the VNF database <NUM> by determining that the VNF may have been unauthorizedly registered, altered, or erroneously registered, and then sends, to the operator terminal <NUM>, an error notification of activation or change of the VNF.

Note that if it is determined that neither a VNF activation instruction nor a VNF change instruction has been received from the operator terminal <NUM>, the control apparatus <NUM> performs, in step S823, processing other than the VNF activation or change processing. The other processing includes VNF registration or update processing (to be described later), and path control and route control without the VNF activation or change processing.

<FIG> is a flowchart illustrating the procedure of the digital signature validity/invalidity determination processing (step S813) according to this example embodiment. Note that <FIG> shows validity/invalidity determination processing for an example of the digital signature. Another digital signal may be equally applied.

In step S831, the control apparatus <NUM> calculates a hash value based on the VNF data of the VNF with the digital signature acquired from the VNF database <NUM>. In step S833, the control apparatus <NUM> decrypts the digital signature of the VNF with the digital signature using the verification key (public key) acquired from the authentication server <NUM>. In step S835, the control apparatus <NUM> determines whether the hash value based on the VNF data is equal to the decrypted value of the digital signature.

If the hash value based on the VNF data is equal to the decrypted value of the digital signature, the control apparatus <NUM> turns on the valid flag of the digital signature in step S837; otherwise, the control apparatus <NUM> turns on the invalid flag of the digital signature in step S839.

Note that in this example embodiment, the control apparatus <NUM> executes the digital signature validity/invalidity determination processing. However, in consideration of the confidentially, it is desirable to entrust the digital signature validity/invalidity determination processing to the authentication server <NUM>.

According to this example embodiment, even if an operator is to create a virtual network system including a virtual network function produced by a third party, the virtual network function is protected by the digital signature of provider information, and thus it is possible to prevent unauthorized registration, alteration, or occurrence of erroneous registration.

A virtual network system according to the third example embodiment of the present invention will be described next. The virtual network system according to this example embodiment is different from that according to the above-described second example embodiment in that when a third party registers or updates a virtual network function, processing of generating and registering a virtual network function with a digital signature and a verification key (public key) is included. The remaining components and operations are the same as those in the second example embodiment. Hence, the same reference numerals denote the same components and operations, and a detailed description thereof will be omitted. That is, authentication processing using a digital signature in an activation or change instruction of the virtual network function by the operator is the same as in the second example embodiment, and a description thereof will be omitted in this example embodiment.

The virtual network system according to this example embodiment will be described in detail below with reference to <FIG>. Note that in this example embodiment, only registration or update of a virtual network function will be described. Thus, in the virtual network system and a control apparatus, components associated with activation or change of a virtual network function are omitted.

<FIG> is a view showing an outline of the operation of a virtual network system <NUM> according to this example embodiment. <FIG> shows display examples of a third party terminal <NUM> operated by a VNF provider (third party) <NUM> who instructs to register or update a virtual network function during the operation according to this example embodiment.

A display screen <NUM> is a screen for authenticating whether the VNF provider <NUM> has authority to register or update a VNF. The VNF provider <NUM> is authenticated by inputting a supplier company name, a provider ID, and a password.

If the VNF provider <NUM> is authenticated, he/she instructs to register a VNF on a display screen <NUM>. Note that whether to register or update a VNF may be selected based on a VNF storage state of a VNF database <NUM>, which complicates the condition. Thus, in this example embodiment, assume that the VNF provider <NUM> inputs the selection.

Next, the VNF provider <NUM> inputs, from a display screen <NUM>, a function (VNF) to be registered, and version information as an option. According to this example embodiment, authentication information indicating whether the target VNF may be registered, that is, authentication information for preventing the target VNF from being unauthorizedly registered, altered, or erroneously registered is generated and registered. In this example embodiment, a digital signature that authenticates the VNF based on provider information is used as the authentication information. A digital signature is generated using a signature key (private key) based on VNF information and provider information, a VNF with the digital signature is stored in the VNF database, and a verification key (public key) generated accordingly is saved in an authentication server.

If the VNF with the digital signature and the verification key (public key) are normally held, information indicating the VNF registration completion is displayed on a display screen <NUM> of the third party terminal <NUM>. On the other hand, if the VNF with the digital signature and the verification key (public key) are not normally held, a VNF registration error (for example, a reason as the factor of the error such as VNF registration that is not permitted for the VNF provider) is displayed on a display screen <NUM> of the third party terminal <NUM>.

<FIG> is a view showing an outline of the operation of the virtual network system <NUM> according to this example embodiment. <FIG> shows display examples of the third party terminal <NUM> operated by the VNF provider (third party) <NUM> who instructs to register or update a virtual network function during the operation according to this example embodiment.

Similarly to <FIG>, the display screen <NUM> is a screen for authenticating whether the VNF provider <NUM> has authority to register or update a VNF. The VNF provider <NUM> is authenticated by inputting a supplier company name, a provider ID, and a password. If the VNF provider <NUM> is authenticated, he/she instructs to update a VNF on a display screen <NUM>.

Next, the VNF provider <NUM> inputs, from a display screen <NUM>, a function (VNF) to be updated, and version information as an option. According to this example embodiment, whether the VNF to be updated may be read out and updated, that is, whether the VNF to be updated is not a VNF that has been unauthorizedly registered, altered, or erroneously registered is authenticated based on authentication information. In this example embodiment, a digital signature that authenticates the VNF based on provider information is used as the authentication information. A pre-registered target VNF with a digital signature is read out from the VNF database, and the digital signature is authenticated using a corresponding verification key (public key) saved in the authentication server. Note that if the VNF is updated by adding a new version without reading out the existing VNF, the same procedure as the registration processing procedure shown in <FIG> is performed.

If the identity of the provider is accepted in authentication of the digital signature, the VNF read out from the VNF database is read out as a VNF to be updated, and information indicating the VNF update start is displayed on a display screen <NUM> of the third party terminal <NUM>. On the other hand, if the identity of the provided is rejected in authentication of the digital signature, the VNF read out from the VNF database may have been unauthorizedly registered, altered, or erroneously registered. As a result, the VNF update processing is terminated, and information indicating that an update error has occurred and its factor is the invalid digital signature is displayed on a display screen <NUM> of the third party terminal <NUM>.

Note that the VNF obtained by reading out and updating the existing VNF is added with a new digital signature, and the VNF with the digital signature is stored. Storage of the VNF with the new digital signature may be implemented by overwriting the old VNF or additionally storing the VNF as a new version. The processing of generating a new digital signature of the VNF and storing the VNF with the digital signature is the same as the VNF registration processing shown in <FIG>, and an illustration and description thereof will be omitted.

<FIG> is a block diagram showing the arrangement of the virtual network system <NUM> according to this example embodiment. Note that in <FIG>, the same reference numerals as those in <FIG> denote the same functional components, and a description of the same processing will be omitted. In the virtual network system <NUM>, an arrangement related to VNF registration or update is shown but no arrangement related to VNF activation or change in <FIG> is shown.

In the virtual network system <NUM>, a control apparatus <NUM> controls generation of a VNF with a digital signature in VNF registration of this example embodiment or authentication for VNF update, and update of the VNF based on the result. An authentication server <NUM> acquires authentication information generated for authentication in VNF registration of this example embodiment. The authentication server <NUM> also holds authentication information for authentication in VNF update. Note that the authentication server <NUM> may be provided in the control apparatus <NUM>. A VNF database <NUM> stores the VNF with the digital signature to be searchable by provider information, a VNF identifier, or the like. A search key is not limited to the provider information or VNF identifier, as shown in <FIG>, and is variously selected to prevent the VNF from being unauthorizedly registered, altered, or erroneously registered.

A registration update apparatus <NUM> is connected to the third party terminal <NUM>, and transmits a VNF registration or update instruction to the control apparatus <NUM>.

Referring to <FIG>, if the authenticated third party terminal <NUM> requests to register a VNF, a pair of a signature key (private key) and a verification key (public key) is generated by a predetermined algorithm using a pseudo random number based on VNF provider information. A digital signature is generated using the signature key (private key), and a VNF with the digital signature is stored in the VNF database <NUM> to be searchable by the function or provider. The corresponding verification key (public key) is saved in the authentication server <NUM> to be searchable by the function or provider.

On the other hand, if the authenticated third party terminal <NUM> requests to update a VNF, authentication which has been performed to activate or change the VNF is executed using the digital signature for detecting unauthorized registration, alteration, or erroneous registration. This authentication processing is the same as that performed to activate or change the VNF and a description thereof will be omitted. If the result of authentication using the digital signature is valid, the VNF in the VNF database <NUM> is read out, the third party terminal <NUM> sends an update instruction, and then processing of registering the updated VNF added with the digital signature in the VNF database <NUM> is performed again.

On the other hand, if authentication of the digital signature is not OK, that is, the digital signature is rejected, the VNF update processing is terminated, and the third party terminal <NUM> notifies the provider of a VNF update error via the registration update apparatus <NUM>.

<FIG> is a sequence chart showing the registration operation procedure of the virtual network system <NUM> according to this example embodiment. <FIG> corresponds to <FIG>.

In step S1111, VNF provider authentication processing is performed between the third party terminal <NUM> and the registration update apparatus <NUM>. If VNF provider authentication is OK, the third party terminal <NUM> instructs, in step S <NUM>, the registration update apparatus <NUM> to register a VNF.

In step S1115, the registration update apparatus <NUM> determines whether the VNF to be registered is a VNF that may be registered by the VNF provider. If it is determined that the VNF may be registered by the VNF provider, the registration update apparatus <NUM> transmits, in step S1117, the VNF to be registered and provider information to the control apparatus <NUM>, and requests to register the VNF. The control apparatus <NUM> also transmits the VNF registration request to the authentication server <NUM>. On the other hand, if it is determined that the VNF may not be registered by the VNF provider, the registration update apparatus <NUM> sends, in step S1119, an error notification to the third party terminal <NUM>. In step S1121, the third party terminal <NUM> notifies the provider of the error by displaying information indicating that registration is impossible.

Upon receiving the VNF registration request, the authentication server <NUM> transmits, in step S1123, a digital signature generation algorithm (or application program) to the control apparatus <NUM>. Note that if the algorithm is determined in advance or the authentication server <NUM> generates a digital signature, it is not necessary to transmit the algorithm in step S1123.

In step S1125, the control apparatus <NUM> generates a pair of a signature key (private key) and a verification key (public key) based on the provider information in accordance with the received algorithm. In step S1127, the control apparatus <NUM> transmits the generated verification key (public key) to the authentication server <NUM>. In step S1129, the authentication server <NUM> holds the received verification key (public key) to be searchable by the provider information (or function information).

In step S1131, the control apparatus <NUM> generates a digital signature based on the VNF to be registered, the provider information, and the signature key (private key). In step S1133, the control apparatus <NUM> instructs the VNF database <NUM> to store the VNF with the generated digital signature. In step S1135, the VNF database <NUM> accumulates the VNF with the digital signature to be searchable by the VNF provider (or function information).

In step S1137, the control apparatus <NUM> notifies the third party terminal <NUM> of VNF registration completion. In step S1139, the third party terminal <NUM> displays information indicating the VNF registration completion.

<FIG> is a sequence chart showing another registration operation procedure of the virtual network system <NUM> according to this example embodiment. <FIG> corresponds to <FIG>. Note that in <FIG>, the same step numbers as those in <FIG> denote the same steps and a description thereof will be omitted.

If a VNF registration instruction is received, the control apparatus <NUM> requests, in step S1171, from the authentication server <NUM>, the digital signature of the VNF to be registered. In step S1173, the authentication server <NUM> generates a signature key (private key) and a verification key (public key) based on provider information. In step S1175, the authentication server <NUM> holds the verification key (public key) to be searchable by the provider information. In step S1177, the authentication server <NUM> generates a digital signature based on the VNF and the provider information.

In step S1179, the control apparatus <NUM> acquires the digital signature of the VNF from the authentication server <NUM>.

<FIG> is a sequence chart showing the update operation procedure of the virtual network system <NUM> according to this example embodiment. Note that the same step numbers as those in <FIG> denote the same steps and a description thereof will be omitted. Note that the following update operation procedure corresponds to the activation/change operation procedure shown in <FIG>, and an illustration and description of a procedure corresponding to <FIG> will be omitted.

If third party authentication is OK, the third party terminal <NUM> instructs, in step S1143, the registration update apparatus <NUM> to update a VNF.

In step S1145, the registration update apparatus <NUM> determines whether the VNF can be updated by the authenticated VNF provider (third party). If the VNF can be updated, the registration update apparatus <NUM> transmits, in step S1147, the provider information of the VNF provider or a VNF identifier to the control apparatus <NUM>, and requests to acquire the VNF to be updated. The request to acquire the VNF to be updated is also transmitted to the authentication server <NUM> and the VNF database <NUM>. On the other hand, if the VNF cannot be updated by the VNF provider, the registration update apparatus <NUM> sends, in step S <NUM>, to the third party terminal <NUM>, an error notification indicating that update is impossible. In step S1151, the third party terminal <NUM> displays an error indicating that the VNF cannot be updated.

In step S1153, the VNF database <NUM> extracts VNF data with a digital signature of the target VNF, and transmits it to the control apparatus <NUM>. In step S1155, the control apparatus <NUM> acquires the VNF data with the digital signature. In step S1157, the authentication server <NUM> extracts a verification key (public key) corresponding to the target VNF or the VNF provider (when one provider provides one VNF), and transmits it to the control apparatus <NUM>. In step S1159, the control apparatus <NUM> acquires the verification key (public key). In step S1161, using the acquired VNF data with the digital signature and the acquired verification key (public key), the control apparatus <NUM> determines whether the digital signature is valid or invalid.

If it is determined that the digital signature of the VNF data with the digital signature is valid, the control apparatus <NUM> transmits, in step S <NUM>, the acquired VNF to the third party terminal <NUM> as the VNF to be updated. In step S1165, the third party terminal <NUM> acquires the VNF to be updated. Note that the VNF to be updated may be updated by the third party terminal <NUM> or updated by the control apparatus <NUM> based on an instruction of the third party terminal <NUM>. On the other hand, if it is determined that the digital signature of the VNF data with the digital signature is invalid, the control apparatus <NUM> notifies, in step S1167, the third party terminal <NUM> of an error by determining that the acquired VNF may have been unauthorizedly registered, altered, or erroneously registered, and terminating the acquisition of the VNF. In step S1169, the third party terminal <NUM> displays, on the screen, an acquisition error of the VNF that may have been unauthorizedly registered, altered, or erroneously registered, thereby notifying the VNF provider of the error.

Registration of the updated VNF is the same as the registration operation shown in <FIG>, and an illustration and description thereof will be omitted.

<FIG> is a block diagram showing the functional arrangement of the control apparatus <NUM> according to this example embodiment. Note that in <FIG>, the same reference numerals as those in <FIG> denote the same functional components and a description thereof will be omitted.

The control apparatus <NUM> further includes a registration update controller <NUM>. An interface <NUM> is connected to the registration update controller <NUM> and the registration update apparatus <NUM>. The registration update controller <NUM> controls registration processing and update processing of a VNF based on a VNF registration or update instruction received from the third party terminal <NUM> via the registration update apparatus <NUM>. In addition, the interface <NUM> notifies the third party terminal <NUM> of the processing result of the registration processing and update processing of the VNF via the registration update apparatus <NUM>.

<FIG> is a block diagram showing the functional arrangement of the registration update apparatus <NUM> according to this example embodiment.

The registration update apparatus <NUM> includes an interface <NUM>, a third party authenticator <NUM>, and a registrability/updatability determiner <NUM>.

The interface <NUM> communicates with other components forming the virtual network system <NUM>. In this example embodiment, the interface <NUM> is connected to the third party terminal <NUM> to receive a VNF registration or update instruction input by a VNF provider, VNF information, and provider information, and to transmit a VNF registration or update result to the third party terminal <NUM>. Furthermore, the interface <NUM> is connected to the control apparatus <NUM> to transmit, to the control apparatus <NUM>, the VNF information and provider information received from the third party terminal <NUM> in this example embodiment.

The third party authenticator <NUM> authenticates the third party terminal <NUM> and the VNF provider who operates the virtual network system <NUM> using the third party terminal <NUM>. The registrability/updatability determiner <NUM> includes a registrability/updatability determination table <NUM>, and determines whether the VNF provider is permitted to operate the VNF that is set as a registration or update target by the VNF provider.

<FIG> is a table showing the structure of the registrability/updatability determination table <NUM> according to this example embodiment. The registrability/updatability determination table <NUM> is used to determine whether the VNF provider is permitted to operate the VNF that is set as a registration or update target by the VNF provider.

The registrability/updatability determination table <NUM> stores a VNF (in <FIG>, a registrable/updatable function) <NUM> for which an operation is permitted, in association with provider information (third party) <NUM>.

<FIG> is a flowchart illustrating the procedure of the VNF registration/update processing of the control apparatus <NUM> according to this example embodiment.

In step S1401, the control apparatus <NUM> determines whether a VNF registration or update instruction has been received. If it is determined that a VNF registration or update instruction has been received, the control apparatus <NUM> determines in step S1403 whether the instruction is a registration instruction or an update instruction. If the instruction is an update instruction, the control apparatus <NUM> executes VNF update processing in step S1405. After the update processing, the control apparatus <NUM> executes VNF registration processing in step S1407. On the other hand, if the instruction is registration instruction, the control apparatus <NUM> executes the VNF registration processing in step S1407. If the instruction is neither a VNF registration instruction nor a VNF update instruction, the control apparatus <NUM> performs processing other than the VNF registration processing and VNF update processing in step S1409. The other processing includes the above-described VNF activation or change processing, and path control and route control without the VNF activation or change processing.

<FIG> is a flowchart illustrating the procedure of the VNF update processing (step S1405) according to this example embodiment.

In step S1411, the control apparatus <NUM> receives the identifier of the VNF to be registered and the provider information from the registration update apparatus <NUM>. In step S1413, the control apparatus <NUM> transmits the identifier of the VNF to be registered and the provider information to the authentication server <NUM> and the VNF database <NUM>. In step S1415, the control apparatus <NUM> acquires the VNF with the digital signature from the VNF database <NUM>. In step S1417, the control apparatus <NUM> acquires the corresponding verification key (public key) from the authentication server <NUM>. In step S813, based on the acquired VNF with the digital signature and the acquired verification key (public key), the control apparatus <NUM> executes processing of determining whether the digital signature is valid or invalid. Note that the same algorithm as in <FIG> is performed in step S813.

In step S1419, the control apparatus <NUM> branches the processing based on a result of determining whether the digital signature is valid or invalid. If the digital signature is valid, the control apparatus <NUM> permits, in step S1421, update of the VNF acquired from the VNF database <NUM>. In step S1423, the control apparatus <NUM> waits until the VNF update processing by the VNF provider ends. If the VNF update processing ends, the process returns. On the other hand, if the digital signature is invalid, the control apparatus <NUM> notifies, in step S1425, the third party terminal <NUM> of a VNF update error, and the process returns.

<FIG> is a flowchart illustrating the procedure of the VNF registration processing (step S1407) according to this example embodiment.

In step S1431, the control apparatus <NUM> acquires the digital signature generation algorithm from the authentication server <NUM>. In step S1433, the control apparatus <NUM> generates a pair of a signature key (private key) and a verification key (public key) based on the provider information. In step S1435, the control apparatus <NUM> transmits the generated verification key (public key) to the authentication server <NUM> together with the provider information, and instructs to save the verification key (public key) to be searchable by the provider information (or function).

In step S1437, the control apparatus <NUM> generates a digital signature based on the VNF to be registered, the provider information, and the signature key (private key). In step S1439, the control apparatus <NUM> instructs the VNF database <NUM> to save the VNF with the generated digital signature to be searchable by the provider information (or function).

In step S1441, the control apparatus <NUM> notifies the third party terminal <NUM> of registration completion for the VNF registration processing, and notifies the third party terminal <NUM> of update completion for the VNF update processing.

A virtual network system according to the fourth example embodiment of the present invention will be described next. The virtual network system according to this example embodiment is different from those according to the above-described second and third example embodiments in that a virtual network function is prevented from being unauthorizedly registered, altered, or erroneously registered in a virtual network system that integrates and manages a plurality of virtual network systems. The remaining components and operations are the same as those in the second and third example embodiments. Hence, the same reference numerals denote the same components and operations, and a detailed description thereof will be omitted.

The virtual network system according to this example embodiment will be described in detail below with reference to <FIG> and <FIG>. Note that functional elements in each virtual network system, for example, the components and operations of a control apparatus and the like are the same as those in the second or third example embodiment.

<FIG> is a block diagram showing the arrangement of a virtual network system <NUM> according to this example embodiment. Note that in <FIG>, the same reference numerals as those in <FIG> denote the same functional components and a description thereof will be omitted.

The virtual network system <NUM> includes a plurality of virtual network systems each corresponding to the virtual network system <NUM> shown in <FIG> or different network systems. For example, another virtual network system controlled by a control apparatus <NUM> is shown. An orchestration apparatus <NUM> that is connected to the plurality of virtual network systems or the different virtual network systems and integrally controls them is included. The orchestration apparatus <NUM> receives a VNF registration/update instruction or VNF activation/change instruction via an operation management apparatus <NUM> to which an operator terminal group and third party terminal group are connected, and integrally manages the plurality of virtual network systems or the different virtual network systems. Each of the plurality of network systems controlled by the orchestration apparatus <NUM> is, for example, a carrier network, a data center, a transport network, or the like, and may be a network that virtually implements the network.

In the virtual network system <NUM> of <FIG>, each virtual network system has the same arrangement as that of the virtual network system <NUM> of <FIG>, and is configured to control a VNF registration/update instruction or VNF activation/change instruction, and perform VNF management and route management.

<FIG> is a sequence chart showing the operation procedure of the virtual network system <NUM> according to this example embodiment.

If, in step S1601, the third party terminal group sends a VNF registration or update instruction, the operation management apparatus <NUM> authenticates a VNF provider (third party) in step S1603. If authentication is OK, the orchestration apparatus <NUM> selects, in step S1605, a virtual network system as a VNF registration destination or that as a VNF update destination based on the VNF registration or update instruction. Then, the orchestration apparatus <NUM> transmits the VNF registration or update instruction to a corresponding one of the control apparatuses <NUM>,. , and <NUM> that respectively control the virtual network systems.

Upon receiving the VNF registration or update instruction, the corresponding one of the control apparatuses <NUM>,. , and <NUM> executes, in step S1607, the following processing of this example embodiment as VNF registration or update processing. The first processing is generation of a signature key (private key) and a verification key (public key). The second processing is generation of a digital signature using the signature key (private key) and storage of a VNF with the digital signature. Third processing is saving of the generated verification key (public key). Upon completion of the VNF registration or update processing in the virtual network system, the corresponding one of the control apparatuses <NUM>,. , and <NUM> notifies the orchestration apparatus <NUM> of it. In step S1609, the orchestration apparatus <NUM> notifies, via the operation management apparatus <NUM>, the third party terminal, that has requested to perform the VNF registration or update processing, of completion of the VNF registration or update processing. Upon receiving the notification, the third party terminal displays information indicating the VNF registration or update completion in step S1611. Note that an error case is not shown.

If, in step S1621, the operator terminal group sends a VNF activation or change instruction, the operation management apparatus <NUM> authenticates an operator in step S1623. If authentication is OK, the orchestration apparatus <NUM> selects, in step S1625, a virtual network system as a VNF activation destination or that as a VNF change destination based on the VNF activation or change instruction. Then, the orchestration apparatus <NUM> transmits the VNF activation or change instruction to a corresponding one of the control apparatuses <NUM>,. , and <NUM> that respectively control the virtual network systems.

Upon receiving the VNF activation or change instruction, the corresponding one of the control apparatuses <NUM>,. , and <NUM> executes, in step S1627, the following processing of this example embodiment as VNF activation or change processing. That is, the VNF with the digital signature is verified using the verification key (public key). In step S1629, the corresponding one of the control apparatuses <NUM>,. , and <NUM> sets, in the virtual network system, the VNF to be activated or changed. Upon completion of the VNF activation or change processing in the virtual network system, the corresponding one of the control apparatuses <NUM>,. , and <NUM> notifies the orchestration apparatus <NUM> of it. In step S1631, the orchestration apparatus <NUM> notifies, via the operation management apparatus <NUM>, the operator terminal, that has requested to perform the VNF activation or change processing, of completion of the VNF activation or change processing. In step S1633, the operator terminal displays information indicating the VNF activation or change completion. Note that an error case is not shown.

<FIG> is a block diagram showing the functional arrangement of the orchestration apparatus <NUM> according to this example embodiment.

The orchestration apparatus <NUM> includes an interface <NUM> and respective function processors. The orchestration apparatus <NUM> includes, as the function processor, a VNF operation destination selector <NUM> that selects a virtual network system to process a VNF instructed to be registered/updated or activated/changed. Furthermore, the orchestration apparatus <NUM> includes a scale-out controller <NUM> that processes scale-out causing the activation or change of the VNF, and a migration controller <NUM> that processes migration. The orchestration apparatus <NUM> also includes a virtual network service generator <NUM> that generates a new virtual network service, and a virtual network service deletion unit <NUM> that deletes an existing virtual network service. The function processors shown in <FIG> are merely examples, and another function controller for performing integration processing of the virtual network system <NUM> may be connected.

The interface <NUM> receives, via the operation management apparatus <NUM>, VNF information, VNF operation information, operator information, provider information, and the like added to an instruction from the operator terminal group or third party terminal group, and transmits a processing result to the operator terminal group or third party terminal group. Furthermore, the interface <NUM> transmits, to the control apparatus group, the VNF information, VNF operation information, operator information, provider information, and the like for operating the virtual network service or VNF, and receives a processing result from the control apparatus group.

<FIG> is a table showing the structure of an integration control table <NUM> according to this example embodiment. The integration control table <NUM> is used by the orchestration apparatus <NUM> to integrally manage the virtual network system <NUM>. Note that the contents of the integration control table <NUM> are not limited to those shown in <FIG>. The integration control table <NUM> can be extended in accordance with the processing contents of the orchestration apparatus <NUM>.

The integration control table <NUM> stores, in association with a virtual network service ID <NUM>, a control apparatus ID <NUM> that controls the virtual network service, a VNF <NUM> currently used in the virtual network service, a connectable VNF <NUM>, and a replaceable VNF <NUM>. The integration control table <NUM> also stores a connectable (or replaceable) route position <NUM> and an unconnectable VNF <NUM>.

<FIG> is a flowchart illustrating the processing procedure of the orchestration apparatus <NUM> according to this example embodiment.

In step S1901, the orchestration apparatus <NUM> determines whether a VNF operation instruction has been received. If it is determined that a VNF operation instruction has been received, the orchestration apparatus <NUM> determines in step S1903 whether the operation instruction is a VNF registration/update or activation/change instruction.

If the operation instruction is a VNF registration/update instruction, the orchestration apparatus <NUM> instructs, in step S1911, to register or update a VNF by transmitting provider information and VNF information to the control apparatus of the operation destination. In step S1913, the orchestration apparatus <NUM> determines whether the VNF registration or update processing is normally complete. If it is determined that the VNF registration or update processing is normally complete, the orchestration apparatus <NUM> notifies, in step S1915, the provider terminal (third party terminal) that the VNF registration or update processing is normally complete. If it is determined that the VNF registration or update processing is not normally complete, the orchestration apparatus <NUM> notifies, in step S1917, the provider terminal (third party terminal) that a VNF registration or update error has occurred.

On the other hand, if the operation instruction is a VNF activation/change instruction, the orchestration apparatus <NUM> instructs, in step S1921, to activate or change a VNF by transmitting operator information, provider information, and VNF information to the control apparatus of the operation destination. The orchestration apparatus <NUM> determines in step S1923 whether the VNF activation or change processing is normally complete. If it is determined that the VNF activation or change processing is normally complete, the orchestration apparatus <NUM> notifies, in step S1925, the operator terminal that the VNF activation or change processing is normally complete. If it is determined that the VNF activation or change processing is not normally complete, the orchestration apparatus <NUM> notifies, in step S1927, the operator terminal of a VNF activation or change error.

According to this example embodiment, in the virtual network system that implements orchestration, even if an operator is to provide a virtual network service based on a virtual network function produced by a third party, it is possible to prevent unauthorized registration, alteration, or occurrence of erroneous registration in each virtual network service.

A virtual network system according to the fifth example embodiment of the present invention will be described next. The virtual network system according to this example embodiment is different from that according to the fourth example embodiment in that an orchestration apparatus authenticates all virtual network functions, instead of authenticating a virtual network function by each control apparatus. The remaining components and operations are the same as those in the second to fourth example embodiments. Hence, the same reference numerals denote the same components and operations, and a detailed description thereof will be omitted.

In the virtual network system <NUM>, an orchestration apparatus <NUM> includes an authentication server <NUM>, and authenticates the operations of the VNFs of all the virtual network services of the virtual network system <NUM>. Therefore, each virtual network system <NUM> of the virtual network system <NUM> includes no authentication server.

<FIG> is a block diagram showing the functional arrangement of the orchestration apparatus <NUM> according to this example embodiment. In <FIG>, the same reference numerals as those in <FIG> denote the same functional components and a description thereof will be omitted.

The orchestration apparatus <NUM> includes a digital signature generation verifier <NUM> that generates a digital signature for authenticating a VNF to be operated and verifies the digital signature. The authentication server <NUM> is connected via an interface <NUM>. Note that the authentication server <NUM> may be provided in the orchestration apparatus <NUM>.

Note that the structure of the authentication server <NUM> is obtained by adding only information for selecting a target virtual network system or service, and can be assumed from the authentication server <NUM> shown in <FIG>, and a detailed illustration and description thereof will be omitted.

<FIG> is a block diagram showing the arrangement of a virtual network system <NUM> according to this example embodiment. <FIG> shows an arrangement in which a plurality of virtual network systems <NUM> and <NUM> share an authentication server <NUM>. Note that an arrangement in which the plurality of virtual network systems <NUM> and <NUM> share a VNF database may be adopted. In <FIG>, the same reference numerals as those in <FIG> denote the same functional components and a description thereof will be omitted.

The virtual network system <NUM> includes a control apparatus <NUM>, a VNF database <NUM>, and a virtual network service <NUM>, and shares the authentication server <NUM> with the virtual network system <NUM>.

Note that the structure of the shared authentication server <NUM> is obtained by adding only information for selecting a target virtual network system or service, and can be assumed from the authentication server <NUM> shown in <FIG>, and a detailed illustration and description thereof will be omitted.

According to this example embodiment, in the virtual network system that implements orchestration, even if an operator is to provide a virtual network service based on a virtual network function produced by a third party, it is possible to prevent unauthorized registration, alteration, or occurrence of erroneous registration by a small number of components.

A virtual network system according to the sixth example embodiment of the present invention will be described next. The virtual network system according to this example embodiment is different from those according to the above-described second to fifth example embodiments in that special management is performed for virtual network functions. The remaining components and operations are the same as those in the second to fifth example embodiments. Hence, the same reference numerals denote the same components and operations, and a detailed description thereof will be omitted.

<FIG> is a view showing a case in which the valid period of a virtual network function is set according to this example embodiment. In <FIG>, the same reference numerals as those in <FIG> denote the same components and a description thereof will be omitted.

In an authentication server <NUM>, a valid period <NUM> of a verification key (public key) <NUM> is set. In a VNF database <NUM>, a valid period <NUM> of VNF data <NUM> with a digital signature is set.

If the valid periods end, the verification key (public key) <NUM> and the VNF data <NUM> with the digital signature are deleted or disabled. A VNF provider is notified of the end of the valid periods, and a new VNF is registered.

<FIG> is a table showing a case in which the compatibility of virtual network functions is considered according to this example embodiment.

For each VNF information (function or company) <NUM>, a VNF (or VNFs) <NUM> connectable to the VNF identified by the VNF information <NUM> and a VNF (or VNFs) <NUM> unconnectable to the VNF are stored. By using this table, it is possible to prevent unauthorized registration, alteration, or occurrence of erroneous registration by a digital signature, and also prevent an erroneous operation of a virtual network service based on whether the VNF is connectable.

According to this example embodiment, if the valid periods end, the virtual network function is updated and the authentication information is also updated, and an incompatible virtual network function is originally disabled. Thus, it is possible to prevent unauthorized registration, alteration, or erroneous registration from being encountered.

While the invention has been particularly shown and described with reference to example embodiments thereof, the invention is not limited to these example embodiments. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the scope of the present invention as defined by the claims.

Claim 1:
A virtual network system (<NUM>, <NUM>) comprising:
an authentication server (<NUM>) configured to store a plurality of pieces of authentication information (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>), each associated with a VNF, virtual network function identifier, and with a VNF provider identifier (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>) which represents a provider of a VNF, and wherein the authentication information is generated to include both VNF function information and VNF provider information;
a registration apparatus (<NUM>) configured to register a plurality of virtual network functions (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>), each associated with a VNF function identifier and with a VNF provider identifier (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>), respectively; and
a control apparatus (<NUM>) configured to:
receive, from an operator terminal (<NUM>), an instruction which represents activation or change of a virtual network function, and a VNF function identifier and a VNF provider identifier of the instructed virtual network function;
authenticate that the instructed virtual network function is valid, according to the received VNF function identifier and VNF provider identifier, using the plurality of pieces of authentication information (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>) stored in the authentication server (<NUM>); and
perform the activation or the change of the instructed virtual network function in response to a status that the instructed virtual network function corresponds to the received VNF function identifier and VNF provider identifier, using the plurality of virtual network functions (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>) associated with the plurality of VNF function identifiers and VNF provider identifiers (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>) registered in the registration apparatus (<NUM>);
wherein the authentication server (<NUM>) is configured to store as the authentication information a verification key (<NUM>, <NUM>, <NUM>, <NUM>) in association with the VNF identifier (<NUM>) and the VNF provider identifier, wherein the verification key (<NUM>, <NUM>, <NUM> and <NUM>) is generated to include VNF function information, VNF provider information and operator information, wherein the operator (<NUM>) is the operator who has input the instruction which represents the activation or change of a virtual network function.