Highly dynamic authorisation of concurrent usage of separated controllers

1. A method for controlling a virtual network in which resources of a physical network or a further virtual network are modeled, wherein a network element of the physical network or the further virtual network is configured to be controlled by a virtual network operator controller the method comprising:

receiving, in a virtual network control message from the virtual network operator controller, control information indicating at least one additional controller, which is not configured to be enabled to control the network element, to be enabled and disabled to control the network element;

forwarding configuration information to a network element controller controlling the network element to accept configuration messages from the additional controller; and

receiving, in the virtual network control message from the virtual network operator controller, via at least one input/output unit, control information indicating that the at least one additional controller is no longer to be enabled to control the network element and forwarding configuration information to the network element controller controlling the network element to not accept configuration messages from the additional controller.

2. The method according to claim 1 , wherein the control information comprises information of an identity of the at least one additional controller and/or information of an address of the at least one additional controller.

3. The method according to claim 1 , further comprising:

deciding whether the at least one additional controller is to be trusted or not; and

forwarding the configuration information to the network element controller controlling the network element only when the additional controller can be trusted.

4. The method according to claim 3 , wherein it is decided to trust the additional controller when the control information is received from a trusted application control element and/or it is decided to trust the additional controller based on network configuration.

5. The method according to claim 1 , further comprising:

receiving, in the virtual network control message, control information indicating that the at least one additional controller is no longer to be enabled to configure and/or control the network element or

deciding that the additional controller is no longer to be enabled to configure and/or control the network element; and

forwarding configuration information to the network element controller controlling the network element to not accept configuration messages from the additional controller.

6. The method according to claim 1 , wherein the control information is inserted into an information element of the virtual network control message.

7. A computer program product embodied on a non-transitory computer-readable medium, said product comprising computer-executable components which, when the program is run on a processing device, are configured to carry out the method according to claim 1 .

8. A virtual network provider controller comprising

a memory,

at least one input/output unit, and

a processor, the virtual network provider controller being a control element on a virtual network provider level of a virtual network in which resources of a physical network or a further virtual network are modeled and wherein a network element of the physical network or the further virtual network is configured to be controlled by a virtual network operator controller,

the processor being further configured to

to receive, in a virtual network control message from the virtual network operator controller, via the at least one input/output unit, control information indicating an additional controller, which is not configured to be enabled to control the network element, to be enabled to control the network element;

to forward configuration information to a network element controller controlling the network element to accept configuration messages from the additional controller; and

to receive, in the virtual network control message from the virtual network operator controller, via the at least one input/output unit, control information indicating that the at least one additional controller is no longer to be enabled to control the network element and to forward configuration information to the network element controller controlling the network element to not accept configuration messages from the additional controller.

9. The apparatus according to claim 8 , wherein the control information comprises information of an identity of the at least one additional controller and/or information of an address of the at least one additional controller.

10. The apparatus according to claim 8 , wherein the processor is further configured to decide whether the at least one additional controller is to be trusted or not; and

to forward the configuration information to the network element controller controlling the network element only when the additional controller can be trusted.

11. The apparatus according to claim 10 , wherein the processor is configured to decide to trust the additional controller when the control information is received from a trusted application control element and/or to decide to trust the additional controller based on network configuration.

12. The apparatus according to claim 8 , wherein the processor is further configured

to receive, in the virtual network control message, via the at least one input/output unit, control information indicating that the at least one additional controller is no longer to be enabled to configure and/or control the network element; or

to decide that the additional controller is no longer to be enabled to configure and/or control the network element, and

to forward configuration information to the network element controller controlling the network element to not accept configuration messages from the additional controller.

13. The apparatus according to claim 8 , wherein the control information is inserted into an information element of the virtual network control message.