Multi-tenant isolation control system based on QUIC proxy optimization

Abstract

The invention relates to a multi-tenant isolation control system based on QUIC proxy optimization, and belongs to the field of computer networks. The system comprises an access layer, a control layer and a data layer, the access layer is responsible for protocol processing, the control layer realizes strategy management, the data layer completes isolated forwarding, and the system realizes tenant identity binding and connection management, a tenant resource isolation method, a tenant personalized strategy and tenant monitoring and recording. Through the kernel-level isolation technology, the cross-tenant resource interference rate is effectively reduced, the bandwidth of key tenants is effectively guaranteed, various scene requirements are met, the multi-tenant transmission performance is improved, personalized requirements are supported to rapidly fall into the ground, the monitorability and compliance are enhanced, and the resource utilization rate is optimized.

Description

Technical Field

[0001] This invention belongs to the field of computer networks, specifically relating to a multi-tenant isolation control system based on QUIC proxy optimization. Background Technology

[0002] With the widespread adoption of cloud-native and SaaS models, system platforms need to simultaneously support the business loads of tens of thousands of tenants, covering various scenarios such as relational enterprise data, personal data, and industrial production data. Traditional TCP-based proxy gateways have limitations, requiring 2-3 handshakes to establish a persistent network connection, which significantly increases connection latency under high concurrency. Furthermore, the current method of identifying connections using a four-tuple of IP address and port cannot adapt to the needs of tenants dynamically migrating their networks, and the current extensive resource allocation model is prone to cross-tenant performance interference caused by sudden surges in single-tenant traffic.

[0003] The QUIC protocol is implemented based on UDP and incorporates features such as TLS 1.3 encryption and 0-RTT connection establishment, significantly reducing latency during the initial handshake. Furthermore, it eliminates IP address binding issues through Connection ID (CID), effectively supporting network connection migration (client migration between different networks). For example, major cloud vendors have gradually begun supporting QUIC proxies, resulting in improved page load times.

[0004] However, current QUIC proxy solutions are not deeply optimized for multi-tenant scenarios, with limited improvements to the tenant identity and connection context binding mechanism, posing a risk of data leakage. Furthermore, resource allocation does not incorporate differentiated SLA requirements, resulting in weak business assurance capabilities; tenant-level granular monitoring logs are needed. Therefore, building a QUIC proxy gateway that supports multi-tenant resource isolation has become a key direction for cloud service / SaaS platforms to improve performance and security.

[0005] The purpose of this invention is to solve the problems of tenant resource contention and isolation failure, QUIC link and tenant identity adaptation, delayed response to tenant personalized needs, and lack of multi-tenant observability.

[0006] Tenant resource contention and isolation failure issues: Under shared gateway resources, sudden traffic surges from a single tenant can easily consume high bandwidth, such as more than 70%, causing the response latency of other tenant interfaces to increase several times, such as from 100ms to 300ms or even higher; some solutions rely solely on path prefix isolation, which may lead to security incidents where data is misrouted to other tenant databases.

[0007] QUIC link and tenant identity mismatch issue: The CID of the traditional QUIC proxy is not associated with the tenant identifier. When the tenant service migrates across nodes, a new connection needs to be established, which may cause business interruption.

[0008] The problem of delayed response to tenant personalized configuration requirements: Different tenants have different requirements for encryption algorithms, rate limiting thresholds, and retransmission strategies. Most existing solutions are implemented through hard coding, and adding new rules requires an iteration cycle.

[0009] The issue of missing multi-tenant observational monitoring: monitoring logs do not tag tenant IDs, and when the interface timeout rate increases, it is necessary to check each tenant individually. There is a lack of tenant-level SLA compliance rate statistics, making it impossible to quantify the effect of resource isolation. Summary of the Invention

[0010] (a) Technical problems to be solved The technical problem to be solved by this invention is how to provide a multi-tenant isolation control system based on QUIC proxy optimization to solve the problems of tenant resource contention and isolation failure, QUIC link and tenant identity adaptation, delayed response to tenant personalized needs, and lack of multi-tenant observability.

[0011] (II) Technical Solution To address the aforementioned technical issues, this invention proposes a QUIC proxy-optimized multi-tenant isolation control system. This system comprises an access layer, a control layer, and a data layer. The access layer is responsible for protocol processing, the control layer implements policy management, and the data layer completes isolation forwarding. This system implements tenant identity binding and connection management, tenant resource isolation methods, tenant personalized policies, and tenant monitoring and recording. Access layer: Includes QUIC protocol parsing module and tenant access gateway module, responsible for receiving tenant QUIC traffic, parsing CID and tenant identifier in it, and completing 0-RTT handshake and TLS offload; Control Layer: Acts as a gateway, including: tenant metadata center, policy engine and resource scheduling module, used to store tenant ID and deployment mode data; dynamically generate resource isolation, encryption and rate limiting policies; adjust resource quotas in real time based on tenant load; Data Layer: Includes QUIC forwarding proxy and tenant resource pool. Forwarding is based on the CID attribute in the QUIC protocol to realize connection binding and traffic routing functions. The resource pool allocates independent CPU, memory and bandwidth resources to tenants through the set network policies.

[0012] (III) Beneficial Effects This invention proposes a multi-tenant isolation control system based on QUIC proxy optimization. Compared with existing technologies, this invention can effectively solve some pain points of tenant isolation in environments such as cloud services or SaaS platforms.

[0013] 1. Achieve tenant-level resource isolation: Through kernel-level isolation technology, the interference rate of cross-tenant resources is effectively reduced, the bandwidth of critical tenants is effectively guaranteed, and the needs of various scenarios are met.

[0014] 2. Improve multi-tenant transmission performance: Leveraging QUIC 0-RTT handshake and connection migration capabilities, significantly reduce latency for the first connection access of tenants and optimize cross-node migration interruption issues.

[0015] 3. Supports rapid implementation of personalized needs: Encryption, rate limiting and other requirements can be achieved through configurable rules, and the rules take effect faster and more efficiently.

[0016] 4. Enhance monitorability and compliance: Enable tenant-level traffic monitoring and log review to improve fault location efficiency.

[0017] 5. Optimize resource utilization: Dynamically adjust resource quotas based on tenant load to improve server resource utilization. Attached Figure Description

[0018] Figure 1 This is a system architecture diagram of the present invention; Figure 2 This is a method for controlling resource isolation for tenants. Detailed Implementation

[0019] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0020] This invention provides a multi-tenant isolation control system based on QUIC agent optimization. The system architecture consists of: The system adopts a three-tiered architecture of "access-control-data," compatible with various cloud deployment scenarios. Its core components include the access layer, control layer, and data layer, such as... Figure 1 As shown, the system illustrates the relationships between the various layers and the interaction methods of the three-tier architecture. The access layer is responsible for protocol processing, the control layer implements policy management, and the data layer completes isolated forwarding. The system implements tenant identity binding and connection management, tenant resource isolation methods, tenant personalized policies, and tenant monitoring and logging.

[0021] 1. Access Layer: Includes the QUIC protocol parsing module and the tenant access gateway module, which is responsible for receiving tenant QUIC traffic, parsing the CID and the tenant identifier therein, and completing the 0-RTT handshake and TLS offloading.

[0022] 2. Control Layer: Acts as a gateway, consisting of a tenant metadata center, a policy engine, and a resource scheduling module. It stores tenant IDs, deployment modes, and other data; dynamically generates resource isolation, encryption, and rate limiting policies; and adjusts resource quotas in real-time based on tenant load.

[0023] 3. Data Layer: Includes QUIC forwarding proxy and tenant resource pool. Forwarding is based on the CID attribute in the QUIC protocol to realize connection binding and traffic routing functions. The resource pool allocates independent CPU, memory and bandwidth resources to tenants through the set network policies.

[0024] Core Mechanism: 1. Tenant identity binding and connection management (1) Multi-method tenant identification: The access layer can associate traffic with tenants in the following ways: ① The tenant identifier prefix (such as T123xxx) is embedded in the CID of the QUIC protocol header. ② Resolve subdomain information embedded in the request (e.g., T123xxx.com) ③ Verify the tenant token information in the QUIC protocol request header, and determine the tenant and domain information based on the token storage information.

[0025] (2) Connection context storage isolation: By storing session keys, ACK sequence numbers of unacknowledged data packets, etc., an independent QUIC connection context pool is maintained for each tenant of the connection. At the same time, during cross-node transmission migration, the context can be synchronized to the new target node through the control layer so that the new target node receives the complete tenant connection context, thereby realizing seamless network migration.

[0026] 2. Tenant resource isolation methods A diagram illustrating tenant resource isolation methods is shown below. Figure 2 The diagram illustrates the process from tenant access packet identification to resource allocation, ensuring that tenants of different priorities receive the corresponding resource configurations. (1) Tiered resource allocation: Based on the tenant's level, the available resources are allocated: for example, high-priority tenants are reserved with high peak bandwidth and use priority queues; ordinary tenants can use weighted fair queues; low-priority tenants have their bandwidth limited to no more than a certain percentage.

[0027] (2) Kernel resource isolation configuration: Kernel resources can also be further restricted by tenant level, including CPU utilization, memory, etc. (e.g., setting high upper and lower limits for high-priority tenants and low upper limits for low-priority tenants). At the same time, network policies can be used to block direct communication between tenants to achieve logical isolation at the network layer.

[0028] 3. Tenant Personalization Strategy Tenant rule configuration: Standardized rule templates can be provided to allow tenants to configure various custom rules via the console or web interface, including encryption policies, network and system resource restriction rules, etc. Configuration rules can be synchronized to the gateway in real time via messages for control.

[0029] 4. Tenant monitoring and recording (1) Link observation and monitoring: Various indicators used by tenants, including bandwidth utilization, number of connections, latency, etc., can be collected and recorded to record the corresponding observation records and operation logs. At the same time, tenant IDs can be embedded in the log records to form link observation.

[0030] (2) Monitoring and analysis: By statistically analyzing various indicators used by tenants, including bandwidth utilization, connection latency, number of interruptions, etc., we can provide a basis for subsequent resource adjustments.

[0031] Workflow: S1. Tenant Initialization (Tenant Data Pool Initialization): The administrator first creates tenant metadata in the control layer, including various tenant information, tenant level, tenant resource configuration, tenant policy information, etc.

[0032] S2. Tenant Access Connection Establishment: The tenant initiates a QUIC connection request through its corresponding client (e.g., WEB / APP). The QUIC gateway access layer parses the tenant's identifier, verifies the tenant's information, and then assigns an independent tenant information context to complete the handshake operation. This tenant information context stores the connection content, enabling the cross-node migration described above.

[0033] S3. Traffic forwarding: The QUIC gateway's data layer forwards traffic based on the tenant's own policy, prioritizing the transmission of high-priority tenants and monitoring resource usage to ensure that each tenant conforms to its own configuration and does not affect the use of other tenants.

[0034] S4. Dynamic Adjustment: The QUIC gateway's control layer periodically monitors tenant load and network status, enabling adaptive resource adjustment. When utilization is low, high resources are reclaimed, and when utilization is high, resource allocation is increased. At the same time, tenant configuration rules can be quickly modified through gateway synchronization policies.

[0035] S5. Monitoring Records: Collect data through the QUIC gateway or backend services, continuously collect tenant performance metrics and log content, analyze the rationality of tenant configurations, and support subsequent configuration changes and optimization strategies.

[0036] Compared with existing technologies, this invention can effectively solve some pain points of tenant isolation in environments such as cloud services or SaaS platforms.

[0037] 1. Achieve tenant-level resource isolation: Through kernel-level isolation technology, the interference rate of cross-tenant resources is effectively reduced, the bandwidth of critical tenants is effectively guaranteed, and the needs of various scenarios are met.

[0038] 2. Improve multi-tenant transmission performance: Leveraging QUIC 0-RTT handshake and connection migration capabilities, significantly reduce latency for the first connection access of tenants and optimize cross-node migration interruption issues.

[0039] 3. Supports rapid implementation of personalized needs: Encryption, rate limiting and other requirements can be achieved through configurable rules, and the rules take effect faster and more efficiently.

[0040] 4. Enhance monitorability and compliance: Enable tenant-level traffic monitoring and log review to improve fault location efficiency.

[0041] 5. Optimize resource utilization: Dynamically adjust resource quotas based on tenant load to improve server resource utilization.

[0042] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A multi-tenant isolation control system based on QUIC agent optimization, characterized in that, The system comprises an access layer, a control layer, and a data layer. The access layer is responsible for protocol processing, the control layer implements policy management, and the data layer completes isolated forwarding. The system implements tenant identity binding and connection management, tenant resource isolation methods, tenant personalized policies, and tenant monitoring and logging. Access layer: Includes QUIC protocol parsing module and tenant access gateway module, responsible for receiving tenant QUIC traffic, parsing CID and tenant identifier in it, and completing 0-RTT handshake and TLS offload; Control Layer: Acts as a gateway, including: tenant metadata center, policy engine and resource scheduling module, used to store tenant ID and deployment mode data; dynamically generate resource isolation, encryption and rate limiting policies; adjust resource quotas in real time based on tenant load; Data Layer: Includes QUIC forwarding proxy and tenant resource pool. Forwarding is based on the CID attribute in the QUIC protocol to realize connection binding and traffic routing functions. The resource pool allocates independent CPU, memory and bandwidth resources to tenants through the set network policies.

2. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 1, characterized in that, Tenant identity binding and connection management includes: multi-method tenant identification and connection context storage isolation; Multi-method tenant identification: The access layer associates traffic with tenants through multiple methods; Connection context storage isolation: By storing session keys and ACK sequence number information of unacknowledged data packets, an independent QUIC connection context pool is maintained for each tenant of the connection; during cross-node transmission migration, the context is synchronized to the new target node through the control layer so that the new target node receives the complete tenant connection context, thereby realizing seamless network migration.

3. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 2, characterized in that, Multiple methods include: embedding the tenant identifier prefix in the CID of the QUIC protocol header; parsing the subdomain information embedded in the request; verifying the tenant token information in the QUIC protocol request header, and determining the tenant and domain information based on the token storage information.

4. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 1, characterized in that, Tenant resource isolation methods include: tiered resource configuration, specifically: allocating available resource content based on tenant level, reserving high peak bandwidth for high-priority tenants and using priority queues; using weighted fair queues for ordinary tenants; and limiting bandwidth for low-priority tenants to no more than a certain percentage.

5. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 1, characterized in that, Tenant resource isolation methods include: kernel resource isolation configuration, specifically including: further limiting kernel resources at the tenant level, including CPU utilization and memory; at the same time, blocking direct communication between tenants through network policies to achieve logical isolation at the network layer.

6. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 1, characterized in that, Tenant personalization strategies include: tenant rule configuration, specifically including: providing standardized rule templates to support tenants in configuring various custom rules through the console or page, including encryption policies, network and system resource restriction rules; configuration rules are synchronized to the gateway in real time via messages for control.

7. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 1, characterized in that, Tenant monitoring and logging includes: link observation monitoring, which specifically includes: collecting various metrics used by tenants, including bandwidth utilization, number of connections and latency, recording response observation records and operation logs, and embedding the tenant ID in the log records to form link observations.

8. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 1, characterized in that, Tenant monitoring and recording includes monitoring and analysis, specifically: statistically analyzing various metrics used by tenants, including bandwidth utilization, connection latency, and number of interruptions, to provide a basis for subsequent resource adjustments.

9. The QUIC agent-based optimized multi-tenant isolation control system as described in any one of claims 1-8, characterized in that, The system's workflow includes: S1. Tenant Initialization: The administrator first creates tenant metadata in the control layer; S2. Tenant Access Connection Establishment: The tenant initiates a QUIC connection request through the corresponding client. The QUIC gateway access layer parses the tenant's identifier, identifies and verifies the tenant's information, and then assigns an independent tenant information context to complete the handshake operation. The tenant information context here stores the connection content. S3, Traffic Forwarding: The QUIC gateway's data layer forwards traffic based on the tenant's own policy, prioritizing the transmission of high-priority tenants and monitoring resource usage to ensure that each tenant conforms to its own configuration and does not affect the use of other tenants; S4. Dynamic Adjustment: The QUIC gateway's control layer periodically monitors tenant load and network status, enabling adaptive resource adjustment. When utilization is low, high resources are reclaimed, and when utilization is high, resource allocation is increased. At the same time, the gateway synchronization policy allows for quick modification of tenant configuration rules. S5. Monitoring Records: Collect data through the QUIC gateway or backend services, continuously collect tenant performance metrics and log content, analyze the rationality of tenant configurations, and support subsequent configuration changes and optimization strategies.

10. The QUIC agent-based optimized multi-tenant isolation control system as described in claim 9, characterized in that, Tenant metadata includes various tenant information, tenant class, tenant resource configuration, and tenant policy information.

Images