Cloud Cluster Isolation via Authentication Piggybacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face complexity and inefficiency in maintaining customer isolation due to the need for frequent updates and stateful network control planes, which can lead to operational outages and increased network traffic.
Innovation Solution
A method using modified digital certificates to piggyback cluster tenancy and network configuration information, allowing for automatic configuration deployment and traffic isolation without requiring host-side functionality like hypervisors or smart NICs, by leveraging a customized PKI service and port-based authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If host-side functionality (hypervisor/smart NIC) is used to maintain customer isolation, then network traffic separation is achieved, but system complexity and network traffic burden increase
Solution Approach 1:
The patent extracts the isolation enforcement functionality from the host-side (hypervisor/smart NIC) and moves it to the network switch side. The switch now directly enforces customer isolation through port-based authentication and VLAN assignment, eliminating the need for complex host-side network control plane components.
Solution Approach 2:
The patent introduces an authentication service as an intermediary between the network switch and the network control plane. This service handles the complex authentication logic and state management, simplifying the switch's role to just enforcing authentication decisions and reducing overall system complexity.
2Measurement precision
If static switch configuration is dynamically updated to maintain accurate tenancy description, then customer isolation accuracy is improved, but operational outages and network traffic burden increase
Solution Approach 1:
The patent performs preliminary authentication and configuration assignment before traffic forwarding begins. The switch authenticates devices and assigns VLANs in advance, so that when traffic flows, the configuration is already in place and no dynamic updates are needed during operation, preventing outages.
Solution Approach 2:
The patent makes the switch configuration dynamic through authentication-based VLAN assignment. Instead of static pre-configured VLANs, the switch dynamically assigns VLANs based on authentication results, allowing accurate tenancy description without manual configuration updates.
3Reliability
If stateful network control plane is used to maintain customer isolation state, then isolation accuracy is improved, but network resources are consumed and complexity increases
Solution Approach 1:
The patent enables the network switch to self-configure based on authentication results. The authentication service provides configuration instructions to the switch, which then automatically applies the appropriate VLANs and isolation policies without requiring continuous state management by a centralized control plane, reducing resource consumption.
4Measurement precision
If frequent configuration updates are performed to maintain current tenancy description, then isolation accuracy is improved, but update errors and operational outages increase
Solution Approach 1:
The authentication and configuration assignment occurs before traffic forwarding begins, ensuring that the tenancy description is established accurately in advance. This preliminary action prevents the need for frequent updates during operation, reducing the risk of configuration errors and outages.
Data Source
AI summary
Systems, methods, and other embodiments associated with cloud computing cluster isolation with strong authentication and automatic configuration deployment are described. In one embodiment, a method includes, in response to receiving an authentication frame through the uncontrolled port, (i) extracting data from the authentication frame for performing authentication, and (ii) parsing the authentication frame to identify a piggybacked virtual network identifier that functions as an instruction to create an isolated connection. If the authentication was successful and the piggybacked virtual network identifier was identified, creating the isolated connection between the controlled port and a virtual network that is identified by the piggybacked virtual network identifier.