Cloud Multicast Tenant Isolation via VPC Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multicast technologies in cloud computing lack tenant isolation, leading to insecure data transmission, as any device in the network can join any multicast group, compromising data security and efficiency.
Innovation Solution
A cloud-end data multicast method that uses tenant identifiers and destination addresses to search for corresponding multicast groups, computes route trees, performs address filtering, and encapsulates multicast packets for precise delivery, ensuring secure and efficient data transmission by isolating IP address spaces and separating control and data planes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional multicast technology is used without tenant isolation, then data transmission efficiency is improved, but data security deteriorates as any device can join any multicast group
Solution Approach 1:
The patent segments the network into isolated tenant virtual networks using VPC (Virtual Private Cloud) technology. Each tenant's multicast groups are confined within their own VPC, creating logical segmentation that prevents cross-tenant access while maintaining efficient multicast transmission within each tenant's network space.
Solution Approach 2:
The patent introduces a gateway as an intermediary component that mediates between different VPCs and multicast groups. The gateway enforces access control policies, verifying tenant identities and validating multicast group memberships, thereby securing data transmission while enabling controlled multicast communication.
2Reliability
If tenant isolation is implemented in multicast technology, then data security is improved, but network complexity increases due to additional isolation mechanisms
Solution Approach 1:
The patent implements multi-functional gateway devices that simultaneously perform routing, access control, encryption, and multicast management functions. By consolidating multiple functions into a single gateway infrastructure, the system achieves tenant isolation and security without proportionally increasing network device complexity.
Solution Approach 2:
The patent uses parameter-based isolation through VPC identifiers and tenant-specific network parameters. By changing and enforcing specific network parameters (VPC IDs, tenant tags, access control lists) rather than requiring fundamentally different network architectures, the system achieves isolation with minimal complexity increase.
3Measurement precision
If precise multicast delivery is implemented with address filtering, then data transmission accuracy is improved, but processing time increases due to filtering operations
Solution Approach 1:
The patent performs preliminary address filtering and multicast group membership validation during the packet encapsulation phase, before packets enter the transmission network. By pre-filtering addresses and pre-establishing multicast group memberships, the system achieves accurate delivery without adding filtering delays during actual data transmission.
Solution Approach 2:
The patent combines address filtering, tenant validation, and multicast routing decisions into a single integrated processing step at the gateway. By merging multiple processing operations into one unified action during packet encapsulation, the system achieves precise delivery accuracy without sequential processing delays.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
A cloud-end data multicast method includes: obtaining a multicast packet, the multicast packet carrying a tenant identifier, a destination address, and a source address; searching for a corresponding multicast group according to the tenant identifier and the destination address, the multicast group including multiple multicast members; obtaining routes corresponding to the multicast members, and generating a route tree according to routes corresponding to multiple multicast members; obtaining member addresses corresponding to the multicast members, and performing address filtering according to the source address and the member addresses, so as to obtain an address list of members that require the multicast packet; and encapsulating the multicast packet, and delivering an encapsulated multicast packet to multicast members that require the multicast packet according to the address list of members and the route tree.