Container Network Isolation via OpenFlow Software Switch
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In container and virtual machine environments, existing communication methods fail to effectively isolate and secure network communication paths, leading to vulnerabilities in network security due to the inability to target and transmit data packets to specific tunnel inner IPs, resulting in potential network instability and security breaches.
Innovation Solution
A communication control method using a software switch supporting OpenFlow, such as Open vSwitch, generates flow rules and tunnel information to modify source and destination IPs of data packets, ensuring they are transmitted through specific tunnels corresponding to each container or virtual machine, thereby creating isolated communication networks and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing communication methods are used in container and virtual machine environments, then network communication can be established, but network security is compromised due to inability to isolate communication paths
Solution Approach 1:
The patent introduces a software switch supporting OpenFlow as an intermediary device between containers/virtual machines and the network. This software switch receives flow rules from the controller and automatically enforces communication policies by modifying data packets based on matching flow rules, thereby isolating communication paths without requiring complex manual routing configurations on each container or virtual machine
Solution Approach 2:
The patent segments network communication into isolated paths by creating dedicated tunnels for each container or virtual machine. Each tunnel is identified by a unique tunnel inner IP address, and flow rules are configured to match specific source or destination IPs with corresponding tunnel inner IPs, thereby dividing the network into separate secure communication channels
2Reliability
If manual routing setup is implemented for each container or virtual machine, then network isolation can be achieved, but setup complexity and time increase significantly
Solution Approach 1:
The system enables self-service automation where the controller automatically generates flow rules and tunnel information when containers or virtual machines are created. The software switch automatically applies these rules and dynamically modifies data packets based on the configured flow rules, eliminating the need for manual routing setup on each container or virtual machine while maintaining network isolation
Solution Approach 2:
The controller performs preliminary actions by pre-configuring flow rules and tunnel information before containers or virtual machines begin communication. When a container or virtual machine is created, the controller proactively generates the necessary flow rules and transmits them to the software switch, so that network isolation is already in place before any data transmission occurs
3Object-affected harmful factors
If communication paths are not isolated, then network stability may be maintained, but security vulnerabilities increase due to inability to target specific tunnel inner IPs
Solution Approach 1:
The patent applies local quality by configuring specific flow rules with matching conditions tailored to each container or virtual machine's IP address and corresponding tunnel inner IP. Each flow rule is customized to match only the relevant source or destination IP with its specific tunnel inner IP, thereby providing targeted security control for each communication path rather than applying uniform rules to all traffic
Data Source
AI summary
Disclosed is a communication control method of a container in a container environment provided from a computing apparatus, performed by a controller. The communication control method may include, when the container is newly generated, generating a flow rule for controlling a communication path of a data packet related to the container through a software switch supporting OpenFlow; generating tunnel information that includes a tunnel inner Internet protocol (IP) corresponding to the container; and transmitting the flow rule or the tunnel information to the computing apparatus.