Decapsulating VM for Tenant Network Traffic Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring network traffic in cloud computing systems is challenging due to the abstraction of low-level network interfaces and configuration data, making it difficult for tenant organizations to troubleshoot issues, gauge capacity, or detect malicious requests, as traditional sniffer applications require direct access to these hidden resources.
Innovation Solution
A method is introduced that involves instantiating a decapsulating VM with two network interfaces, establishing an encapsulated port mirroring session from a tenant VM's port to the decapsulating VM, and forwarding captured network traffic to a sniffer VM, allowing for monitoring without direct access to the tenant's network configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional sniffer applications are used to monitor network traffic, then network traffic monitoring capability is improved, but direct access to low-level network interfaces and configuration data is required which conflicts with cloud computing system abstraction
Solution Approach 1:
The patent introduces a cloud provider-deployed sniffer application as an intermediary component that bridges the gap between tenant monitoring needs and cloud abstraction. This intermediary sniffer application runs on cloud-provided virtual machines and has the necessary access to network interfaces, while tenants can still monitor their traffic through API-based requests. The intermediary translates tenant monitoring requests into actions that work within the cloud's abstracted network environment.
Solution Approach 2:
The patent segments the monitoring function into two distinct parts: (1) the cloud provider's infrastructure layer that handles direct network interface access and low-level configuration, and (2) the tenant's application layer that uses high-level APIs to request monitoring. This segmentation allows each layer to operate within its appropriate access level, with the cloud provider's sniffer application handling the low-level access requirements while tenants interact through simplified interfaces.
2Reliability
If cloud providers provision virtual machines for tenant isolation, then security and isolation between tenants are improved, but tenant access to underlying network infrastructure is reduced
Solution Approach 1:
The patent uses the cloud provider's virtual machine infrastructure as an intermediary platform. The sniffer application is deployed on these provider-managed VMs, which maintain the isolation boundaries while providing the necessary network access capabilities. Tenants can monitor their traffic by requesting monitoring on their virtual machines through APIs, and the provider's sniffer application on the infrastructure VMs captures and relays this information without breaking the isolation model.
Solution Approach 2:
The cloud provider's virtual machine platform serves multiple functions simultaneously: it maintains tenant isolation and security, provides network connectivity for tenant applications, and hosts the sniffer application infrastructure. This multi-functionality allows the same virtualized environment to support both isolation requirements and monitoring capabilities without requiring separate infrastructure.
Data Source
AI summary
Network traffic in a cloud computing system is monitored in response to a request to capture network traffic of a tenant port of a first virtual machine (VM) executing in the cloud computing system, wherein the first VM is associated with a first tenant organization different from a second organization managing the cloud computing system. A decapsulating VM having a first network interface and a second network interface is instantiated, wherein the decapsulating VM is inaccessible to the first tenant organization. An encapsulated port mirroring session from the tenant port of the first VM to the first network interface of the decapsulating VM is then established. A plurality of packets comprising captured network traffic received via the encapsulated port mirroring session are decapsulated, and the captured network traffic is forwarded via the second network interface of the decapsulating VM to a sniffer VM.