Distributed Source NAT for Multi-Tenant Cloud Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud service access methods using private IP addresses are inefficient due to the need for network address translation (NAT) gateways, which create bottlenecks and are costly when dealing with multiple tenant logical networks, especially when network input/output is intensive.
Innovation Solution
Implementing source network address translation (SNAT) using a pool of unique private IP address and port number pairs across multiple tenant logical networks, allowing packets to bypass NAT gateways by replacing source IP addresses and port numbers with unique replacement pairs, and routing them through tunnels or physical forwarding elements for efficient access to shared cloud services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If one NAT gateway is used per tenant logical network, then cloud service access is enabled for multiple tenant logical networks, but network I/O becomes a bottleneck when access intensity is high
Solution Approach 1:
The patent segments the centralized NAT gateway functionality into distributed NAT capabilities across multiple host machines. Each host that runs a service VM gains the ability to perform NAT operations locally, eliminating the single-point bottleneck architecture. This segmentation allows parallel processing of network I/O across multiple nodes, directly resolving the throughput limitation.
Solution Approach 2:
The patent extracts the NAT function from the centralized NAT gateway and relocates it to individual host machines. By taking out the NAT capability from the gateway and embedding it in the hosts, the system enables direct service access without forcing all traffic through the gateway, thereby eliminating the I/O bottleneck while preserving multi-tenant access capability.
2Productivity
If one floating IP address is assigned to each virtual machine for direct cloud service access, then access efficiency is improved, but cost increases due to requiring one floating IP address per VM
Solution Approach 1:
The patent merges the NAT functionality into the host machines themselves, combining the service hosting capability with the address translation capability. This integration eliminates the need for separate floating IP addresses for each VM, as the host's NAT function can handle address translation for multiple service VMs using its own IP address, thereby reducing the total quantity of floating IPs required while maintaining direct access efficiency.
Solution Approach 2:
The host machine becomes a universal node that can host multiple service VMs and simultaneously perform NAT operations for them. This multi-functionality allows a single host IP address to serve multiple purposes - hosting multiple services and providing address translation - eliminating the need for dedicated floating IP addresses for each VM while preserving direct access capability.
3Reliability
If NAT gateway is used for cloud service access, then network address translation is performed, but device complexity and cost increase
Solution Approach 1:
The host machines perform NAT operations for themselves and other hosts, making the system self-sufficient. Each host that runs a service VM automatically gains NAT capability through the embedded function, eliminating the need for external NAT gateway infrastructure. This self-service approach maintains reliable address translation while reducing overall system complexity and eliminating dedicated gateway devices.
Solution Approach 2:
The patent eliminates the NAT gateway intermediary by making each host its own intermediary for address translation. Instead of traffic flowing through an external gateway, each host performs local NAT operations, removing the intermediate gateway layer from the architecture. This reduces device complexity by eliminating the gateway infrastructure while preserving the essential address translation capability through distributed host-based NAT.
Data Source
AI summary
A method of providing efficient access to cloud services in a network that includes a several tenant logical networks and a set of service logical networks. The method receives, from a particular tenant VM, a first packet that specifies a destination address associated with a service VM of a service logical network. The method, based on the destination address of the first packet, replaces the source network address and source port number of the first packet with one of a set of network address and port number pairs allocated for accessing service VMs. The method receives from the particular VM a second packet that specifies a destination address outside the tenant logical network but not associated with any service VM. The method, without modifying the source address and port number of the second packet, forwards the second packet to a network element outside the host for network NAT processing.