Edge Router Tenant Isolation via Access Switch Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a method to establish a network connection between a cloud network and an enterprise's existing infrastructure, enabling secure and isolated data transmission while managing tenant network edge devices and cloud gateways effectively.
Innovation Solution
The edge router communicates with an access switch to receive and process messages from tenant network edge devices, adding identifiers to requests and removing them from responses, using routing tables to forward messages to cloud gateways, thereby establishing and maintaining network connections and ensuring data isolation and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the edge router directly processes messages from tenant network edge devices, then the network connection between cloud network and enterprise infrastructure is established, but the data isolation and security between different tenants cannot be ensured
Solution Approach 1:
The patent segments the message processing function by introducing a separate access switch that handles tenant identification and message routing. The edge router focuses only on forwarding messages between access switches and cloud gateways, while the access switch manages tenant-specific identifier handling. This segmentation ensures data isolation between tenants while simplifying the edge router's processing complexity.
Solution Approach 2:
The access switch acts as an intermediary device between tenant network edge devices and the edge router. It receives messages from tenants, adds tenant identifiers, routes them to appropriate cloud gateways, and manages the communication protocol. This intermediary role ensures secure data isolation while reducing the complexity burden on the edge router.
2Adaptability or versatility
If the edge router manages all tenant network edge devices directly, then network connection is simplified, but the scalability of the network cannot support multiple tenants effectively
Solution Approach 1:
The network architecture is segmented into multiple functional layers: tenant network edge devices connect to access switches, which then connect to edge routers, and finally to cloud gateways. This hierarchical segmentation allows the system to scale by adding more access switches and edge routers without increasing the complexity at any single level, enabling effective multi-tenant support.
Solution Approach 2:
The access switch serves multiple functions: it connects to multiple tenant network edge devices, manages multiple tenant identifiers, routes messages to different cloud gateways, and handles both request and response messages. This multi-functionality at the access switch level enables the network to support multiple tenants effectively while keeping the edge router's role relatively simple.
3Productivity
If the edge router processes all message routing functions, then the network connection is direct and simple, but the message processing efficiency and routing accuracy decrease
Solution Approach 1:
The message processing function is segmented between the access switch and the edge router. The access switch handles tenant-specific processing, identifier addition, and initial routing decisions, while the edge router handles the final forwarding to cloud gateways. This segmentation improves processing efficiency by distributing workloads and maintains routing accuracy through coordinated operation between the two devices.
Solution Approach 2:
The access switch acts as an intermediary that pre-processes messages before they reach the edge router. It adds tenant identifiers, validates routing information, and prepares messages for forwarding. This intermediary processing improves overall message processing efficiency while the edge router maintains simple forwarding operations through clear interface protocols.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed by embodiments of the present application are a network access method used for an edge router and an edge router. One specific embodiment of the method comprises: receiving a first request message sent by a first tenant network edge device among at least one tenant network edge device; on the basis of port information of a port connected to the first tenant network edge device, obtaining a first request identification corresponding to the first tenant network edge device, wherein the first request identification is used to identify the first tenant network edge device; adding the first request identification to the first request message so as to generate a processed first request message; and on the basis of a stored routing table, forwarding the processed first request message to a cloud gateway. The described embodiment implements a network connection between the first tenant network edge device and the cloud gateway.