Multi-Tenant Edge Router Security Using VRF-Based Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenanted networks, applying zone-based firewalls is challenging due to overlapping VPN IDs and inconsistent VPN presence across edge routers, leading to complex firewall configurations and high overhead when using containers or namespaces.
Innovation Solution
Introduce the concept of local identifiers generated by edge nodes to identify applicable zones, using overlay routing protocols to learn and map VPN IDs to VRFs, enabling efficient zone-based firewall configurations without containers or namespaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If zone-based firewalls are applied in multi-tenanted networks using traditional methods, then security isolation between tenants is improved, but device complexity and configuration overhead increase significantly
Solution Approach 1:
The patent introduces VRF (Virtual Routing and Forwarding) instances as an intermediary layer between physical network interfaces and zone-based firewall policies. Each tenant's VPN is mapped to a unique VRF instance, which acts as a mediator that isolates tenant traffic at the routing level before firewall evaluation. This intermediary structure eliminates the need for complex container or namespace configurations while maintaining security isolation, as the VRF instances provide natural traffic segmentation that simplifies firewall policy application.
Solution Approach 2:
The patent segments the network infrastructure by creating separate VRF instances for each tenant, effectively dividing the shared physical infrastructure into isolated virtual routing domains. This segmentation approach allows zone-based firewalls to operate on clearly defined virtual interfaces without dealing with overlapping VPN IDs or complex tenant identification logic. Each VRF instance represents a discrete segment that can be independently configured and secured.
2Measurement precision
If containers or namespaces are used to isolate VPNs with overlapping IDs, then tenant identification accuracy is improved, but resource overhead and device complexity increase
Solution Approach 1:
The patent uses VRF instances as intermediaries that provide unique identification and isolation for each tenant's VPN without requiring additional container or namespace infrastructure. The VRF mapping table serves as a mediator that translates tenant-specific VPN parameters into globally unique VRF instance identifiers, enabling precise tenant identification without the resource overhead of creating separate container environments for each VPN.
Solution Approach 2:
The VRF instance mechanism serves multiple functions simultaneously: it provides tenant isolation, enables unique identification of overlapping VPNs, facilitates routing, and supports firewall policy application. This universal approach eliminates the need for separate container or namespace implementations, reducing resource overhead while maintaining precise tenant identification and security isolation.
3Adaptability or versatility
If multiple VPN instances with overlapping IDs are supported, then adaptability and tenant flexibility are improved, but firewall policy application becomes more difficult
Solution Approach 1:
The patent performs preliminary action by pre-establishing VRF instances and creating mappings between tenant VPN parameters and VRF identifiers before firewall policy configuration. This advance setup ensures that each tenant's VPN is already associated with a unique VRF instance, eliminating the need for complex runtime identification logic when applying firewall policies. The mapping table is prepared in advance, allowing straightforward policy application based on VRF instance membership.
Solution Approach 2:
The VRF mapping table acts as an intermediary that resolves the complexity of overlapping VPN IDs by translating tenant-specific identifiers into unique VRF instance references. This mediator structure allows firewall policies to be applied uniformly based on VRF membership without requiring complex logic to handle overlapping VPN IDs, thereby maintaining tenant flexibility while simplifying firewall policy management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.