Encrypted Control Connection Sharing for Multi-Tenant Edge Routers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SD-WAN systems face challenges in achieving high scalability and efficiency in multi-tenancy due to the overhead and cost associated with multiple control connections, leading to increased resource usage and complexity.
Innovation Solution
Implementing a shared control plane infrastructure across tenants using a centralized network management system to multiplex multiple tenants onto a single encrypted control connection, reducing the number of control connections and optimizing the control plane interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple control connections are established for each tenant, then tenant isolation and control accuracy are improved, but system complexity and resource usage increase
Solution Approach 1:
The patent merges multiple control connections into a single shared control connection that serves multiple tenants. The control plane interface is designed to multiplex control traffic from different tenants over one encrypted connection, eliminating the need for separate control connections per tenant while maintaining tenant isolation through logical segmentation within the shared connection.
Solution Approach 2:
The shared control connection is designed with multi-functionality to handle control traffic from multiple tenants simultaneously. The control plane interface can identify and route control packets for different tenants within the same connection, allowing a single connection to perform the work of multiple dedicated connections.
2Reliability
If multiple control connections are established for each tenant, then control accuracy is improved, but socket and memory usage increase
Solution Approach 1:
The patent consolidates multiple control connections into one shared connection, directly reducing the number of sockets required and the memory allocated for connection tracking. The control plane interface maintains tenant identification mechanisms within the shared connection to preserve control accuracy without the resource overhead of multiple connections.
3Ease of operation
If multiple control connections are established for each tenant, then tenant-specific control is improved, but bandwidth requirements increase
Solution Approach 1:
The patent merges multiple tenant control traffic streams into a single encrypted control connection, reducing the total bandwidth consumed for control plane communication. The control plane interface includes mechanisms to identify and prioritize control packets for different tenants within the shared connection, maintaining tenant-specific control capabilities while reducing overall bandwidth requirements.
Data Source
AI summary
In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.