Microservice Map Construction for Container Traffic Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring, provisioning, and protecting container-based cloud computing platforms are challenging due to the difficulty in inspecting packet traffic between containers using traditional network management and security tools, which rely on IP addresses, as containers do not require IP addresses and can have virtual IP addresses hidden behind NAT layers.
Innovation Solution
Transforming traffic metrics from containers to microservices and constructing a microservice map to facilitate network policy recommendations and configurations, using a system that includes processors, service engines, virtual switches, and cloud connectors to intercept and redirect traffic, and collect metrics at the microservice level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network management tools that rely on IP addresses are used, then network monitoring and security inspection can be performed, but container-based cloud computing platforms cannot be effectively monitored because containers do not require IP addresses and can have virtual IP addresses hidden behind NAT layers
Solution Approach 1:
The patent introduces a service mesh as an intermediary layer between containers and the network. This service mesh includes service engines that intercept, inspect, and manage traffic at the application layer (Layer 7) rather than relying on IP addresses. The service mesh acts as a mediator that translates container-to-container communication into observable network traffic patterns that can be monitored and managed.
Solution Approach 2:
The patent shifts the monitoring dimension from network layer (IP addresses, ports) to application layer (service names, microservice relationships). By constructing a microservice map that visualizes traffic patterns between services rather than between IP addresses, the system enables monitoring in a different dimensional space where container communication becomes observable and manageable.
2Adaptability or versatility
If containers use virtual IP addresses behind NAT layers, then network address translation is achieved, but traffic patterns between different applications and containers become difficult to inspect
Solution Approach 1:
The service mesh acts as an intermediary that sits between the NAT layer and the applications. It captures traffic before it undergoes NAT translation, allowing full visibility into the original source and destination service identities. The service engines record and analyze traffic patterns at this intermediate point, preserving application-level context that would otherwise be lost in NAT translation.
Solution Approach 2:
The system performs preliminary traffic inspection and pattern detection before NAT translation occurs. By capturing and analyzing traffic metadata at the service mesh layer prior to address translation, the system preserves the ability to trace traffic patterns between applications and containers even though the actual packet headers undergo NAT modification.
3Productivity
If multiple containers share a single operating system instance, then resource efficiency is improved, but monitoring and provisioning become more difficult due to the lack of IP address visibility
Solution Approach 1:
The patent segments the monitoring function into two distinct layers: the service mesh layer that handles container-to-container traffic inspection, and the network layer that handles external traffic. This segmentation allows the monitoring system to focus on application-level patterns without being overwhelmed by the complexity of individual container IP address management, simplifying the overall monitoring architecture despite the dense container packing.
Solution Approach 2:
The service mesh provides universal monitoring capabilities that work across all containers regardless of their specific IP address configurations or host assignments. By creating a unified service-level abstraction layer, the system achieves multi-functionality that handles monitoring, provisioning, and security for diverse container deployments through a single consistent interface.
Data Source
AI summary
Determining and presenting traffic patterns includes: obtaining a first set of traffic metrics pertaining to network traffic associated with a plurality of containers of a container-based cloud computing platform, wherein: the plurality of containers supports a plurality of microservices; and a microservice has one or more corresponding microservice instances that execute on one or more of the plurality of containers; transforming the first set of traffic metrics into a second set of traffic metrics, the second set of traffic metrics comprising network traffic information pertaining to at least some of the plurality of microservices, the transformation being based at least in part on information pertaining to the plurality of containers and the plurality of microservices supported by the plurality of containers; constructing a microservice map based on the second set of traffic metrics; and outputting the microservice map.