MPLS Flow Entries for Cloud Network Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing solutions for virtual private network (VPN) isolation in cloud computing face limitations such as VLAN isolation's restriction on the number of tenants, congestion due to single route selection in IP and MAC encapsulation, and complexity in configuring and maintaining MAC encapsulation networks.
Innovation Solution
Implementing a method using Multi-Protocol Label Switching (MPLS) flow entries managed by a Cloud Network Manager (CNM) to program flow routes in virtual and top-of-rack switches, eliminating the need for IP routing and allowing for scalable and flexible VPN formation without the limitations of VLANs or complex IP routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VLAN isolation is used for tenant separation, then network security and privacy are improved, but the number of supported tenants is limited to 4096 due to VLAN tag constraints
Solution Approach 1:
The patent changes the fundamental parameter for tenant identification from 12-bit VLAN tags (limiting to 4096 tenants) to MPLS labels with greater bit depth, enabling support for millions of tenants while maintaining network security through label-based isolation
Solution Approach 2:
The patent introduces MPLS labels as an intermediary layer between physical network infrastructure and virtual network functions, allowing tenant traffic to be isolated and routed through labeled switching paths without being constrained by traditional VLAN tagging limitations
2Stability of the object's composition
If spanning tree protocol is used for route selection, then routing loop prevention is achieved, but network congestion occurs due to single path selection
Solution Approach 1:
The patent replaces the static spanning tree protocol with dynamic MPLS label switching that can adaptively select multiple active paths simultaneously, allowing the network to dynamically utilize available bandwidth while maintaining loop-free operation through label-based path identification
Solution Approach 2:
The patent segments the network into multiple labeled switching paths, allowing traffic to be distributed across several parallel routes rather than forcing all traffic through a single spanning tree path, thereby increasing overall network throughput while maintaining routing stability
3Reliability
If IP encapsulation or MAC encapsulation is used for VPN implementation, then tenant isolation is achieved, but configuration and maintenance complexity increases
Solution Approach 1:
The patent extracts the complex IP routing and encapsulation logic from the data plane and relocates it to the control plane through centralized controller management, simplifying switch configuration to basic MPLS label switching while maintaining robust tenant isolation through controller-enforced policies
Data Source
AI summary
Embodiments of the invention include a method performed by a cloud network manager flow entries in a cloud network. The CNM is coupled to virtualized servers for hosting virtual machines (“VM”) that each comprise a virtual switch coupled to a top of rack switch (“TORS”). The CNM receives notification messages that indicate virtual machines have been scheduled for activation on virtualized servers. The CNM determines a VM media access control (“MAC”) address associated with the VM and a virtual switch MAC address associated with that virtualized server's virtual switch. The CNM records an association between the VM MAC address and the virtual switch MAC address. The CNM further determines a label that associates the TORS with the virtual switch. The CNM sends a modifies flow entries in the virtual switch to indicate data packets matching the MPLS label and the VM MAC address should be forwarded to the VM.