MPLS Label Isolation for Cloud Network Tenant Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing solutions for virtual private network (VPN) isolation in cloud computing face limitations such as VLAN tag restrictions, congestion due to single route selection, and increased complexity and cost with IP and MAC encapsulation methods, which hinder efficient multi-tenancy and scalability.
Innovation Solution
Implementing a method using a Cloud Network Manager (CNM) that manages multi-protocol label switching (MPLS) flow entries to isolate tenant-specific data by associating tenant IDs with MPLS labels, allowing data packets to be forwarded correctly across virtual machines, thereby eliminating the need for IP routing and reducing network complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VLAN tagging is used for tenant isolation, then network segmentation is achieved, but the number of tenants is limited to 4096 due to tag restrictions
Solution Approach 1:
The patent transitions from 2-layer (VLAN) isolation to 3-layer isolation by adding MPLS labels. The MPLS label stack includes a tenant identifier label and a service identifier label, creating an additional dimension for tenant differentiation beyond the 12-bit VLAN tag limitation, thereby supporting unlimited tenants.
Solution Approach 2:
The patent changes the isolation mechanism from VLAN tags (12-bit limitation) to MPLS labels (32-bit capacity). By modifying the labeling parameter from VLAN ID to MPLS label with tenant identifier, the system overcomes the 4096 tenant limit while maintaining network segmentation.
2Reliability
If IP encapsulation is used for VPN isolation, then tenant traffic isolation is achieved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the routing function from the data plane by using MPLS labels for forwarding decisions. The tenant identifier is carried in the MPLS label stack, allowing switches to forward packets based on label matching rather than complex IP routing tables, thereby reducing device complexity.
Solution Approach 2:
The patent introduces MPLS labels as an intermediary between the tenant identifier and the network forwarding mechanism. Instead of directly implementing IP routing or complex encapsulation, the MPLS label acts as a mediator that simplifies forwarding decisions while maintaining tenant isolation.
3Reliability
If MAC encapsulation is used for VPN isolation, then tenant traffic isolation is achieved, but implementation complexity increases
Solution Approach 1:
The patent segments the MPLS label stack into distinct functional components: a tenant identifier label and a service identifier label. This segmentation allows independent management of tenant isolation and service routing, simplifying implementation compared to monolithic MAC encapsulation approaches.
4Device complexity
If single route selection is used for network forwarding, then routing simplicity is maintained, but network congestion occurs
Solution Approach 1:
The patent enables dynamic route selection by using MPLS label matching to identify multiple possible paths. The network can dynamically choose among multiple routes based on current conditions while maintaining simple forwarding rules at each switch, thereby avoiding congestion without increasing routing complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A tenant database is used to add tenant ID information to the cloud network manager (CNM) address mapping table to isolate tenant specific data to a tenant ID to the CNM. The CNM maintains a mapping among a plurality of items in a plurality of databases or tables. The plurality of databases or tables include a tenant database (DB), a tenant identifier to tenant label (TITL) table, a top of rack server label to virtual switch link label (TLVLL) table, a label mapping table (SMVL), and a CNM address mapping table. The CNM uses the plurality of databases to generate tenant specific labels that are added to packets sent between tenant virtual machines (VMs).