Multi-Layer NAT for SDN Tenant Traffic Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant Software Defined Networking (SDN) environments, existing network overlays introduce processing latency and complexity in distinguishing between tenants' network traffic, as they require additional protocol handling and encapsulation, which negatively impacts performance.
Innovation Solution
Implementing a multi-layer network address translation (NAT) system managed by an SDN controller, which dynamically translates network protocol address attributes to enable logical routing of packets to appropriate packet processing devices, using a tenant-to-address mapping service to ensure multi-tenant awareness without relying on encapsulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network overlay protocols are used to distinguish tenant traffic, then multi-tenant awareness is achieved, but processing latency increases and performance deteriorates
Solution Approach 1:
The patent extracts the tenant identification information from the complex overlay protocol encapsulation and places it directly into the IP header fields (such as DSCP or ECN bits). This allows packet processing devices to identify tenant traffic without needing to decode the entire overlay encapsulation, significantly reducing processing latency while maintaining accurate tenant distinction.
Solution Approach 2:
The patent segments the tenant identification function from the overall packet forwarding process. By using specific IP header fields dedicated to tenant identification, the system separates the tenant awareness function from the routing and overlay processing functions, enabling parallel and more efficient processing.
2Measurement precision
If overlay encapsulation is used to support multi-tenant environments, then tenant isolation is achieved, but device complexity and processing overhead increase
Solution Approach 1:
The patent extracts essential tenant identification information and places it in standard IP header fields that are already present in the packet structure. This eliminates the need for packet processing devices to implement complex overlay-aware logic, as they can identify tenant traffic using standard IP header parsing already built into their forwarding engines.
Solution Approach 2:
The patent uses existing IP header fields (such as DSCP or ECN bits) for dual purposes: traditional QoS/classification functions and new tenant identification functions. This multi-functional use of existing fields avoids adding new complex structures while enabling tenant awareness.
3Reliability
If traditional overlay protocols are used for multi-tenant support, then tenant isolation is achieved, but processing speed and network performance decrease
Solution Approach 1:
The patent extracts tenant identification into readily accessible IP header fields, allowing packet processing devices to identify and separate tenant traffic at line speed without deep packet inspection or complex protocol decoding, thereby maintaining high processing speeds while ensuring reliable tenant isolation.
Data Source
AI summary
“Multi-tenant awareness” is added to a set of one or more packet processing devices in a Software Defined Network (SDN) having a controller. For each of one or more tenants, information in a table associates network protocol address attributes with an Internet Protocol (IP) address unique to the tenant. The table is associated with a multiple-layer translation layer being managed by the SDN controller. As a data packet traverses the translation layer, network protocol address attributes are translated according to values in the table to enable logical routing of the packet (to a given PPD. This translation occurs dynamically (or “on-the-fly”) as packets are “on route” to their destination. By implementing a multi-layer network address translation (NAT), one layer may be used to translate network protocol address source attributes, while a second layer may be used to translate network protocol address destination attributes.