Path Identifier Packet Routing for Multi-Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data centers with multiple service providers, existing technologies face challenges in isolating traffic, managing resource usage, and ensuring security due to the sharing of physical hardware resources and virtual machines across different hosts, leading to issues like routing inefficiencies and security breaches.
Innovation Solution
The implementation of path identifiers within network packets, situated between Layer 2 and Layer 3 headers, allows network elements to determine and enforce valid routing paths, preventing unauthorized packet delivery and enabling logical division of hardware resources, thereby isolating traffic and improving resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualization is used to share physical hardware resources across multiple service providers, then resource utilization and flexibility are improved, but security issues and resource usage control problems arise
Solution Approach 1:
The patent segments network traffic by introducing path identifiers that divide the network space into isolated virtual networks. Each service provider's traffic is segmented into separate path instances, allowing multiple providers to share physical infrastructure while maintaining logical isolation. This resolves the contradiction by enabling resource sharing (improved adaptability) while preventing unauthorized access between providers (maintained security).
Solution Approach 2:
The path identifier acts as an intermediary element inserted between Layer 2 and Layer 3 headers. This intermediary carries routing information that enables network elements to distinguish between different service providers' traffic without requiring separate physical infrastructure. The intermediary mechanism allows secure multi-tenant sharing by mediating access control at the packet level.
2Adaptability or versatility
If virtual machines are moved between physical servers to improve flexibility, then resource allocation flexibility is improved, but routing inefficiencies and forwarding latencies occur
Solution Approach 1:
The system performs preliminary action by pre-establishing path identifiers and routing rules before virtual machines need to be moved. Network elements are pre-configured with path identifier-to-port mappings, so when a virtual machine migrates between physical servers, the pre-established path routing enables immediate forwarding without recalculation delays. This maintains flexibility while minimizing forwarding latency.
Solution Approach 2:
The patent implements dynamic path routing where path identifiers are associated with specific network ports and can be dynamically remapped as virtual machines move between physical hosts. This dynamic association allows the network to adapt to VM migrations in real-time without breaking connectivity or requiring lengthy reconfiguration, thus maintaining both flexibility and low latency.
3Reliability
If path identifiers are inserted into packets between Layer 2 and Layer 3 headers to enforce routing paths, then traffic isolation and security are improved, but device complexity increases
Solution Approach 1:
The patent extracts the path routing function from the complex Layer 3 routing process and implements it as a separate, simplified mechanism at the Layer 2/3 boundary. By taking out the path identifier validation and port mapping functions into dedicated network elements, the system achieves traffic isolation without requiring complex multi-protocol routing logic in every device. This reduces overall device complexity while maintaining strong isolation.
Solution Approach 2:
Rather than implementing full routing logic in every network element, the patent applies partial action by having only specific network elements (those at path boundaries) perform path identifier validation and port mapping. Intermediate switches simply forward packets based on pre-configured path associations, reducing their complexity. This selective application of routing intelligence achieves traffic isolation without universal complexity.
Data Source
AI summary
In one embodiment, a method includes receiving a first packet sent by a first node. The packet includes a first Layer 3 source address, a first Layer 3 destination address, a first Layer 2 source hardware identifier, a first Layer 2 destination hardware identifier, and a first path identifier. The first path identifier is situated between a Layer 2 header of the first packet and a Layer 3 header of the first packet. The method includes automatically determining a first port of the first network element associated with a second node. The second node is associated with the first Layer 2 destination hardware identifier. A second path identifier is automatically determined based on the first port. The first packet is prevented from being delivered to the second node in response to determining that the first path identifier and the second path identifier are different.