Per-IP Routing Tables for Virtual Server Traffic Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current data storage systems lack effective isolation of network traffic between virtual servers sharing a common routing table, leading to security risks and traffic leakage, especially in legacy systems that do not support multiple network namespaces.

Innovation Solution

Each virtual server is provided with its own per-IP routing table specifying its interface with an external network, allowing the storage processor to assign outbound protocol data units (PDUs) to these tables based on the source IP address, ensuring that traffic is isolated from other virtual servers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If a common routing table is shared by all virtual servers, then device complexity is reduced and ease of operation is improved, but network traffic isolation between virtual servers deteriorates and security risks increase

Engineering Contradiction:

Improverouting table structureVSAvoidnetwork traffic isolation

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent divides the single common routing table into multiple separate routing tables, one for each virtual server. Each routing table contains only the routing entries relevant to that specific virtual server, achieving traffic isolation while maintaining manageable complexity through automated management.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a virtual server identifier (VSI) as an intermediary mechanism that links outbound packets to the appropriate virtual server's routing table. This mediator enables the system to select the correct routing table based on the VSI embedded in the packet, achieving isolation without requiring a single monolithic routing structure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If separate network namespaces are provided for each virtual server, then network traffic isolation is improved, but device complexity and compatibility with legacy systems worsen

Engineering Contradiction:

Improvenetwork traffic isolationVSAvoidnetwork namespace structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the routing table separation concept from the network namespace abstraction layer. Instead of creating full separate network namespaces (which legacy systems don't support), it extracts only the routing table component and manages it separately per virtual server, achieving isolation compatibility with legacy systems.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies local quality by providing each virtual server with its own dedicated routing table containing only the routing entries relevant to that server. This localized routing information ensures that each virtual server's traffic is handled according to its specific requirements while maintaining overall system compatibility.

Inventive Principle:

Principle #3Local quality

3Ease of operation

If a common routing table is used for all virtual servers, then ease of operation is improved, but security risks increase due to traffic leakage between virtual servers

Engineering Contradiction:

Improverouting managementVSAvoidtraffic leakage and security risks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent uses the virtual server identifier (VSI) as an intermediary that is embedded in outbound packets and used to automatically select the appropriate routing table. This mediator mechanism maintains ease of operation through automated selection while preventing security risks by ensuring packets are routed only through the correct virtual server's routing table.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements a feedback mechanism where the VSI in the outbound packet feeds back to the routing table selection logic, which then selects the appropriate routing table. This closed-loop feedback ensures that routing decisions are automatically made based on the packet's origin, maintaining operational simplicity while preventing cross-contamination between virtual servers.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS9806984B1Separating network traffic among virtual servers

Publication Date: 2017.10.31 EMC IP HLDG CO LLC

AI summary

Techniques for routing network traffic in a storage processor involve providing per-IP routing tables for each IP address of a virtual server and a per-server routing table. These per-IP and per-server routing tables specify its own interface(s) with external network(s). The storage processor assigns each outbound protocol data unit (PDU), generated by a particular virtual server, to either a per-IP routing table or a per-server routing table provided for that virtual server. The assignment of the routing table is based on source IP address or a connection mark associated with an outbound PDU. The per-IP or per-server routing table(s) identifies an interface through which the packet is routed to the destination IP address.