Route Server Group Address Association Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networking (SDN) multi-site systems, existing technologies face challenges in effectively distributing and enforcing group-based policies, such as firewall rules, across multiple data centers, as they lack efficient mechanisms for learning and sharing associations between group identifiers and addresses.
Innovation Solution
The method involves using route servers associated with central control planes in each data center to learn and distribute associations between group identifiers and addresses through Border Gateway Protocol (BGP), allowing for the enforcement of policies across multiple data centers by storing these associations in tables and programming hypervisors accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If group-based policies are enforced across multiple data centers, then policy coverage and security are improved, but the complexity of distributing and maintaining group address associations increases
Solution Approach 1:
The patent introduces route servers as intermediary components that mediate between control planes in different data centers. These route servers maintain local tables of group-to-address associations and exchange routing information using BGP protocols, thereby distributing the complexity of multi-site policy enforcement across dedicated intermediary nodes rather than requiring direct coordination between all control planes.
Solution Approach 2:
The system segments the global policy enforcement function into distributed components: each data center's control plane generates local group-to-address associations, which are then distributed to route servers. This segmentation allows each component to handle a manageable subset of the overall task, reducing individual complexity while maintaining global policy consistency.
2Loss of information
If route servers distribute group address associations across data centers, then information sharing and policy enforcement are improved, but the amount of data to be transmitted and stored increases
Solution Approach 1:
Route servers maintain and exchange only the specific group-to-address association data that is relevant for policy enforcement, rather than transmitting complete endpoint inventories or all possible routing information. This partial action approach transmits sufficient data for security policies while avoiding unnecessary data volume expansion.
3Reliability
If firewall rules are enforced at hypervisors based on distributed associations, then security enforcement is improved, but the complexity of programming and configuring hypervisors increases
Solution Approach 1:
The system performs preliminary computation of group-to-address associations at control planes and route servers before enforcement. By pre-computing the necessary firewall rules and association mappings, the system reduces the complexity of hypervisor configuration, as hypervisors receive ready-to-enforce rule sets rather than requiring complex real-time computation or configuration management.
Data Source
AI summary
Embodiments described herein involve learning and distributing associations between groups and addresses. Embodiments include receiving, by a first route server associated with a first central control plane (CCP) of a first data center, a definition of a first group. Embodiments include learning, by the first route server, a first association between the first group and one or more addresses based on the definition of the first group. Embodiments include transmitting, by the first route server, the first association to a second route server in a second CCP of a second data center. Embodiments include receiving, by the first route server, from the second route server, a second association between the first group and one or more additional addresses. Embodiments include storing, by the first route server, the first association and the second association in a table and programming, by the first central control plane, the hypervisor based on the table.