Route-Tagged VPC Routing for Multi-Tenant Route Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network technologies fail to efficiently isolate routing information among virtual private clouds (VPCs) in multi-tenancy networks, leading to potential interference and unauthorized access due to compromised route isolation, which impacts security, privacy, and resource management.
Innovation Solution
Associating routing information with unique route tags and allowing VPCs to subscribe to these tags for receiving relevant routing information, ensuring that only subscribed VPCs receive advertisements, thereby isolating and sharing routing information as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If routing information is exchanged among multiple VPCs using traditional routing protocols, then routing information can be shared, but route isolation is compromised leading to potential interference and unauthorized access
Solution Approach 1:
The patent segments routing information by associating each route with a unique route tag (such as VPC ID, subnet ID, or custom tag). This segmentation allows the routing system to distinguish between different VPCs and their respective routing information, enabling selective distribution only to authorized VPCs while maintaining isolation. The route tag acts as a identifier that partitions the routing information space among multiple tenants.
Solution Approach 2:
The patent introduces a transit VPC as an intermediary component that mediates routing information exchange between user VPCs. The transit VPC receives route advertisements, applies subscription-based filtering using route tags, and distributes only relevant routes to subscribed VPCs. This intermediary layer ensures that direct peer-to-peer routing exchanges are controlled and isolated, preventing unauthorized access while enabling necessary routing information sharing.
2Adaptability or versatility
If a transit VPC is deployed to facilitate routing information exchange, then routing information can be distributed among user VPCs, but system complexity increases
Solution Approach 1:
The transit VPC is designed with multi-functionality to justify its presence in the architecture. It simultaneously performs routing information reception, subscription management, route tag-based filtering, and selective distribution to multiple user VPCs. By consolidating these functions in a single intermediary component rather than requiring separate mechanisms for each VPC pair, the overall system complexity is reduced despite the added transit VPC.
Solution Approach 2:
The patent changes the parameter of route advertisement by introducing route tags as an additional attribute. Instead of traditional flat routing information exchange, routes are advertised with associated tags that enable subscription-based filtering. This parameter change transforms the routing information structure, allowing the transit VPC to efficiently manage multiple subscriptions and distributions using a standardized tagging mechanism rather than complex individual configurations.
3Ease of operation
If traditional routing protocols are used without route tags, then routing information exchange is simple, but security and privacy are compromised
Solution Approach 1:
The patent applies preliminary action by associating route tags with routing information before distribution occurs. User VPCs declare their subscriptions to specific route tags in advance, and the transit VPC configures its filtering rules beforehand. When route advertisements are received, the pre-configured subscription information enables automatic and secure filtering without requiring complex real-time security decisions, thus maintaining ease of operation while preventing unauthorized access.
Data Source
AI summary
A system for the isolation of routes in a network is provided. During operation, the system can receive subscription information indicating that a first virtual private cloud (VPC) of the network subscribes to a first route tag. Here, the subscription to a route tag can indicate that a subscriber is to receive routes associated with the route tag. The system can also receive, from a routing protocol instance of the network, a first route advertisement indicating a first route in the network. The first route advertisement can include the first route tag. The system can then determine, based on the first route tag in the route advertisement, that the first VPC subscribes to the first route tag. Accordingly, the system can provide the first route to the first VPC.