Multi-Tenant SD-WAN Node Isolation for Shared Cloud Conduits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SD-WAN technologies face challenges in providing reliable and cost-effective access to cloud services for multiple tenants, as service providers are reluctant to manage numerous SD-WAN nodes and maintain service levels for each enterprise, and existing solutions lack efficient methods to prevent interference between different administrative domains.
Innovation Solution
A multi-tenant SD-WAN node is implemented within a service provider network, utilizing unique security measures and access designs to manage configurations independently for each tenant while maintaining control over the service provider network, with features like tenant-specific bandwidth limits and high-precision time synchronization to ensure reliable cloud conduit management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service providers allow each enterprise to place an SD-WAN appliance in their network, then service level requirements can be met, but device complexity and management overhead increase significantly
Solution Approach 1:
The patent combines multiple enterprise SD-WAN appliances into a single shared SD-WAN appliance that serves multiple tenants. The network controller manages multiple virtual networks within this single physical appliance, eliminating the need for separate appliances per enterprise while maintaining service level requirements through virtualization and isolated configuration spaces.
Solution Approach 2:
The shared SD-WAN appliance is designed to perform multiple functions for different enterprises simultaneously. It can handle routing, firewalling, and cloud service access for multiple tenants through a unified platform, making the appliance universal rather than dedicated to a single enterprise.
2Ease of manufacture
If service providers use commercially available Internet access and network equipment, then cost efficiency improves, but service level control and reliability deteriorate
Solution Approach 1:
The network controller acts as an intermediary between the service provider's core network and the SD-WAN appliance. It enforces service level policies, monitors performance, and manages traffic routing to ensure reliable cloud service access while allowing the use of cost-effective commercial Internet access and standard network equipment.
Solution Approach 2:
The system dynamically adjusts network parameters such as bandwidth allocation, routing paths, and quality of service settings through the network controller. This allows service levels to be maintained and optimized for different enterprises using the same physical infrastructure, enabling reliable service with cost-effective equipment.
3Device complexity
If multiple tenants share a single SD-WAN appliance, then device complexity is reduced, but tenant interference and security isolation become problematic
Solution Approach 1:
The shared SD-WAN appliance is segmented into multiple isolated virtual networks, each dedicated to a specific enterprise. The network controller creates separate configuration spaces and routing tables for each tenant, ensuring that traffic and management operations of one enterprise cannot interfere with another, while still using a single physical appliance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One method occurs at a first network node in a service provider network for providing at least one service to multiple tenants. The method includes generating, using input from an administrator of the service provider network, user configuration information for a first tenant; sending, to the first tenant, at least some of the user configuration information; receiving, from the first tenant, first configuration information for configuring a first conduit for tunneling communications between the service provider network and a first site associated with the first tenant's SD-WAN; configuring, using the first configuration information, the first conduit, wherein the first network node is associated with a plurality of conduits, wherein a second conduit of the plurality of conduits is at least in part configured by a second tenant and not the first tenant; and tunneling, via the first conduit, communications between the service provider network and the first site.