SDN Multi-Tenant Port Association for Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Software Defined Networking (SDN) environments, there is a need to achieve high-performance tenant-specific processing while minimizing the overhead associated with processing flows encapsulated in tunneling protocols, which complicates the application of tenant-specific policy to tenant-specific network flows.
Innovation Solution
The approach involves associating a specific tenant with a specific port on a virtual switch, using a non-overlay SDN method, where the SDN controller maintains tenant/port associations and applies per-tenant policies to ensure compliance with multi-tenant security requirements, thereby enabling direct network flow processing without continuous parsing of tenant data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If overlay networks use encapsulation (tunneling) to transmit additional information (e.g., tenant identity), then tenant identification capability is improved, but processing overhead increases significantly
Solution Approach 1:
The patent extracts the tenant identification function from the packet data payload and places it in the packet header at the data link layer. By using VLAN tags and switch port associations, the tenant identity is carried separately from the actual data traffic, eliminating the need to parse through encapsulated payload data for tenant information.
Solution Approach 2:
The patent segments the network processing function by separating control plane (tenant policy management) from data plane (packet forwarding). The SDN controller handles tenant-specific policy application centrally, while switches perform simple hardware-based packet forwarding based on pre-established port-tenant mappings, dividing the processing workload to optimize both identification capability and speed.
2Measurement precision
If continuous parsing of tenant data from information flow is performed, then tenant-specific policy application accuracy is improved, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing port-tenant association mappings in the SDN controller before data traffic flows through the network. These pre-computed associations are installed in switch forwarding tables, allowing packets to be routed to the correct tenant port without real-time parsing or decision-making, thus achieving both accurate policy application and fast processing.
3Productivity
If direct network flow processing is used without overlay encapsulation, then processing overhead is reduced, but tenant isolation and security policy application become difficult
Solution Approach 1:
The patent introduces the switch port as an intermediary mechanism between the physical network infrastructure and tenant logic. By associating specific ports with specific tenants through VLAN tags and forwarding tables, the system maintains tenant isolation and security boundaries without requiring complex overlay encapsulation, thus preserving both efficiency and reliability.
Data Source
AI summary
An SDN controller associated with a switch maintains unique tenant/port association data, and pushes to the switch per-tenant policies. A per-tenant information processing port (IPP) on the switch enables traffic sent to or from a tenant to be distinguished from that of another tenant, even with respect to packet processing devices (PPDs) that share a particular switch. With the described approach, the properties of a non-overlay SDN are leveraged to support multi-tenancy in an efficient manner, preferably by associating a specific tenant with a specific port (on the virtual switch) once, rather than continuously parsing tenant data from the information flow. The technique enables the application of tenant-specific policy to tenant-specific network flows in a multi-tenant network.