SDN Policy Enforcement Across Heterogeneous VPCs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

There is a need for defining and enforcing policies in software-defined networks (SDNs) for traffic to and from container clusters, particularly in Kubernetes environments, where existing solutions lack efficient mechanisms for scaling and managing network policies across multiple virtual private clouds (VPCs).

Innovation Solution

A method is introduced where a second SDN controller cluster, residing in a different VPC, receives resource identifiers from adapters in the first VPC to define and distribute service policies to network elements, ensuring enforcement of policies on data messages across VPCs, even when the first SDN controller cluster does not have the capability to define these policies itself, utilizing adapters and network attributes to manage network policies across multiple VPCs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a second SDN controller cluster is introduced to define service policies for the first VPC, then the capability to define and enforce policies across multiple VPCs is improved, but the device complexity increases due to multiple controller clusters and adapters

Engineering Contradiction:

Improvecapability to define and enforce policies across multiple VPCsVSAvoidstructure with multiple controller clusters and adapters

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system is divided into separate controller clusters (first SDN controller cluster for first VPC, second SDN controller cluster for policy definition) and adapters, allowing each component to have specialized functionality. This segmentation enables independent scaling and management of policy definition and enforcement functions across different VPCs.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Adapters are introduced as intermediary components between the first SDN controller cluster and the second SDN controller cluster. These adapters facilitate communication and coordinate policy enforcement across VPC boundaries, simplifying the interaction between multiple controller clusters.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If service policies are distributed to network elements in the first VPC by the second SDN controller cluster, then the scalability of policy management across VPCs is improved, but the loss of information may increase due to policy distribution through multiple components

Engineering Contradiction:

Improvescalability of policy management across VPCsVSAvoidpotential information loss during policy distribution

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The system implements feedback mechanisms where the second SDN controller cluster receives status information from network elements in the first VPC about policy enforcement. This feedback loop ensures that policy information is accurately transmitted and enforced, allowing for correction of any potential information loss during distribution.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The second SDN controller cluster performs preliminary actions by pre-defining service policies based on resource identifiers before distributing them to network elements. This preliminary policy preparation ensures that all necessary information is included in the distributed policies, reducing the risk of information loss during transmission.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If the first SDN controller cluster uses adapters to communicate with the second SDN controller cluster, then the adaptability of the system to manage heterogeneous networks is improved, but the ease of operation decreases due to the complexity of adapter configuration

Engineering Contradiction:

Improveability to manage heterogeneous networksVSAvoidadapter configuration complexity

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The adapters are designed with universal functionality to communicate with both the first SDN controller cluster and the second SDN controller cluster. This multi-functionality allows the same adapter components to handle diverse network configurations and protocols, simplifying their operation while maintaining adaptability to heterogeneous networks.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11831511B1Enforcing network policies in heterogeneous systems

Publication Date: 2023.11.28 VMWARE INC

AI summary

Some embodiments provide a novel method for enforcing service policies at different container clusters configured by several SDN controller clusters. A first SDN controller cluster defines a particular service policy to be enforced for machines in first, second, and third container clusters. First, second, and third sets of network elements for the first, second, and third container clusters are managed by the first, a second, and a third SDN controller cluster respectively. For data message flows exchanged between machines in the first and second container clusters, the first SDN controller cluster distributes the particular service policy to service nodes only in the first container cluster. For data message flows exchanged between machines in the second and third container clusters, the first SDN controller cluster distributes the particular service policy to service nodes in at least one of the second and third container clusters.