Tunnel Endpoint Allocation for SDN Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments with multiple tenants, distinguishing between encapsulated packets and managing network usage and quality of service for each tenant is challenging due to the lack of distinct tunnel endpoints allocation.
Innovation Solution
A management operation identifies virtual machine connections to virtual switches and allocates unique tunnel endpoints to each tenant, mapping virtual machines to these endpoints for proper encapsulation and communication, ensuring each tenant has a unique identifier for quality of service management and network traffic monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If tunnel endpoints are shared among multiple tenants, then device complexity is reduced, but measurement precision of network usage per tenant deteriorates
Solution Approach 1:
The patent segments the shared tunnel endpoint resource by introducing tenant-specific identifiers (VXLAN VNI, tenant ID) that divide the communal tunnel endpoint into logically separated channels for different tenants. This allows the same physical tunnel endpoint to serve multiple tenants while maintaining distinct measurement capabilities for each tenant's network usage.
2Measurement precision
If unique tunnel endpoints are allocated to each tenant, then measurement precision of network usage improves, but device complexity increases
Solution Approach 1:
The patent makes the tunnel endpoint universal by enabling it to serve multiple tenants simultaneously through the introduction of tenant identifiers and VLAN tagging. Instead of requiring separate physical tunnel endpoints for each tenant, a single tunnel endpoint can handle traffic from multiple tenants by identifying and separating their packets using VXLAN VNI and tenant ID fields, thus achieving multi-functionality.
3Ease of operation
If tenant identification in encapsulated packets is difficult, then ease of operation is reduced, but device complexity is reduced
Solution Approach 1:
The patent uses VXLAN VNI and tenant ID as distinctive markers (analogous to color changes) that clearly identify which tenant each encapsulated packet belongs to. These identifiers are embedded in the packet header, making tenant identification straightforward and enabling easy quality of service management without requiring complex packet inspection or handling mechanisms.
Data Source
AI summary
Described herein are systems and methods for allocating to tunnel endpoints to virtual machines on a host. In one example, a host identifies when a new virtual machine is coupled to a virtual switch and determines a tenant associated with the new virtual machine. The host further determines whether a tunnel endpoint is allocated to the tenant and, when a tunnel endpoint has not been allocated, allocates a new tunnel endpoint to the tenant and maps the new virtual machine to the new tunnel endpoint.