SDN Virtual Switch Multi-Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network architectures face challenges in providing scalable and transparent isolation for multi-tenant virtual data center networks (vDCNs) due to limitations in traditional router designs and the complexity of managing bandwidth, security policies, and quality of service, especially in cloud computing environments, where traditional methods fail to efficiently manage dynamic traffic and resource sharing.
Innovation Solution
The implementation of a Software Defined Networking (SDN) system with an autonomic management plane that uses OpenFlow protocol to provide elastic Layer 2 (L2) isolation, enabling self-managing and self-configuring virtual networks by decoupling the control and data planes, allowing for dynamic configuration and scalable management of virtual switches and routers, and utilizing a hybrid architecture with a master SDN controller and tenant-specific controllers for efficient packet handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional monolithic router designs are used to meet increasing bandwidth demands, then network capacity is improved, but device complexity and cost increase significantly
Solution Approach 1:
The patent segments the traditional monolithic router into two separate planes: a control plane handled by a centralized SDN controller and a forwarding plane handled by simplified switching elements. This segmentation allows the forwarding plane to use cost-effective, simple hardware while the control plane handles complex routing logic, thus maintaining high bandwidth capacity without proportionally increasing device complexity and cost.
Solution Approach 2:
The SDN controller acts as an intermediary between the centralized intelligence and the simplified switching elements. It receives high-level routing policies, translates them into detailed forwarding rules, and programs the switching elements accordingly. This intermediary approach enables complex network management without requiring complex hardware at each switching point.
2Productivity
If network virtualization is adopted to share infrastructure among multiple tenants, then resource efficiency is improved, but multi-tenant isolation and security become more difficult to implement
Solution Approach 1:
The patent segments the network view for each tenant by implementing multi-table lookups in the forwarding plane. The first table performs tenant identification and the second table performs forwarding decision. This segmentation ensures that each tenant's traffic is independently identified and forwarded according to tenant-specific rules, providing strong isolation while sharing the underlying physical infrastructure.
Solution Approach 2:
The patent creates virtual copies of network resources for each tenant through virtualization. Each tenant gets a virtual network instance with its own forwarding table, security policies, and routing rules. These virtual copies run on shared physical infrastructure, enabling resource efficiency while maintaining tenant isolation through virtual boundary enforcement.
3Ease of operation
If centralized control is implemented to simplify forwarding elements, then ease of operation is improved, but control plane scalability becomes a bottleneck
Solution Approach 1:
The patent segments the control plane functionality by separating tenant-specific control logic from global network control. The SDN controller uses a multi-table lookup approach where the first table handles tenant identification (tenant-specific) and the second table handles forwarding decisions (global network-wide). This segmentation allows the control plane to scale by distributing tenant-specific management while maintaining centralized coordination for network-wide policies.
Data Source
AI summary
Systems and methods for ensuring multi-tenant isolation in a data center are provided. A switch, or virtualized switch, can be used to de-multiplex incoming traffic between a number of data centers tenants and to direct traffic to the appropriate virtual slice for an identified tenant. The switch can store tenant identifying information received from a master controller and packet forwarding rules received from at least one tenant controller. The packet handling rules are associated with a specific tenant and can be used to forward traffic to its destination.