SDN VLAN Tagging for Cloud Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Native VLAN support in cloud-based networks is insufficient due to the limited number of VLANs (4,096) available, which is inadequate for networks with tens or hundreds of thousands of tenants, leading to inefficiencies in traffic management and isolation.
Innovation Solution
A software-defined network (SDN) controller dynamically assigns VLANs to traffic flows within the core network, using edge devices to tag and untage frames, and performs address translation to optimize network utilization and isolate tenants, while also entering encapsulation mode to manage high endpoint state information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If native VLAN support is used in cloud-based networks, then traffic isolation between tenants is achieved, but the limited number of VLANs (4,096) becomes insufficient for networks with tens or hundreds of thousands of tenants
Solution Approach 1:
The patent segments the VLAN identification into two parts: a 12-bit VLAN ID (0-4095) for tenant identification and a 24-bit VLAN sub-ID (0-16,777,215) for virtual machine identification within the tenant's VLAN. This segmentation allows the system to support over 700 million unique virtual machine to VLAN mappings while using only 4,096 native VLANs, resolving the contradiction between limited VLAN numbers and large tenant base.
Solution Approach 2:
The patent adds an additional dimension to VLAN identification by introducing VLAN sub-IDs. Instead of relying solely on the traditional 12-bit VLAN ID, the system combines VLAN ID with VLAN sub-ID to create a hierarchical identification scheme. This dimensional expansion enables the system to scale from supporting only 4,096 VLANs to supporting over 700 million virtual machine to VLAN mappings.
2Adaptability or versatility
If dynamic VLAN assignment is implemented to support more tenants, then network scalability is improved, but network complexity and overhead increase
Solution Approach 1:
The patent implements self-service by having edge devices automatically generate and assign VLAN sub-IDs without requiring manual configuration or centralized controller intervention. Each edge device maintains a local mapping between virtual machine MAC addresses and VLAN sub-IDs, enabling autonomous VLAN assignment. This self-service mechanism reduces management complexity while maintaining scalability.
Solution Approach 2:
The patent changes the parameter space from using only 12-bit VLAN IDs to using a combination of 12-bit VLAN IDs and 24-bit VLAN sub-IDs. This parameter expansion allows the system to differentiate between multiple virtual machines within the same tenant's VLAN without requiring additional native VLANs, thereby achieving scalability without proportionally increasing network complexity.
3Reliability
If VLAN sub-IDs are added to differentiate virtual machines within the same VLAN, then virtual machine isolation is improved, but frame overhead increases
Solution Approach 1:
The patent segments the isolation mechanism into two layers: VLAN ID for tenant-level isolation and VLAN sub-ID for virtual machine-level isolation within the same VLAN. This segmentation allows the system to provide fine-grained isolation between virtual machines while reusing the same physical VLAN infrastructure, thereby achieving improved isolation without requiring separate physical networks for each virtual machine.
Solution Approach 2:
The patent implements a nested structure where the VLAN sub-ID is embedded within the existing VLAN framework. The VLAN sub-ID acts as a nested identifier within the VLAN ID, creating a hierarchical identification system. This nesting approach allows the system to provide additional isolation granularity without fundamentally changing the existing Ethernet frame structure, thereby minimizing overhead.
4Measurement precision
If edge devices tag outgoing frames with VLAN identifiers, then traffic flow identification is improved, but processing overhead at edge devices increases
Solution Approach 1:
The patent implements self-service by having edge devices automatically generate and assign VLAN sub-IDs without requiring manual configuration or centralized controller intervention. Each edge device maintains a local mapping between virtual machine MAC addresses and VLAN sub-IDs, enabling autonomous VLAN assignment. This self-service mechanism reduces management complexity while maintaining scalability.
Solution Approach 2:
The patent performs preliminary action by pre-establishing mappings between virtual machine MAC addresses and VLAN sub-IDs at the edge device before traffic needs to be forwarded. This pre-computed mapping allows the edge device to quickly attach VLAN sub-IDs to outgoing frames without requiring complex real-time decisions, thereby improving processing speed while maintaining accurate traffic flow identification.
Data Source
AI summary
Various embodiments relate to a method, device, and machine-readable storage medium including: instructions for receiving a configuration request from an edge device, wherein the configuration request identifies a traffic flow between at least two end devices other than the edge device; instructions for assigning a virtual local area network (VLAN) identifier to the traffic flow; instructions for configuring the edge device to add the assigned VLAN identifier to outgoing frames associated with the traffic flow, wherein the outgoing frames are frames that will be transmitted by the edge device to a core network. Various embodiments additionally include instructions for configuring, in response to assigning the VLAN identifier, at least one additional edge device to remove the VLAN identifier from incoming frames associated with the traffic flow, wherein the incoming frames are frames that have traversed at least one core node of the core network.