Secure Cluster Pairing via Controller VM Subnets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for business continuity and disaster recovery in network computation environments face challenges in creating a secure, efficient, and non-disruptive communication channel between geographically distinct clusters, particularly in scenarios where a many-to-many connectivity topology is required, and existing technologies often impact primary I/O traffic and management/control traffic.
Innovation Solution
The establishment of a dedicated communication channel for replication between clusters using controller virtual machines, which assign replication IP addresses, modify route tables and firewall rules, and configure subnets to enable secure, bidirectional replication without affecting primary I/O traffic or management/control traffic, utilizing mechanisms like VPNs for security and allowing for QoS and bandwidth modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated communication channel is created for replication between clusters, then replication security and efficiency are improved, but device complexity and configuration overhead increase
Solution Approach 1:
The network communication is segmented into different channels: a dedicated replication channel for backup traffic and a separate management channel for control traffic. This segmentation allows the replication channel to be optimized for security and reliability without interfering with management operations, while the management channel handles configuration and authentication independently.
Solution Approach 2:
A controller virtual machine acts as an intermediary to manage the pairing and communication between clusters. The controller handles authentication, certificate management, and channel establishment automatically, reducing the operational complexity of configuring direct cluster-to-cluster connections while maintaining high security standards.
2Productivity
If all nodes communicate with all nodes in a many-to-many topology, then replication completeness is improved, but network resource consumption increases
Solution Approach 1:
The many-to-many node connectivity is segmented into a systematic structure where each node establishes a dedicated replication channel through the controller to the corresponding node in the peer cluster. This transforms the O(n²) complex many-to-many connections into O(n) structured connections, reducing network resource consumption while maintaining complete replication coverage.
Solution Approach 2:
The dedicated replication channel serves multiple functions simultaneously: it carries replication traffic, provides authentication, handles encryption keys, and enables monitoring. This multi-functionality reduces the need for separate communication paths and minimizes overall network resource consumption while ensuring complete node-to-node replication.
3Reliability
If a secure communication channel is established for disaster recovery, then data protection is improved, but authentication and certificate management overhead increase
Solution Approach 1:
Certificates and authentication credentials are pre-issued and stored in a secure vault before the replication channel is established. When a replication channel needs to be created, the controller automatically retrieves and presents the pre-prepared certificates, eliminating the need for real-time certificate generation and reducing authentication time while maintaining strong security.
Solution Approach 2:
The controller virtual machine automatically handles all authentication and certificate management tasks without requiring manual intervention. It performs self-service operations including certificate validation, key exchange, and channel authentication, which reduces the operational overhead and time required to establish secure communication channels between clusters.
4Reliability
If replication traffic is separated from primary I/O traffic, then replication reliability is improved, but device complexity increases
Solution Approach 1:
The network infrastructure is segmented into separate virtual networks: a replication network for backup traffic and a primary network for I/O operations. This segmentation is implemented at the virtualization layer through virtual switches and routing tables, allowing traffic separation without requiring complex physical network reconfiguration. The logical separation maintains replication reliability while the virtualization abstraction keeps the overall system manageable.
Data Source
AI summary
Techniques are disclosed for providing backup protection. A first subnet is established for replication in a first cluster that includes a plurality of host devices. Each of the host devices includes a respective controller virtual machine, which together form a virtual local area network for replication. Each of the controller virtual machines is assigned an Ethernet interface. A replication Internet Protocol address is assigned to each of the Ethernet interfaces of the controller virtual machines. Route tables and firewall rules of the controller virtual machines are modified to allow communications between nodes of the first subnet. The first subnet is configured with information related to a second subnet for replication in a second cluster. A dedicated communication channel is generated for replication between the first cluster and the second cluster based on the configuring.