Storage Node VLAN Sharing Across Isolated Network Namespaces
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in efficiently sharing Virtual Local Area Networks (VLANs) and subnetworks between different network namespaces, particularly when integrating native and containerized applications, which often require separate network stacks and can lead to security issues and inefficiencies.
Innovation Solution
A virtual ethernet tunnel is created between network namespaces within a storage node, utilizing a traffic mirroring and redirection engine to route network packets, including packet filters that redirect and mirror packets between namespaces, ensuring shared access to VLANs and subnetworks without introducing additional MAC addresses, compatible with both virtualized and bare-metal deployments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate network stacks are used for native and containerized applications, then security isolation is improved, but network resource sharing efficiency deteriorates
Solution Approach 1:
The patent merges multiple network namespaces (default and additional) into a shared network infrastructure by creating virtual ethernet tunnels between them. This allows containerized applications in additional network namespaces to access the same VLANs and subnets as native applications in the default network namespace, improving network resource sharing efficiency while maintaining security isolation through namespace boundaries.
Solution Approach 2:
The patent introduces virtual ethernet devices and traffic mirroring/redirection engines as intermediaries between network namespaces. These intermediaries enable controlled communication and resource sharing between namespaces without compromising security isolation. The traffic mirroring engine acts as a mediator that allows broadcast packets and ARP replies to be shared across namespaces while maintaining proper routing and filtering.
2Reliability
If VLAN tagging is used to isolate broadcast domains, then network security is improved, but network configuration complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the traffic mirroring and redirection engine automatically handles VLAN packet routing and broadcasting between network namespaces. The system configures itself to mirror broadcast packets and redirect unicast packets based on VLAN tags, eliminating the need for manual configuration of complex VLAN routing rules in each namespace while maintaining security isolation.
3Adaptability or versatility
If multiple MAC addresses are assigned to share network resources, then network accessibility is improved, but hardware resource consumption increases
Solution Approach 1:
The patent creates virtual copies of network interface functionality through virtual ethernet devices in the traffic namespace. Instead of requiring additional physical NICs or MAC addresses for each namespace, the system creates virtual representations that share the underlying physical network interface. The virtual ethernet tunnel endpoints act as copies that provide namespace-specific network access while sharing the same physical hardware resources.
Data Source
AI summary
Within a storage node having a default network namespace and at least one additional network namespace, a virtual ethernet tunnel is created connecting the default network namespace and the additional network namespace. The virtual ethernet tunnel includes a local virtual ethernet device in the default network namespace and a remote virtual ethernet device in the additional network namespace. A Media Access Control (MAC) address of the remote virtual ethernet device of the virtual ethernet tunnel is changed to a MAC address of a network interface controller of the storage node. A traffic mirroring and redirection engine within the default network namespace is configured to route network packets within the storage node such that a virtual local area network and a subnetwork are shared by the default network namespace and the additional network namespace.