Global Tenant Identifier Mapping for Cloud Federation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network tenant identifier systems face challenges in providing global uniqueness and avoiding collisions across multiple administrative domains, especially as cloud services become federated, due to limitations in identifier space and autonomous identifier assignment by organizations.
Innovation Solution
The solution extends the tenant identifier space in the control plane to a larger bit space while keeping data plane labels unchanged, using demand-based forwarding to separate control and data plane identifiers, and introduces a mapping of global identifiers to local tenant identifiers stored in a database, ensuring global uniqueness and avoiding collisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If autonomous identifier assignment by organizations is used, then ease of operation is improved, but global uniqueness of identifiers deteriorates
Solution Approach 1:
The patent segments the identifier system into two parts: a globally unique domain identifier (assigned autonomously to organizations) and a local tenant identifier (assigned within each domain). This segmentation allows autonomous assignment at the domain level while ensuring global uniqueness through the combination of domain ID + local ID, resolving the contradiction between operational ease and identifier uniqueness.
Solution Approach 2:
The patent introduces a mapping database as an intermediary that stores the correspondence between global tenant identifiers and local tenant identifiers across different domains. This intermediary mechanism enables global uniqueness to be maintained while allowing autonomous local assignment, as the mapping database resolves any potential collisions and ensures consistent global identification.
2Reliability
If identifier space is extended in control plane, then global uniqueness is improved, but device complexity increases
Solution Approach 1:
The patent extracts the global uniqueness requirement from the data plane identifiers and places it in the control plane. The control plane uses extended identifier spaces and mapping databases to ensure global uniqueness, while the data plane maintains simpler, unchanged labels. This extraction reduces data plane complexity while achieving global uniqueness in the control plane.
Solution Approach 2:
The patent adds a new dimension to the identifier system by introducing domain identifiers as a separate layer. Instead of extending the length of existing identifiers, it creates a hierarchical structure where global uniqueness is achieved through the combination of domain dimension and local identifier dimension, thereby avoiding the complexity of managing extremely large identifier spaces in a single dimension.
3Ease of operation
If data plane labels are kept unchanged, then ease of operation is improved, but adaptability to federated cloud environments deteriorates
Solution Approach 1:
The patent applies local quality by allowing each domain to maintain its own local tenant identifier scheme unchanged in the data plane, while the control plane implements a universal mapping mechanism. This enables each domain to operate independently with its preferred labeling scheme while still being adaptable to federated environments through the global mapping database that translates between different local schemes.
Data Source
AI summary
In one embodiment, a method includes receiving a packet at a tunnel end point in a multi-tenant network, the packet comprising a destination, performing a lookup for the destination in a database comprising a mapping of global identifiers to local tenant identifiers for different hosting locations, each of the global identifiers uniquely identifying a tenant across all of the hosting locations, identifying a destination tunnel end point and a local tenant identifier for the destination, and inserting the destination tunnel end point and the local tenant identifier into the packet and forwarding the packet. An apparatus and logic are also disclosed herein.