Multi-Tenant VPN Address Translation for Subnet Fragmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network fragmentation occurs when subnets are assigned in sequence and then changed, making it difficult to find contiguous subnets as networks age, leading to inefficiencies in network management.
Innovation Solution
Implement a multi-tenant virtual private network address translation (MT-NAT) system that translates non-contiguous subnets into contiguous MT-NAT subnets, allowing for dynamic allocation and management of network addresses, supported by a cloud-based engine that facilitates seamless scaling and resource provisioning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If subnets are assigned in sequence and changed over time, then network flexibility and adaptability improve, but network fragmentation increases and management difficulty worsens
Solution Approach 1:
The patent introduces a NAT gateway as an intermediary component that sits between the fragmented private subnets and the public network. This NAT gateway consolidates multiple non-contiguous subnets into a single contiguous public subnet, thereby simplifying routing and management while preserving the flexibility of having multiple private subnets for different tenants or purposes.
Solution Approach 2:
The patent merges multiple non-contiguous private subnets into a single contiguous public subnet through the NAT gateway. This combining approach reduces the number of routing tables and simplifies network management, while the internal mapping maintains the logical separation and flexibility of the original multiple subnets.
2Reliability
If multiple non-contiguous subnets are used for different tenants, then multi-tenant isolation and security improve, but routing complexity and address management worsen
Solution Approach 1:
The NAT gateway serves as an intermediary that handles all routing and address translation between the isolated tenant subnets and the external network. Each tenant's non-contiguous subnets are mapped to the NAT gateway, which then manages the contiguous public subnet allocation, thereby maintaining tenant isolation while simplifying external routing.
Solution Approach 2:
The patent segments the network into isolated tenant virtual private clouds, each with its own non-contiguous subnets, while the NAT gateway operates as a separate management layer. This segmentation maintains security boundaries between tenants while the NAT gateway handles the complexity of address translation and routing consolidation.
3Productivity
If subnets are dynamically allocated and reassigned, then resource utilization and scalability improve, but finding contiguous subnets and managing fragmentation worsens
Solution Approach 1:
The NAT gateway acts as an intermediary that abstracts the complexity of subnet management from the dynamic allocation process. Internal subnets can be dynamically assigned and reassigned to different tenants or purposes, while the NAT gateway maintains a stable contiguous public subnet mapping, thereby enabling flexibility without fragmentation issues.
Solution Approach 2:
The patent creates a virtual copy of the subnet structure through the NAT gateway, where the internal non-contiguous subnet structure is replicated and mapped to a contiguous external subnet. This copying approach allows dynamic internal allocation while maintaining a stable, non-fragmented external interface.
Data Source
AI summary
What is disclosed is providing a multi-tenant virtual private network (VPN) to a plurality of tenants, wherein tenant VPNs are associated with respective private networks; identifying a first subnet that makes up a portion of a first private network associated with a first tenant of the plurality of tenants; translating the first subnet into a first multi-tenant VPN address translation (MT-NAT) subnet that is used as part of a first tenant VPN to extend the first private network across a public network; identifying a second subnet that makes up a portion of the first private network, that is not contiguous with the first subnet, and that has not been translated into the first MT-NAT; and translating the second subnet and a proper subnet of the first subnet into a second MT-NAT subnet without impacting subnet fragmentation of the first private network. Also disclosed are systems and methods for this.