Virtual Domain VPN Routing for Secure Multi-Tenant Traffic Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data center networks face challenges in securely sharing network functions among multiple customers while maintaining traffic isolation and security, particularly in scenarios involving encrypted traffic.
Innovation Solution
Implementing virtual domains within a shared device that utilize route-based VPNs to terminate secure VPN tunnels within customer-specific domains, ensuring encrypted traffic remains encrypted until it reaches the intended destination, thereby isolating customer traffic and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single device is shared among multiple customers to provide network functions, then device utilization and cost efficiency are improved, but traffic isolation and security between customers deteriorate
Solution Approach 1:
The device is segmented into multiple virtual domains, each dedicated to a specific customer. The routing table is divided into customer-specific routing tables, and the single device instance is partitioned into multiple virtual device instances. This segmentation enables traffic isolation while maintaining shared physical infrastructure, resolving the contradiction between device utilization and traffic isolation.
2Ease of operation
If encrypted traffic is decrypted at a common VPN gateway before forwarding, then traffic can be routed to destination networks, but security is reduced because unencrypted traffic traverses common links
Solution Approach 1:
A route-based VPN is introduced as an intermediary mechanism that operates on encrypted traffic without requiring decryption. The VPN routing rules direct encrypted packets to the appropriate virtual domain based on destination IP addresses, enabling traffic routing while maintaining encryption throughout the forwarding path, thus resolving the contradiction between routing capability and security.
3Device complexity
If multiple customers share common network infrastructure, then cost and complexity are reduced, but the risk of cross-customer traffic interference and security breaches increases
Solution Approach 1:
The routing infrastructure is segmented into customer-specific routing tables within each virtual domain. This segmentation ensures that routing operations for one customer do not interfere with another customer's traffic, eliminating cross-customer traffic interference while maintaining shared physical infrastructure and reducing overall complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one example, a method comprises receiving, by a computing device, configuration data defining: an external virtual domain for a network function, the external virtual domain connected to a public network and managed by a provider for the computing device; a virtual domain for the network function, the virtual domain separate from the external virtual domain, configured with a secure tunnel interface, connected to a customer network, and managed by a customer of the provider for the computing device; forwarding, by the external virtual domain implementing a route-based virtual private network, encrypted network traffic, received from the public network via a secure tunnel, to the secure tunnel interface configured in the virtual domain; decrypting, by the virtual domain, the encrypted network traffic to generate network traffic; and forwarding, by the virtual domain, the network traffic to the customer network.