Virtual Network Devices for Multi-AS Overlay Isolation

The patent creates virtual copies of network functions through virtual network devices that can be instantiated multiple times to provide network isolation. Instead of adding physical hardware for each isolated network, virtual instances are created in software, allowing multiple autonomous systems to be isolated logically while sharing the same physical infrastructure. This resolves the contradiction by providing isolation without proportional increases in physical hardware complexity.

The patent transitions from physical hardware-based isolation to a virtual/software dimension for network isolation. By introducing virtual network devices and overlay networks, isolation is achieved in the virtualization layer rather than requiring separate physical hardware for each autonomous system. This dimensional shift allows multiple isolated networks to coexist on shared infrastructure without increasing physical device complexity.

The patent makes network devices universal by enabling them to support multiple autonomous systems simultaneously through virtualization. Virtual network devices can be configured to handle routing for different ASes, and a single physical router can host multiple virtual instances, each managing a different autonomous system. This multi-functionality allows edge routers to maintain security isolation while gaining the adaptability to support multiple ASes, resolving the contradiction between security and versatility.

The patent segments network device functions into virtual components that can be independently configured for different autonomous systems. By dividing the routing function into separate virtual network devices or virtual instances, each can maintain strict isolation for its assigned AS while the overall physical device supports multiple ASes. This functional segmentation resolves the contradiction by allowing security isolation at the virtual instance level while enabling multi-AS support at the physical device level.

The patent introduces virtual network devices as intermediary components between the overlay networks and the shared underlay network. These virtual devices provide a standardized interface that simplifies management by abstracting the complexity of multiple overlay networks. Instead of directly managing complex interactions between multiple overlays on shared infrastructure, administrators manage virtual network devices that handle the complexity internally, thus improving resource utilization while reducing management complexity.

The patent implements partial virtualization where only the necessary network functions are virtualized to support multiple overlay networks, rather than fully virtualizing the entire infrastructure. This selective approach allows shared underlay networks to be utilized efficiently while keeping management complexity manageable by virtualizing only the components that need isolation and multi-tenant support, rather than over-virtualizing the entire system.