Virtual Network Paths for Data Plane-Isolated VM Mobility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In existing virtual infrastructure platforms, virtual machine (VM) mobility across different virtualization management domains requires direct network visibility between source and destination host systems, which is not feasible if they reside in separate management domains due to security and compliance restrictions, leading to performance issues and management overhead when using intermediate proxies.
Innovation Solution
Implement a virtual network path between source and destination host systems using a global mobility manager and site-specific mobility managers to allocate virtual IP addresses and configure network address translation, enabling direct communication without exposing physical IP addresses, thus allowing VM migration across different VI management domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct network route is required between source and destination host systems for VM mobility operations, then network communication reliability is improved, but data plane isolation and security are worsened
Solution Approach 1:
The patent introduces a mobility manager as an intermediary component that mediates all network communications between source and destination host systems during VM mobility operations. The mobility manager allocates virtual IP addresses to host systems and routes all traffic through itself, preventing direct IP address exposure while maintaining reliable communication. This resolves the contradiction by providing both communication reliability and data plane isolation simultaneously.
2Adaptability or versatility
If intermediate proxies are used to enable VM mobility across different management domains, then adaptability is improved, but performance and management overhead are worsened
Solution Approach 1:
The patent implements a universal mobility manager that handles multiple functions: it acts as an intermediary for communication, allocates virtual IP addresses, routes traffic, and manages mobility operations across different management domains. By consolidating these functions into a single multi-functional component, the system achieves cross-domain adaptability without the performance penalty of multiple separate proxy components.
Solution Approach 2:
The patent creates a virtual copy of the network communication path through virtual IP addresses and routing tables in the mobility manager, rather than using physical intermediate proxy hardware. This virtualization approach maintains migration performance by eliminating the performance overhead associated with physical proxy intermediaries while still enabling cross-domain mobility.
3Ease of operation
If physical IP addresses are exposed between host systems for direct communication, then communication simplicity is improved, but security and compliance are worsened
Solution Approach 1:
The patent changes the network address parameter from physical IP addresses to virtual IP addresses allocated by the mobility manager. Host systems communicate using these virtual addresses, which simplifies communication setup while maintaining security because the virtual addresses do not reveal the actual physical IP addresses. The mobility manager maintains mapping between virtual and physical addresses, enabling secure communication without direct physical IP exposure.
Data Source
AI summary
Techniques for implementing data plane isolation for VM mobility operations are provided. In one set of embodiments, these techniques include creating a virtual network path between a source host system and a destination host system participating in a VM mobility operation, which allows the host systems to exchange data for carrying out the operation without exposing their physical IP addresses to each other and without requiring the use of intermediate proxies. In certain embodiments, the virtual network path can be dynamically established upon initiation of the VM mobility operation and dynamically rolled back upon operation completion, thereby reducing the overhead of virtual path management.