Virtual Network Key Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant computing environments, existing methods for isolating virtual machines from each other are inefficient and burdensome, particularly when virtual machines are frequently reassigned, leading to management delays and packet routing issues due to the need for constant network configuration updates.
Innovation Solution
Assigning a Virtual Network Key (VNK) to each tenant, which is used to encapsulate packets and ensure secure communication only between matching virtual machines, eliminating the need for frequent network configuration updates by using physical IP addresses for routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are organized into VLANs to prevent communication between different tenants, then tenant isolation is improved, but network configuration complexity and management burden increase significantly
Solution Approach 1:
The patent introduces a virtual network key (VNK) as an intermediary mechanism that mediates between tenants and the physical network infrastructure. Instead of configuring physical switches for each tenant, the VNK is embedded in packet headers to provide isolation at the packet level, eliminating the need for complex VLAN configurations on physical network devices.
Solution Approach 2:
The patent replaces the mechanical/VLAN-based network isolation system with a software-based packet encapsulation system. Rather than using physical switch configurations to isolate tenants, the system uses software processing to encapsulate packets with VNKs, providing isolation through software rather than hardware configuration.
2Adaptability or versatility
If VLAN configurations are updated frequently to accommodate dynamic virtual machine reassignment, then adaptability is improved, but packet routing reliability and system stability deteriorate due to race conditions and delays
Solution Approach 1:
The patent implements dynamic adaptability by allowing virtual machines to be reassigned between tenants without triggering network configuration changes. The system dynamically tracks which VNK corresponds to which virtual machine and updates packet forwarding decisions in real-time, enabling flexible reassignment while maintaining routing reliability through software-based state management rather than static VLAN configurations.
3Reliability
If traditional VLAN methods are used for network isolation, then tenant separation is achieved, but network management speed and operational efficiency are reduced due to substantial configuration delays
Solution Approach 1:
The patent applies preliminary action by pre-establishing a mapping between virtual machine identifiers and VNKs before network isolation is needed. When a virtual machine is assigned to a tenant, the corresponding VNK is already determined and can be immediately applied to packets, eliminating the need for real-time VLAN configuration changes and significantly speeding up network management operations.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A system includes a processor executing instructions from a computer-readable storage medium. The instructions include, in response to receiving a job request that identifies a first tenant, obtaining a first virtual network key (VNK) corresponding to the first tenant. The instructions include identifying a first computing system that has resources available to satisfy the job request. The instructions include transmitting a first command to the first computing system. The first command includes the first VNK, instructs the first computing system to assign a virtual machine to the job request, and associates the first VNK with the assigned virtual machine. The instructions include, in response to completion of the job request, transmitting a second command to the first computing system. The second command instructs the first computing system to associate a default VNK with the assigned virtual machine. The default VNK does not correspond to the first tenant.