Virtual Router Segmentation for Secure Tenant Workload Forwarding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale computer networks, particularly in cloud data centers, existing virtual network technologies face challenges in efficiently managing and routing traffic across virtual networks, including multicasting, security, and load balancing, while maintaining high-speed connectivity and scalability.
Innovation Solution
A virtual network controller configures and manages an overlay network within a physical network, utilizing virtual routers that execute multiple routing instances, aggregate packets, and implement tunneling protocols like MPLS and VxLAN to extend virtual networks, enabling efficient traffic forwarding, re-routing, and security services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual routers execute multiple routing instances to manage virtual networks, then network management capability and security are improved, but device complexity and packet processing overhead increase
Solution Approach 1:
The patent segments the virtual router functionality into multiple independent routing instances (VRFs - Virtual Routing Instances). Each VRF handles a specific virtual network with its own routing table, forwarding rules, and security policies. This segmentation allows the system to manage multiple virtual networks simultaneously while maintaining isolation and security, as each instance operates independently with dedicated resources.
Solution Approach 2:
The patent introduces a new dimension of virtualization by adding the VRF layer above the physical network infrastructure. Instead of managing virtual networks directly on the physical network plane, it creates a virtual routing dimension that abstracts and isolates traffic flows. This dimensional addition allows multiple virtual networks to coexist on the same physical infrastructure without interfering with each other.
2Productivity
If virtual routers aggregate and process packets through multiple routing instances, then traffic management capability is improved, but packet processing overhead increases
Solution Approach 1:
The patent implements preliminary action by pre-configuring routing tables, forwarding rules, and security policies for each VRF instance before traffic arrives. The control plane establishes all necessary routing information and forwarding states in advance, so that when data plane packets arrive, they can be processed using pre-computed forwarding decisions rather than requiring complex real-time analysis.
Solution Approach 2:
The patent extracts the control plane functions (routing computation, policy management, security rule configuration) from the data plane packet processing. The control plane handles complex decision-making and rule establishment separately, while the data plane focuses on high-speed packet forwarding using pre-established forwarding tables. This separation allows the system to maintain high productivity in traffic management while reducing packet processing overhead.
3Adaptability or versatility
If tunneling protocols like VxLAN and MPLS are implemented to extend virtual networks, then network scalability and connectivity are improved, but device complexity and bandwidth overhead increase
Solution Approach 1:
The patent uses tunneling protocols (VxLAN, MPLS) as intermediary mechanisms to extend virtual networks across the physical infrastructure. These protocols act as mediators that encapsulate virtual network packets within physical network packets, allowing virtual networks to span multiple physical locations while maintaining virtual network boundaries. The tunneling protocol handles the complexity of network extension, shielding the virtual network endpoints from implementation details.
Solution Approach 2:
The patent implements universal virtual router instances that can operate with multiple tunneling protocols simultaneously. Each VRF instance is designed to be protocol-agnostic, supporting VxLAN, MPLS, or other tunneling mechanisms as needed. This multi-functionality allows the same virtual router infrastructure to serve diverse network requirements and extend virtual networks across different physical topologies without requiring protocol-specific hardware or software for each deployment scenario.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
In general, techniques are described for enhancing operations of virtual networks. In some examples, a network system includes a plurality of servers interconnected by a switch fabric comprising a plurality of switches interconnected to form a physical network. Each of the servers comprises an operating environment executing one or more virtual machines in communication via one or more virtual networks. The servers comprise a set of virtual routers configured to extend the virtual networks to the operating environments of the virtual machines. A virtual router of the set of virtual routers is configured to prepare tunnel packets by forwarding packets received from virtual machines to an IPSec kernel executing in a host operating network stack, receiving the ESP packets back from the IPSec kernel and forwarding the ESP packets across the virtual networks.