Virtual Switch Proxy for Underlay Multicast Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current datacenter overlay networking technologies isolate virtual machines from physical network resources, making it difficult for them to access underlay resources, such as multicast streams, which are inaccessible via the overlay network.

Innovation Solution

Implementing a virtual switch in the hypervisor that acts as a proxy to request and forward underlay resources, using IGMP messages to access multicast traffic directly from the underlay network, while monitoring and authorizing virtual machine requests to ensure secure access to authorized resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If overlay networking is used to isolate virtual machines from physical network infrastructure, then virtual machine security and network management are improved, but access to underlay resources such as multicast streams is lost

Engineering Contradiction:

Improvevirtual machine securityVSAvoidaccess to underlay resources

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The virtual switch acts as an intermediary between virtual machines and underlay resources. It receives IGMP membership reports from virtual machines, translates them into appropriate underlay network requests, and forwards them to underlay resources like multicast sources. This mediator role allows virtual machines to access underlay resources while maintaining overlay network isolation and security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If virtual machines are completely isolated from the underlay network, then overlay network security is maintained, but functionality to access physical network resources is reduced

Engineering Contradiction:

Improveoverlay network securityVSAvoidaccess to physical network resources

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The virtual switch serves as a controlled intermediary that selectively permits access to underlay resources. It monitors IGMP messages from virtual machines, validates membership requests against authorization policies, and only forwards approved requests to underlay resources. This maintains security while enabling necessary functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback mechanisms where the virtual switch monitors underlay resource availability and virtual machine membership changes. When virtual machines join or leave multicast groups, the virtual switch receives IGMP reports and adjusts underlay resource allocation accordingly. This feedback loop ensures secure access while maintaining resource efficiency.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS9900263B2Non-overlay resource access in datacenters using overlay networks

Publication Date: 2018.02.20 NOKIA OF AMERICA CORP

AI summary

Various embodiments relate to a method, device, and machine-readable storage medium including: exchanging messages between a virtual machine and the overlay network; identifying a request message transmitted by a virtual machine supported by the server as requesting an underlay resource that is inaccessible via the overlay network; sending a proxy request to the underlay resource via the underlay network; receiving, at the server, at least one message from the underlay resource in response to the proxy request; and forwarding the at least one message to the virtual machine based on determining that the virtual machine previously requested the underlay resource.