Virtual Network Path Isolation for Cross-Domain VM Mobility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual infrastructure platforms face challenges in migrating virtual machines across different virtualization management domains without exposing the physical IP addresses of source and destination host systems, which is necessary for network connectivity but often restricted due to security and compliance concerns.
Innovation Solution
Implement a virtual network path between source and destination host systems using a global mobility manager and site-specific mobility managers to assign and manage virtual IP addresses, enabling migration without revealing physical IP addresses, and automate the creation and teardown of this path to minimize overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a direct network route is required between source and destination host systems for VM mobility operations, then network connectivity is established, but physical IP addresses are exposed which creates security and compliance issues
Solution Approach 1:
The patent introduces a mobility manager as an intermediary component that mediates all network communications between source and destination host systems during VM migration. The mobility manager assigns virtual IP addresses to host systems and routes all migration traffic through itself, preventing direct exposure of physical IP addresses while maintaining reliable network connectivity for the migration process
2Object-affected harmful factors
If proxy-based approaches are used to maintain data plane isolation, then security is improved, but performance degradation and management overhead occur
Solution Approach 1:
The patent implements dynamic virtual IP address assignment and routing where the mobility manager dynamically allocates virtual IP addresses from available pools and adjusts routing rules in real-time during migration operations. This dynamic approach allows direct peer-to-peer migration traffic flow between host systems while maintaining isolation, avoiding the performance penalties of static proxy-based architectures
Solution Approach 2:
The patent changes the network addressing parameter from physical IP addresses to virtual IP addresses during migration operations. By transforming the addressing scheme and introducing virtual addressing controlled by the mobility manager, the system achieves both data plane isolation and optimal migration performance without the overhead of traditional proxy approaches
3Object-affected harmful factors
If virtual IP addresses are dynamically assigned and routed through a mobility manager, then data plane isolation is maintained, but additional routing infrastructure is required
Solution Approach 1:
The mobility manager serves multiple functions simultaneously: it acts as a virtual IP address assignment authority, a routing controller, a migration coordinator, and a network policy enforcement point. By consolidating these diverse functions into a single multi-functional component, the patent reduces overall system complexity despite introducing virtual addressing infrastructure
Data Source
AI summary
Techniques for implementing data plane isolation for VM mobility operations are provided. In one set of embodiments, these techniques include creating a virtual network path between a source host system and a destination host system participating in a VM mobility operation, which allows the host systems to exchange data for carrying out the operation without exposing their physical IP addresses to each other and without requiring the use of intermediate proxies. In certain embodiments, the virtual network path can be dynamically established upon initiation of the VM mobility operation and dynamically rolled back upon operation completion, thereby reducing the overhead of virtual path management.