VPC-WAN Border Gateway Cross-Region Traffic Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud-based network providers face difficulties in providing cross-region isolated segmentation of traffic due to physical and logical separation of networks into regions or divisions, making it challenging to maintain isolation across regions using conventional routers and configurations.
Innovation Solution
The implementation of a virtual private cloud-based global wide area network (VPC-WAN) within a cloud provider's shared network infrastructure, utilizing network policy data to define regions, segments, and attachment policies, along with packet header metadata for policy-based routing, ensures isolated segments across regions remain separate, and dynamic best path selection based on metrics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If conventional routers and configurations are used to provide cross-region network connectivity, then network infrastructure complexity is reduced, but traffic isolation between regions cannot be maintained
Solution Approach 1:
The patent introduces border gateways as intermediary devices between regions. These border gateways maintain routing tables that map destination IP addresses to source region identifiers, enabling them to mediate cross-region traffic while preserving isolation. When a packet arrives from one region destined for another, the border gateway uses the routing table to determine the source region and applies appropriate policies to maintain isolation, thus solving the contradiction between using conventional infrastructure and maintaining traffic isolation.
2Reliability
If network segments are isolated across regions, then traffic security and client privacy are improved, but routing complexity and configuration difficulty increase
Solution Approach 1:
The patent merges routing table functionality with region identification capabilities into a single data structure at the border gateway. Instead of maintaining separate routing tables and region mapping configurations, the system combines destination IP address routing information with source region identifier mappings in one integrated routing table. This consolidation reduces configuration complexity while maintaining the required traffic isolation across regions.
3Adaptability or versatility
If geographically-dispersed networks serve multiple clients with expansive segments, then network coverage and client service capability are improved, but maintaining isolation across regions becomes more difficult
Solution Approach 1:
The patent segments the network into distinct regional domains with border gateways at the boundaries. Each region is treated as an independent segment with its own border gateway that maintains a routing table specific to that region. This segmentation allows the network to expand geographically to serve multiple clients while keeping isolation management localized to each region's border gateway, making it easier to maintain isolation as the network grows.
Data Source
AI summary
Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. Gateway may manage traffic across regions using routing metadata that includes a segment identifier. The gateways may also signal their routes across regions based on segment data, and implement the signaled routes using segment-based routing policies. Route selection may be performed using optimization data.