Multi-domain cloud computing

• US 10,728,106 B1
• Filed: 05/01/2017
• Issued: 07/28/2020
• Est. Priority Date: 04/29/2016
• Status: Active Grant

• Current Assignee: Architectural technology Inc.
• Original Assignee: Architecture Technology Corporation
• Inventors: Hartley, Timothy E., Ramanujan, Ranga S.
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Almamun, Abdullah
• Application Number:
  US15/583,711
• Time in Patent Office: 1,184 Days
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5066 Algorithms for mapping a plurality of inter-dependent sub-tasks onto a plurality of physical CPUs mappping at compile time, see G06F8/451
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: G06F 9/5083 Techniques for rebalancing the load in a distributed system
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

A method of managing a plurality of client nodes in a network is disclosed. A plurality of domains is provided in the network, each domain isolating data from other domains. A plurality of applications is also provided, each application of the plurality of applications allowed to operate in one or more of the plurality of domains. Each of the plurality of client nodes is allowed to operate in one or more of the plurality of domains. The method includes assigning the plurality of applications to the plurality of client nodes, such that each application of the plurality of applications is assigned to a client node that is allowed to operate in a domain that the application is allowed to operate in.

Claims

1. A method of managing a plurality of client nodes in a network, the method comprising:

providing a plurality of domains in the network, each domain isolating data from other domains;

providing a plurality of applications, each application of the plurality of applications having a profile that indicates which one or more domains of the plurality of domains the application is allowed to operate in;

wherein each of the plurality of client nodes has a profile that indicates which one or more of the plurality of domains that client node is allowed to operate in;

evaluating different assignments of the plurality of applications to select an assignment that assigns the plurality of applications to the plurality of client nodes such that each application of the plurality of applications is assigned to a client node that is allowed to operate in a domain that the application is allowed to operate in,

wherein evaluating different assignments includes;

generate a plurality of assignments, each assignment of the plurality of assignments assigning each of the plurality of applications to one or more of the plurality of client nodes, wherein the assignments are developed based on the profile of each of the plurality of applications and the profile of each of the plurality of client nodes such that each of the plurality of applications is assigned to a client node that is allowed to operate in the domain that the application is allowed to operate in; and

comparing the plurality of assignments to one another with a utility function that factors in multiple aspects in addition to the domains of the applications and the client nodes.

2. The method of claim 1, wherein each client node of the plurality of client nodes implements either a single one of the plurality of domains or implements multiple domains of the plurality of domains by maintaining a plurality of partitions on the client node and executing applications for each domain of the multiple domains in a disjoint subset of the plurality of partitions from other of the multiple domains.

3. The method of claim 2, wherein at least one client node of the plurality of client nodes implements multiple domains by executing a host operating system that maintains the plurality of partitions, and executing a respective guest operating system in each of the plurality of partitions.

4. The method of claim 3, comprising:

executing multiple applications on a first guest operating system of the respective guest operating systems, each of the multiple applications operating in a common domain corresponding to the domain of a partition in which the first guest operating system is executing.

5. The method of claim 2, comprising:

executing a secure hypervisor separation kernel at at least one of the client nodes implementing multiple domains, the separation kernel maintaining separation of each partition of the multiple partitions from other partitions of the multiple partitions.

6. The method of claim 2, comprising:

sharing a physical communication medium communicatively coupling a first client node to a networking device amongst multiple domains by controlling which of the plurality of partitions are bridged to a physical network interface of the first client node, wherein the physical communication medium is connected to the physical network interface.

7. The method of claim 6, wherein sharing includes bridging one or more partitions corresponding to each domain to the physical network interface sequentially.

8. The method of claim 2, providing a networking device communicatively coupled to a first client node via a first physical communication medium,

the first client node encrypting/decrypting packets for a first domain using first encryption/decryption keys, and encrypting/decrypting packets for a second domain using second encryption/decryption keys, wherein the first client node sends the packets for the first domain and the second domain over the first physical communication medium,

the networking device receiving the packets and forwarding the packets to a respective outgoing port as addressed by the respective packet;

for each port that is at a boundary between a single domain and a multi-domain area of the first physical communication medium, the networking device encrypting and decrypting the packets such that the packets in the single domain area are unencrypted and packets in the multi-domain area are encrypted.

9. The method of claim 1, wherein each domain of the plurality of domains is a distinct one or more local area networks from other domains of the plurality of domains.

10. The method of claim 1, comprising:

separating communications with a cloud manager from communications in the plurality of domains, wherein the cloud manager communicates with the plurality of client nodes to assign the plurality of applications thereto.

11. A network of nodes comprising:

a plurality of client nodes; and

one or more networking devices;

wherein the plurality of client nodes and networking devices implement multiple domains, each domain of the multiple domains isolating data from other domains of the multiple domains,

wherein a cloud manager evaluates different assignments of the plurality of applications to select an assignment and instruct the plurality of client nodes to run a plurality of applications, such that an allowed domain for each of the plurality of applications matches with an allowed domain of a client node on which the application is run, each application of the plurality of applications having a profile that indicates which one or more domains of the plurality of domains is an allowed domain for the application, and each client node of the plurality of client nodes having a profile that indicates which one or more of the plurality of domains is an allowed domain for that client node;

wherein evaluates different assignments includes;

generate a plurality of assignments;

each assignment of the plurality of assignments assigning each of the plurality of applications to one or more of the plurality of client nodes, wherein the assignments are developed based on the profile of each of the plurality of applications and the profile of each of the plurality of client nodes such that each of the plurality of applications is assigned to a client node that is allowed to operate in the domain that the application is allowed to operate in; and

compare the plurality of assignments to one another with a utility function that factors in multiple aspects in addition to the domains of the applications and the client nodes.

12. The network of claim 11, wherein a first subset of the plurality of client nodes operate in a single domain of the multiple domains, wherein a second subset of the plurality of client nodes operate in at least two of the multiple domains.

13. The network of claim 11, wherein at the cloud manager controls which of the multiple domains a first client node of the client nodes in the second subset operates in.

14. The network of claim 13, wherein the cloud manager controls a first networking device communicatively coupled to the first client node over at least a first network link, such that the first networking device implements a common domain with the first client node over the first network link.

15. The network of claim 11, wherein the cloud manager instructs a second client node of the plurality of client nodes to change from operating in a first domain to operating in a second domain,

wherein the cloud manager instructs a second networking device that is communicatively, coupled to the second client node over a second network link, to change from implementing the first domain over the second network link to implementing the second domain over the second network link.

16. The network of claim 15, wherein the cloud manager instructs the second networking device to change includes the cloud manager instructs the second networking device to change an assignment of a physical network interface to which the second network link is connected, from a first VLAN to a second VLAN.

17. The network of claim 15, wherein the cloud manager instructs the second client node to change includes the cloud manager instructs the second client node to encrypt communications from the second domain with a first encryption key;

wherein the cloud manager instructs the second networking device to change includes the cloud manager instructs the second networking device to use a decryption key corresponding to the first encryption key for communications from the second client node that are leaving the second networking device to a single domain area of the second domain.

18. A data storage entity comprising:

a non-transitory processor readable medium having software stored thereon, wherein the software, when executed by one or more processing devices;

evaluates different assignments of a plurality of applications to a plurality of client nodes to select an assignment that assigns each application of the plurality of applications to a client node that is allowed to operate in a domain that the application is allowed to operate in,

wherein each domain of the plurality of domains is a distinct one or more local area networks, wherein each domain isolates data from other domains;

wherein each application of the plurality of applications has a profile that indicates which one or more domains of the plurality of domains the application is allowed to operate in;

wherein each of the plurality of client nodes has a profile that indicates which one or more of the plurality of domains that client node is allowed to operate in;

wherein evaluates different assignments includes;

generate a plurality of assignments, each assignment of the plurality of assignments assigning each of the plurality of applications to one or more of the plurality of client nodes, wherein the assignments are developed based on the profile of each of the plurality of applications and the profile of each of the plurality of client nodes such that each of the plurality of applications is assigned to a client node that is allowed to operate in the domain that the application is allowed to operate in; and

compare the plurality of assignments to one another with a utility function that factors in multiple aspects in addition to the domains of the applications and the client nodes.

19. The data storage entity of claim 18, wherein each client node of the plurality of client nodes implements either a single one of the plurality of domains or implements multiple domains of the plurality of domains by maintaining a plurality of partitions on the client node and executing applications for each domain of the multiple domains in a disjoint subset of the plurality of partitions from other of the multiple domains.

20. The data storage entity of claim 18, wherein at least one client node of the plurality of client nodes implements multiple domains by executing a separation kernel operating system that maintains the plurality of partitions, and executing a respective guest operating system in each of the plurality of partitions,

wherein multiple applications on a first guest operating system of the respective guest operating systems, each of the multiple applications operating in a common domain corresponding to the domain of a partition in which the first guest operating system is executing.