Defining And Managing Virtual Networks In Multi-Tenant Virtualized Data Centers

• US 20130091501A1
• Filed: 08/14/2012
• Published: 04/11/2013
• Est. Priority Date: 10/05/2011
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Barabash, Katherine, Cohen, Rami, Jain, Vinit, Recio, Renato J., Rochwerger, Benny
• Application Number:
  US13/585,086
• Publication Number:
  US 20130091501A1
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An approach is provided in which a computer system selects a virtual domain from multiple virtual domains, which are each overlayed onto a physical network and are independent of physical topology constraints of the physical network. The computer system selects, from the selected virtual domain, a first virtual group that includes one or more first virtual network endpoints. Next, the computer system selects, from the selected virtual domain, a second virtual group that includes one or more second virtual network endpoints. In turn, the computer system creates a logical link policy that includes one or more actions corresponding to sending data between the first virtual group and the second virtual group.

Claims

1. A method for managing a plurality of virtual domains residing on a physical network, the method comprising:

selecting one of the plurality of virtual domains, wherein each of the plurality of virtual domains is independent of physical topology constraints of the physical network;

selecting a first virtual group corresponding to the selected virtual domain, the first virtual group including one or more first virtual endpoints;

selecting a second virtual group corresponding to the selected virtual domain, the second virtual group including one or more second virtual endpoints; and

creating a logical link policy that includes one or more actions corresponding to sending data between the first virtual group and the second virtual group.

2. The method of claim 1 further comprising:

receiving a policy resolution request from a virtualized domain module, the policy resolution request identifying one of the first virtual endpoints and identifying one of the second virtual endpoints;

mapping the identified first virtual endpoint to the first virtual group;

mapping the identified second virtual endpoint to the second virtual group;

locating the logical link policy in response to the mapping to the first virtual group and the second virtual group;

translating the one or more actions into one or more physical path translations;

creating a policy resolution response that includes the one or more physical path translations; and

sending the policy resolution response to the virtualized domain module.

3. The method of claim 2 wherein the mapping of the identified second virtual endpoint to the second virtual group further comprises mapping a destination virtual IP address included in the policy resolution request to the identified second virtual endpoint.

4. The method of claim 1 further comprising:

prior to selecting one of the plurality of virtual domains;

creating the selected virtual domain; and

assigning the selected virtual domain to a system administrator.

5. The method of claim 4 further comprising:

receiving one or more management overlay commands originating from the assigned system administrator, the one or more management overlay commands corresponding to an entity that is selected from the group consisting of the virtual domain, the first virtual group, one of the first virtual endpoints, and the logical link policy.

6. The method of claim 4 further comprising:

creating the first virtual group;

assigning the first virtual group to the system administrator; and

receiving one or more management overlay commands originating from the assigned system administrator, the one or more management overlay commands corresponding to the one or more first virtual endpoints.

7. The method of claim 6 wherein the management overlay commands are selected from the group consisting of adding an endpoint, deleting an endpoint, updating an endpoint, and migrating an endpoint.

8. The method of claim 1 further comprising:

including a policy tracking number in the logical link policy during the creation of the logical link policy;

updating the logical link policy; and

incrementing the policy tracking number in response to updating the logical link policy.

9. The method of claim 1 wherein the one or more first virtual endpoints are virtual machines executing on one or more host systems included in the physical network.

10. The method of claim 1 wherein one of the second virtual endpoints is an external virtual domain endpoint that provides a data path to a second virtual domain included in the plurality of virtual domains.

11. The method of claim 1 wherein one of the second virtual endpoints is an external physical network endpoint that provides a data path to a different physical network.

12. The method of claim 1 wherein each of the plurality of virtual domains is independently managed by one of a plurality of heterogeneous tenants, and wherein each of the plurality of virtual domains corresponds to an independent address space and one or more independent security rules.

13. The method of claim 1 further comprising:

creating an internal logical link policy that includes one or more different actions corresponding to sending data between the one or more first virtual endpoints, wherein the internal logical link policy includes a source virtual group identifier and a destination virtual group identifier that both correspond to the first virtual group.

14. The method of claim 1 further comprising:

receiving a data packet initiated by one of the first virtual endpoints with a destination at one of the second virtual endpoints;

encapsulating the data packet with one or more physical path translations corresponding to the one or more actions; and

sending the encapsulated data packet over the selected virtual domain.