Method and apparatus for tenant programmable logical network for multi-tenancy cloud datacenters

• US 20140052877A1
• Filed: 08/16/2013
• Published: 02/20/2014
• Est. Priority Date: 08/16/2012
• Status: Abandoned Application

• Current Assignee: Wenbo Mao
• Original Assignee: Wenbo Mao
• Inventors: Mao, Wenbo
• Application Number:
  US13/968,511
• Publication Number:
  US 20140052877A1
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

Conventional network technology is based on processing metadata in the head part of a network packet (e.g., addresses and context tags). In cloud computing, resources have dynamic properties of on-demand elasticity, trans-datacenter distribution, location motion, and tenant-defining arbitrary network topology. Conventional static networks can no longer satisfy these dynamic properties of IT provisioning. Provided is a network virtualization technology—“NVI”. The NVI technology achieves de-coupling between a logical network and the underlying physical network provided through cloud resources. Network control can be implemented on vNICs of VMs in the network. On NVI, a cloud tenant can construct a firewalled logic and virtual private network to protect rental IT infrastructure in global trans-datacenter distributions. The de-coupling enables the virtual network construction job to be completed as high-level language programming tasks (SDN), achieving cloud properties of automatic, fast, dynamic changing, unlimited size scalability, and tenant-defining arbitrary topology network provisioning.

Claims

1. A system for managing a logical network operating in a cloud compute environment, the system comprising:

at least one processor operatively connected to a memory;

a network virtualization infrastructure (NVI) component, executed by the at least one processor, configured to;

manage communication between a plurality of virtual machines;

assign globally unique logical identities to the plurality of virtual machines;

map, for each virtual machine, a respective globally unique logical identity to a physically associated network address; and

control communication within the logical network according to the globally unique logical identities.

2. system according to claim 1, wherein the NVI component is configured to map between the globally unique logical identities of the virtual machines having respective physically associated network addresses.

3. system according to claim 1, wherein the NVI component is configured to control communication within the logical network according to the globally unique logical identities at respective virtual network interface controllers (“

vNICs”

) of the plurality of virtual machines.

4. system according to claim 3, wherein the NVI component is configured to define logically unicast cables between pairs of vNICs of pairs of virtual machines in the plurality of virtual machines according to their globally unique logical identities.

5. system according to claim 1, wherein the system further comprises a database management system (DBMS) configured to store mappings between the globally unique logical identities of the plurality of virtual machines and physically associated addresses.

6. system according to claim 5, wherein the NVI component is configured to update a respective mapping stored by the DBMS between the globally unique logical identity and the physically associated network address in response to migration of a VM to a new location which has a new physically associated network address.

7. system according to claim 5, wherein the NVI component includes a plurality of hypervisors configured to control communication between the plurality of virtual machines according to mappings accessible through the DBMS.

8. system according to claim 1, wherein the NVI component includes a plurality of hypervisors and DBMS associated with at least one or a plurality of cloud providers.

9. system according to claim 8, wherein the plurality of hypervisors are configured to:

assign resources from respective cloud providers, wherein the plurality of hypervisors assign physically associated addresses for the resources; and

maintain mappings between the globally unique logical identities of the plurality of virtual machines and the physically associated addresses.

10. system according to claim 1, further comprising a network definition component configured to accept specification of a group of virtual machines to include in a tenant logical network.

11. system according to claim 10, wherein the network definition component is configured to accept tenant specified definition of the group of virtual machines, wherein tenant specified definition includes identifying information for the group of virtual machines to be included in the tenant logical network.

12. system according to claim 3, wherein the NVI component is configured to define an exclusive communication channel over a logical unicast cable for each pair of virtual machines of the plurality of virtual machines.

13. system according to claim 12, wherein the NVI component is configured to activate or de-activate the exclusive communication channel between the pair of virtual machines.

14. system according to claim 13, wherein the NVI component is configured to activate or de-activate the exclusive communication channel according to tenant defined communication policy.

15. system according to claim 14, wherein the tenant defined communication policy includes criteria for allowing or excluding communication over respective exclusive communication channels.

16. system according to claim 1, wherein the NVI component is configured to control external communication with the plurality of virtual machines at respective vNICs of the plurality of virtual machines.

17. system according to claim 1, wherein a system accessible communication policy can specify communication criteria for external communication.

18. system according to claim 1, wherein the NVI component is configured to manage communication between a plurality of virtual machines by managing physical communication pathways between a plurality of physically associated network addresses which are mapped to respective globally unique logical identities of the respective plurality of virtual machines,

19. system according to claim 18, wherein the mapping between the globally unique logical identities of the virtual machines and physically associated network addresses is configured to use physical network addresses of the NVI.

20. system according to claim 1, wherein the NVI component includes a plurality of hypervisors and respective proxy entities, wherein the plurality of hypervisors and the respective proxy entities are configured to manage the communication between the plurality of virtual machines.

21. system according to claim 20, wherein the respective proxy entities are configured to maintain mappings between the globally unique logical identities of the plurality of virtual machines and the physically associated addresses.

22. A computer implemented method for managing a logical network operating in a cloud compute environment, the method comprising:

managing, by a computer system, communication between a plurality of virtual machines;

assigning, by the computer system, globally unique logical identities to the plurality of virtual machines;

mapping, by the computer system, for each virtual machine, a respective globally unique logical identity to a physically associated network address; and

controlling, by the computer system, communication within the logical network according to the globally unique logical identities.

23. method according to claim 22, wherein controlling communication within the logical network according to the globally unique logical identities includes controlling communication at respective virtual network interface controllers (“

vNICs”

) of the plurality of virtual machines.

24. method according to claim 23, further comprising defining logically unicast cables between pairs of vNICs of pairs of virtual machines in the plurality of virtual machines according to their globally unique logical identities.

25. method according to claim 22, further comprising storing mappings between the globally unique logical identities of the plurality of virtual machines and physically associated addresses.

26. method according to claim 25, further comprising updating a respective mapping stored by the DBMS between the globally unique logical identity and the physically associated network address in response to migration of a VM to a new location which has a new physically associated network address.

27. method according to claim 25, wherein controlling, by the computer system, communication within the logical network according to the globally unique logical identities includes controlling, by a plurality of hypervisors, communication for the plurality of virtual machines according to the mappings.

28. method according to claim 22, wherein the computer system includes a plurality of hypervisors associated with at least one or a plurality of cloud providers.

29. method according to claim 28, wherein the method further comprises:

assigning, by the plurality of hypervisors, resources from respective cloud providers, including physically associated addresses for the resources; and

maintaining, by the plurality of hypervisors, mappings between the globally unique logical identities of the plurality of virtual machines and the physically associated addresses.

30. method according to claim 22, further comprising accepting specification of a group of virtual machines to include in a tenant logical network.

31-44. -44. (canceled)