ENABLING NETWORK SERVICES IN MULTI-TENANT IAAS ENVIRONMENT

• US 20170012872A1
• Filed: 07/09/2015
• Published: 01/12/2017
• Est. Priority Date: 07/09/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Suen, Wei-Shiau, Chao, Chih-Wen, Lee, Cheng-Ta, Wu, Ming-Hsun
• Granted Patent: US 10,212,078 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: H04L 45/586 of virtual routers

Abstract

Methods, systems, and computer program products for enabling network services in a multi-tenant IaaS environment are provided. A service portal is deployed in the IaaS environment. In one embodiment, tenant packet associated with a first tenant of the IaaS environment is received by the service portal. The tenant packet is analyzed to identify one or more services to which to transmit the tenant packet. The tenant packet is distributed to the identified services for processing. A processed tenant packet is received from one or more of the identified services. The processed tenant packet is transmitted to a destination.

Claims

1. A method, the method comprising:

deploying a service portal in an IaaS environment;

receiving, by the service portal, a tenant packet associated with a first tenant of the IaaS environment;

analyzing, by the service portal, the tenant packet to identify one or more services to which to transmit the tenant packet;

distributing, by the service portal, the tenant packet to the identified services for processing;

receiving, by the service portal, a processed tenant packet from one or more of the identified services; and

transmitting, by the service portal, the processed tenant packet to a destination.

2. The method of claim 1, wherein the destination is a second tenant in the IaaS environment.

3. The method of claim 1, wherein the destination is the first tenant.

4. The method of claim 1, wherein analyzing the tenant packet to identify one or more services to which to transmit the tenant packet comprises:

consulting a policy table, wherein the policy table comprises one or more policies corresponding to the one or more services; and

determining the identified services based on the one or more policies.

5. The method of claim 1, further comprising:

prior to distributing the tenant packet to the identified services, stripping a tenant header from the tenant packet; and

prior to transmitting the processed tenant packet to the destination, adding the tenant header to the processed tenant packet.

6. The method of claim 1, wherein distributing the tenant packet to the identified services for processing comprises:

sending the tenant packet to a first service of the identified services;

receiving the processed packet from the first service; and

sending the processed packet to a second service of the identified services.

7. The method of claim 1, wherein distributing the tenant packet to the identified services for processing comprises:

sending the tenant packet to a first service of the identified services and a second service of the identified services;

receiving a first processed tenant packet from the first service; and

receiving a second processed tenant packet from the second service.

8. The method of claim 1, wherein the identifies services include one or more of:

a firewall, a captive portal, a traffic analyzer, an encryption system, or a security system.

9. A computer program product, the computer program product comprising:

a computer readable storage medium and program instructions stored on the computer readable storage medium, the program instructions comprising;

program instructions to deploy a service portal in an IaaS environment;

program instructions to receive a tenant packet associated with a first tenant of the IaaS environment;

program instructions to analyze the tenant packet to identify one or more services to which to transmit the tenant packet;

program instructions to distribute the tenant packet to the identified services for processing;

program instructions to receive a processed tenant packet from one or more of the identified services; and

program instructions to transmit the processed tenant packet to a destination.

10. The computer program product of claim 9, wherein the destination is a second tenant in the IaaS environment.

11. The computer program product of claim 9, wherein the destination is the first tenant.

12. The computer program product of claim 9, wherein the program instructions to analyze the tenant packet to identify one or more services to which to transmit the tenant packet comprise:

program instructions to consult a policy table, wherein the policy table comprises one or more policies corresponding to the one or more services; and

program instructions to determine the identified services based on the one or more policies.

13. The computer program product of claim 9, wherein the program instructions stored on the computer readable storage medium further comprise:

program instructions to, prior to distributing the tenant packet to the identified services, strip a tenant header from the tenant packet; and

program instructions to, prior to transmitting the processed tenant packet to the destination, add the tenant header to the processed tenant packet.

14. The computer program product of claim 9, wherein the program instructions to distribute the tenant packet to the identified services for processing comprise:

program instructions to send the tenant packet to a first service of the identified services;

program instructions to receive the processed packet from the first service; and

program instructions to send the processed packet to a second service of the identified services.

15. The computer program product of claim 9, wherein the program instructions to distribute the tenant packet to the identified services for processing comprise:

program instructions to send the tenant packet to a first service of the identified services and a second service of the identified services;

program instructions to receive a first processed tenant packet from the first service; and

program instructions to receive a second processed tenant packet from the second service.

16. The computer program product of claim 9, wherein the identified services include one or more of:

a firewall, a captive portal, a traffic analyzer, an encryption system, or a security system.

17. A computer system, the computer system comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to deploy a service portal in an IaaS environment;

program instructions to receive a tenant packet associated with a first tenant of the IaaS environment;

program instructions to analyze the tenant packet to identify one or more services to which to transmit the tenant packet;

program instructions to distribute the tenant packet to the identified services for processing;

program instructions to receive a processed tenant packet from one or more of the identified services; and

program instructions to transmit the processed tenant packet to a destination.

18. The computer system of claim 17, wherein the destination is a second tenant in the IaaS environment.

19. The computer system of claim 17, wherein the destination is the first tenant.

20. The computer system of claim 17, wherein the program instructions to analyze the tenant packet to identify one or more services to which to transmit the tenant packet comprise:

program instructions to consult a policy table, wherein the policy table comprises one or more policies corresponding to the one or more services; and

program instructions to determine the identified services based on the one or more policies.

21. The computer system of claim 17, wherein the program instructions stored on the computer readable storage medium further comprise:

program instructions to, prior to distributing the tenant packet to the identified services, strip a tenant header from the tenant packet; and

program instructions to, prior to transmitting the processed tenant packet to the destination, add the tenant header to the processed tenant packet.

22. The computer system of claim 17, wherein the program instructions to distribute the tenant packet to the identified services for processing comprise:

program instructions to send the tenant packet to a first service of the identified services;

program instructions to receive the processed packet from the first service; and

program instructions to send the processed packet to a second service of the identified services.

23. The computer system of claim 17, wherein the program instructions to distribute the tenant packet to the identified services for processing comprise:

program instructions to send the tenant packet to a first service of the identified services and a second service of the identified services;

program instructions to receive a first processed tenant packet from the first service; and

program instructions to receive a second processed tenant packet from the second service.

24. The computer system of claim 17, wherein identified services include one or more of:

a firewall, a captive portal, a traffic analyzer, an encryption system, or a security system.