INTERCONNECTING EXTERNAL NETWORKS WITH OVERLAY NETWORKS IN A SHARED COMPUTING ENVIRONMENT

• US 20170078248A1
• Filed: 09/10/2015
• Published: 03/16/2017
• Est. Priority Date: 09/10/2015
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Bian, Guo Chun, Lin, Jin Jing, Rong, Liang, Tang, Gang, Xian, Ming Shuang
• Granted Patent: US 9,860,214 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A method includes obtaining, by one or more processor, data from a virtual network of a tenant and an identifier of the tenant, where the virtual network of the tenant is one of at least two virtual networks in a shared computing environment where the at least two virtual networks overlay a physical network. Based on obtaining the identifier of the tenant, the method includes setting, by one or more processor, the identifier in metadata of the data and based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant. The method also includes identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data and transmitting, by the one or more processor, the processed data through the network connection.

Claims

1. A method comprising:

obtaining, by one or more processor, data from a virtual network of a tenant and an identifier of the tenant, wherein the virtual network of the tenant is one of at least two virtual networks in a shared computing environment wherein the at least two virtual networks overlay a physical network;

based on obtaining the identifier of the tenant, setting, by the one or more processor, the identifier in metadata of the data;

based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant;

identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data; and

transmitting, by the one or more processor, the processed data through the network connection.

2. The method of claim 1, wherein the data comprises a frame,

wherein the obtaining data from the virtual network of the tenant further comprises removing the outer header of the frame leaving a packet as the data, and

wherein the setting the identifier in metadata of the data comprises setting the identifier in the metadata of the packet.

3. The method of claim 1, wherein the identifier of the tenant is an identifier for a port from which the one or more processor obtained the data, the port comprising a logical connection point between the physical network and the virtual network.

4. The method of claim 1, wherein the network connection is a virtual private network tunnel coupled to a remote network of the tenant.

5. The method of claim 1, wherein the identifying the network connection associated with the tenant further comprises utilizing at least one field in the data with the tenant identifier to identify the network connection.

6. The method of claim 1, further comprising:

obtaining, by the one or more processor, additional data from the network connection, wherein the network connection is coupled to a resource on a remote network of the tenant;

setting, by the one or more processor, a network connection identifier in metadata of the additional data;

obtaining, by the one or more processor, the additional data and the network connection identifier and based on the network connection identifier, identifying the tenant, wherein the tenant is a tenant of the shared computing environment; and

based on identifying the tenant, inserting, by the one or more processor, the additional data into an access the virtual network of the tenant.

7. The method of claim 6, wherein the obtaining, additional data from the network connection comprises decrypting the additional data by enforcing a security policy of the network connection.

8. The method of claim 6, wherein the network connection is a virtual private network tunnel.

9. The method of claim 6, wherein the additional data comprises a packet and the identifying the tenant comprises:

reconstructing, by the one or more processor, the header of the packet to convert the packet to a frame, wherein the reconstructing comprises utilizing the network connection identifier in the metadata to set a next hop media access control address as a destination media access control address and a pseudo media access control as a source media access control address.

10. The method of claim 9, wherein the inserting the additional data into the access comprises:

based on setting the destination media access control address and the source media access control address, inserting the frame into the access through a logical connection point between the physical network and the virtual network.

11. A computer program product comprising:

a computer readable storage medium readable by one or more processor and storing instructions for execution by the one or more processor for performing a method comprising;

obtaining, by the one or more processor, data from a virtual network of a tenant and an identifier of the tenant, wherein the virtual network of the tenant is one of at least two virtual networks in a shared computing environment wherein the at least two virtual networks overlay a physical network;

based on obtaining the identifier of the tenant, setting, by the one or more processor, the identifier in metadata of the data;

based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant;

identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data; and

transmitting, by the one or more processor, the processed data through the network connection.

12. The computer program product of claim 11, wherein the data comprises a frame,

wherein the obtaining data from the virtual network of the tenant further comprises removing the outer header of the frame leaving a packet as the data, and

wherein the setting the identifier in metadata of the data comprises setting the identifier in the metadata of the packet.

13. The computer program product of claim 11, wherein the identifier of the tenant is an identifier for a port from which the one or more processor obtained the data, the port comprising a logical connection point between the physical network and the virtual network.

14. The computer program product of claim 11, wherein the network connection is a VPN tunnel coupled to a remote network of the tenant.

15. The computer program product of claim 11, wherein the identifying the network connection associated with the tenant further comprises utilizing at least one field in the data with the tenant identifier to identify the network connection.

16. The computer program product of claim 11, the method further comprising:

obtaining, by the one or more processor, additional data from the network connection, wherein the network connection is coupled to a resource on a remote network of the tenant;

setting, by the one or more processor, a network connection identifier in metadata of the additional data;

obtaining, by the one or more processor, the additional data and the network connection identifier and based on the network connection identifier, identifying the tenant, wherein the tenant is a tenant of the shared computing environment; and

based on identifying the tenant, inserting, by the one or more processor, the additional data into an access the virtual network of the tenant.

17. The computer program product of claim 16, wherein the obtaining, additional data from the network connection comprises decrypting the additional data by enforcing a security policy of the network connection.

18. The computer program product of claim 16, wherein the additional data comprises a packet and the identifying the tenant comprises:

reconstructing, by the one or more processor, the header of the packet to convert the packet to a frame, wherein the reconstructing comprises utilizing the network connection identifier in the metadata to set a next hop media access control address as a destination media access control address and a pseudo media access control as a source media access control address.

19. A system comprising:

a memory;

one or more processor in communication with the memory; and

program instructions executable by the one or more processor via the memory to perform a method, the method comprising;

obtaining, by the one or more processor, data from a virtual network of a tenant and an identifier of the tenant, wherein the virtual network of the tenant is one of at least two virtual networks in a shared computing environment wherein the at least two virtual networks overlay a physical network;

based on obtaining the identifier of the tenant, setting, by the one or more processor, the identifier in metadata of the data;

based on the identifier in the metadata, identifying, by the one or more processor, a network connection associated with the tenant;

identifying, by the one or more processor, a policy of the network connection and processing the data with the policy to create processed data; and

transmitting, by the one or more processor, the processed data through the network connection.

20. The system of claim 19, the method further comprising:

obtaining, by the one or more processor, additional data from the network connection, wherein the network connection is coupled to a resource on a remote network of the tenant;

setting, by the one or more processor, a network connection identifier in metadata of the additional data;

obtaining, by the one or more processor, the additional data and the network connection identifier and based on the network connection identifier, identifying the tenant, wherein the tenant is a tenant of the shared computing environment; and

based on identifying the tenant, inserting, by the one or more processor, the additional data into an access the virtual network of the tenant.