DYNAMICALLY DEFINED VIRTUAL PRIVATE NETWORK TUNNELS IN HYBRID CLOUD ENVIRONMENTS

• US 20170171158A1
• Filed: 12/15/2015
• Published: 06/15/2017
• Est. Priority Date: 12/15/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hoy, Jeffrey Robert, Iyer, Sreekanth Ramakrishna, Kapadia, Kaushal Kiran, Muthukrishnan, Ravi Krishnan, Nagaratnam, Nataraj
• Granted Patent: US 10,142,293 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A method, apparatus and computer program product manage a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment is described. A method in a first VPN agent manages a first VPN tunnel in a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment. The VPN agent receives a request from a VPN manager. The request includes a first set of requirements for the first VPN tunnel in the plurality of VPN tunnels. The VPN agent creates the first VPN tunnel according to the first set of requirements. A modification request is received from the VPN manager containing a second set of requirements. The VPN agent tunes the first VPN tunnel according to a second set of requirements. The tuning of the first VPN tunnel can include merging the first VPN tunnel with a second VPN tunnel, or splitting the first VPN tunnel into a first and second VPN tunnels.

Claims

1. A method comprising:

in a first VPN agent, managing a first VPN tunnel in a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment;

receiving a request from a VPN manager, the request including a first set of requirements for the first VPN tunnel in the plurality of VPN tunnels;

creating the first VPN tunnel according to the first set of requirements;

receiving a modification request from the VPN manager containing a second set of requirements; and

tuning the first VPN tunnel according to a second set of requirements.

2. The method as recited in claim 1, further comprising:

monitoring for events occurring in the first VPN tunnel;

detecting a first event occurring in the first VPN tunnel; and

sending the first event to the VPN manager.

3. The method as recited in claim 1, wherein the first set of requirements include a set of security requirements.

4. The method as recited in claim 2 wherein the first event is selected from the group consisting of receiving a modification request from an application using the first VPN tunnel which includes a second set of requirements for the first VPN tunnel, detecting a change in traffic bandwidth in the first VPN tunnel, a network topology change for the first cloud and a modification request from an application for a change in security requirements for the first VPN tunnel.

5. The method as recited in claim 1, further comprising:

receiving a request from the VPN manager, the request including a second set of requirements for the first VPN tunnel;

modifying the first VPN tunnel according to the second set of requirements, wherein the first set of requirements is for traffic from the first cloud application and the second set of requirements is for traffic from a second cloud application;

wherein tuning the first VPN tunnel in response to the event comprises splitting the first VPN tunnel into the first VPN tunnel to accommodate traffic from the first cloud application and a second VPN tunnel to accommodate traffic from the second cloud application, and

wherein the first cloud is a private cloud and the second cloud is a public cloud within the hybrid cloud environment.

6. The method as recited in claim 1, further comprising:

merging a second VPN tunnel created according to the second set of requirements with the first VPN tunnel; and

modifying first VPN tunnel according to the first and second set of requirements.

7. The method as recited in claim 1, further comprising:

receiving a selected VPN agent from the VPN manager;

installing the selected VPN agent in a first system; and

wherein the VPN agent is selected based on the first set of requirements.

8. Apparatus, comprising:

a processor;

computer memory holding computer program instructions executed by the processor to manage a first VPN tunnel of a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment, the computer program instructions comprising;

program code, operative to receive a first request from a VPN manager, the request including a first set of requirements for the first VPN tunnel in the plurality of VPN tunnels;

program code, operative create the first VPN tunnel according to the first set of requirements;

program code, operative to receive a second request from the VPN manager, the second request including a second set of requirements for a second VPN tunnel in the plurality of VPN tunnels;

program code, operative to create the second VPN tunnel according to the second set of requirements;

program code, operative to receive a merge request to merge the second VPN tunnel into the first VPN tunnel;

program code, operative to merge the first VPN tunnel and the second VPN tunnel; and

program code operative to tune the first VPN tunnel according to a second set of requirements.

9. The apparatus as recited in claim 8, further comprising:

program code, operative to monitor events in the first VPN tunnel;

program code, operative to receive requests from applications using the first VPN tunnel; and

program code, operative to communicate requests and information concerning the management of the first VPN tunnel to the VPN manager.

10. The apparatus as recited in claim 8, wherein the first set of requirements include a first set of security requirements and the second set of requirements include a second set of security requirements and the apparatus further comprises program code operative to determine whether the first and the second sets of security requirements are compatible prior to merging the first VPN tunnel and the second VPN tunnel.

11. The apparatus as recited in claim 9, wherein the event is a detected change in traffic bandwidth in the first VPN tunnel detected by the VPN agent.

12. The apparatus as recited in claim 9, further comprising:

a set of specialized VPN agents; and

program code operative to select a selected VPN agent among the specialized VPN agents according to the first set of requirements.

13. The apparatus as recited in claim 9, wherein the event is detecting an application lifecycle change of the first cloud application.

14. The apparatus as recited in claim 11, wherein the program code operative to monitor events in the first VPN tunnel further comprises:

program code, operative to determine whether a lower threshold of traffic bandwidth has been crossed in the first VPN tunnel;

program code, operative to determine whether an upper threshold of traffic bandwidth has been crossed in the first VPN tunnel; and

program code, responsive to a determination that a threshold has been crossed to send a message to the VPN manager.

15. The apparatus as recited in claim 9, further comprising:

program code, operative to receive a split request from the VPN manager to split the first VPN tunnel into a third VPN tunnel and the first VPN tunnel; and

program code, operative to split the first tunnel into the first VPN tunnel and the third VPN tunnel.

16. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the processor to manage a first VPN tunnel of a plurality of VPN tunnels between a first cloud and a second cloud in a hybrid cloud environment, the computer program instructions comprising:

program code, operative to receive a first request from a VPN manager, the first request including a first set of requirements for a first VPN tunnel in the plurality of VPN tunnels;

program code, operative to create the first VPN tunnel according to the first set of requirements;

program code, operative to receive a second request from the VPN manager, the second request including a second set of requirements for a VPN tunnel in the plurality of VPN tunnels;

program code, operative to modify the first VPN tunnel according to the second set of requirements, wherein the first set of requirements is for traffic from a first cloud application and the second set of requirements is for traffic from a second cloud application and the first VPN tunnel carries traffic from first and second cloud applications;

program code, operative to receive a split request for the first VPN tunnel; and

program code, operative to split the first VPN tunnel into the first VPN tunnel and a second VPN tunnel, wherein the VPN agent tunes the first VPN tunnel according to the first set of requirements for traffic for the first cloud application and tunes the second VPN tunnel according to a second set of requirements for traffic for the second cloud application.

17. The computer program product as recited in claim 16, further comprising:

program code, operative to monitor events in the first VPN tunnel;

program code, operative to receive requests from applications using the first VPN tunnel; and

program code, operative to communicate requests and information concerning the management of the first VPN tunnel to the VPN manager.

18. The computer program product as recited in claim 16, wherein a change in security requirements for the first cloud application causes the split request for the first VPN tunnel.

19. The computer program product as recited in claim 16, further comprising program code operative to determine that traffic from the first cloud application is not compatible with traffic from the second cloud application.

20. The computer program product as recited in claim 16, further comprising program code operative to remove the first VPN tunnel at an end of a first cloud application lifecycle.