SOFTWARE DEFINED NETWORK CONTROLLER FOR IMPLEMENTING TENANT SPECIFIC POLICY

• US 20170279689A1
• Filed: 02/27/2015
• Published: 09/28/2017
• Est. Priority Date: 02/27/2015
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Mohan, Rupin T., Zuckerman, Boris, Voigt, Douglas L., Puttagunta, Krishna
• Application Number:
  US15/507,156
• Publication Number:
  US 20170279689A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 45/52 Multiprotocol routers
• CPC Class Codes: H04L 45/56 Routing software
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Abstract

Example implementations may relate to a software defined networking (SDN) controller. A method may include receiving, at a SDN controller, a tagged initialization packet from a software defined network enabled switch. The method may include identifying, at the SDN controller, a tenant corresponding to or based on the tagged initialization packet. The method may include implementing a policy specific to the identified tenant.

Claims

1. A method comprising:

receiving, at a software defined network (SDN) controller, a tagged initialization packet from an SDN enabled switch;

identifying, at the SDN controller, a tenant corresponding to the tagged initialization packet, the tenant being one of a plurality of tenants;

identifying, at the SDN controller, a policy specific to the identified tenant; and

implementing, by the SDN controller, the policy specific to the identified tenant.

2. The method of claim 1, wherein the SDN controller identifies the tenant by:

determining whether an IP address of the tagged initialization packet is included in a list of tenant IP addresses, or

determining whether an IP address subnet of the tagged initialization packet is associated with the tenant.

3. The method of claim 1, further comprising compiling, by the SDN controller, a list of tenant IP addresses by analyzing a successful directory authentication to determine a tenant requesting the directory authentication, and matching the tenant requesting the directory authentication to an IP address associated with the successful directory authentication,

wherein the identifying the tenant corresponding to the tagged initialization packet is performed by looking up an IP address of the tagged initialization packet in the list of tenant IP addresses.

4. The method of claim 1, further comprising compiling, by the SDN controller, a list of tenant IP addresses by analyzing a namespace of an unencrypted packet to identify a tenant associated with the namespace, and matching the tenant associated with the name space with an IP address of the unencrypted packet,

wherein the identifying the tenant corresponding to the tagged initialization packet is performed by looking up an IP address of the tagged initialization packet in the list of tenant IP addresses.

5. The method of claim 1, further comprising compiling, by the SDN controller, a list of tenant IP addresses by receiving a tenant and IP address pair from a network file access daemon that has information linking tenants to clients interacting with the daemon,

wherein the identifying the tenant corresponding to the tagged initialization packet is performed by looking up an IP address of the tagged initialization packet in the list of tenant IP addresses.

6. The method of claim 1, wherein

the implementing includes configuring the SDN enabled switch to enact the policy, and

the policy is at least one of a tenant isolation policy, a quality of service policy, a security policy, a data encryption policy, or a resource tracking policy.

7. The method of claim 1, wherein the tagged initialization packet is a packet received by the SDN enabled switch and tagged by the SDN enabled switch after being determined to not match an existing flow table of the SDN enabled switch and determined to be an initialization packet of a network file access protocol.

8. A system comprising:

a software defined network (SDN) enabled switch that includes a packet tagger to tag incoming packets that are initialization packets of a network file access protocol; and

an SDN controller to receive tagged initialization packets from the SDN enabled switch, the SDN controller includes;

a tenant awareness module to identify a tenant from among a plurality of tenants based on the tagged initialization packet; and

a management module to implement a policy specific to the identified tenant.

9. The system of claim 8, wherein the tenant awareness module identifies the tenant by comparison of an IP address of the tagged initialization packet with IP addresses associated with the plurality of tenants.

10. The system of claim 8, wherein the tenant awareness module identifies the tenant based on whether an IP address of the tagged initialization packet matches at least one of:

an IP address associated with the tenant in a list of tenant IP addresses;

an IP address subnet associated with the tenant in a list of tenant subnets;

an IP address associated with a successful directory authentication requested by the tenant;

an IP address associated with a namespace extracted from unencrypted network traffic, the namespace being determined to relate to the tenant;

or

an IP address of an IP address and tenant pair received by the SDN controller from a network file access daemon.

11. The system of claim 8, wherein the management module implements the policy by configuring the SDN enabled switch to provide to the identified tenant at least one of a tenant isolation, a quality of service level, a security policy, data encryption, or a resource tracking.

12. The system of claim 8, wherein subsequent incoming packets received by the SDN enabled switch from the identified tenant are processed according to the policy specific to the identified tenant.

13. The system of claim 8, wherein the network file access protocol is based on network file system (NFS) protocol, server message block (SMB) protocol, or a file transfer protocol (FTP).

14. A non-transitory machine readable medium storing instructions executable by a processor of a software defined network (SDN) controller, the non-transitory machine readable medium comprising:

instructions to receive a tagged initialization packet from an SDN enabled switch, the tagged initialization packet being a packet received by the SDN enabled switch and tagged by the SDN enabled switch after being determined to not match an existing flow table of the SDN enabled switch and determined to be an initialization packet of a network file access protocol;

instructions to analyze the tagged initialization packet to identify a tenant from among a plurality of tenants;

instructions to identify a policy specific to the identified tenant; and

instructions to implement the policy specific to the identified tenant.

15. The non-transitory machine readable medium of claim 14, wherein

the instructions to implement the policy configures the SDN enabled switch to process subsequent packets of the tenant according to at least one of a tenant isolation policy, a quality of service policy, a security policy, an data encryption policy, or a resource tracking policy, and

the instructions to analyze the tagged initialization packet compares an IP address of the tagged initialization packet to a list of IP addresses matched to tenants.