CROSS-CLOUD NAMESPACE MANAGEMENT FOR MULTI-TENANT ENVIRONMENTS

• US 20160105393A1
• Filed: 03/23/2015
• Published: 04/14/2016
• Est. Priority Date: 10/13/2014
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: THAKKAR, SACHIN, BASAK, DEBASHIS, MASKALIK, SERGE, SRINIVASAN, ARAVIND, WU, WEIQING
• Granted Patent: US 10,757,170 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 41/0823 characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability for optimising operational conditions of wireless networks H04W24/02
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 61/5038 for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04M 7/0012 Details of application programming interfaces [API] for telephone networks; Arrangements which combine a telephonic communication equipment and a computer, i.e. computer telephony integration [CPI] arrangements

Abstract

Conditional address translation is performed in a multi-tenant cloud infrastructure to effectively support tenant-assigned addresses. For each tenant, the multi-tenant cloud infrastructure deploys both a private network used to communicate between the tenant and the cloud and a tenant-facing gateway to manage the private network. The multi-tenant cloud infrastructure also includes an externally-facing gateway used to communicate between the multi-tenant cloud and a public network. The tenant-facing gateways are configured to bypass address translation—providing consistent addressing across each private network irrespective of the physical location of resources linked by the private network. By contrast, the public-facing gateway is configured to translate source addresses in outgoing packets to addresses that are unique within the public network. Advantageously, discriminately mapping addresses enables multiple tenants to interact in a uniform fashion with both on-premises resources and cloud-hosted resources without incurring undesirable address collisions between tenants.

Claims

1. A method of supporting independent addressing for multiple tenants in a cloud computing system, comprising:

for each tenant, configuring a private network between the tenant and the cloud computing system, wherein the private network is managed by a tenant-facing cloud gateway;

configuring the tenant-facing cloud gateways to preserve the source addresses of packets originating from the cloud computing system; and

configuring a multi-tenant cloud gateway to a public network to translate the source addresses of packets originating from the cloud computing system to addresses that are unique within the public network.

2. The method of claim 1, wherein the source addresses are media access control (MAC) addresses.

3. The method of claim 1, wherein the private network is delineated by a virtual network identifier (VNI) or a virtual local area network (VLAN) identifier.

4. The method of claim 1, wherein configuring the private network comprises provisioning the private network for a virtualized computing system.

5. The method of claim 4, wherein a first source address specifics a virtual machine that is included in the private network and is running in a host in the cloud computing system.

6. The method of claim 4, wherein a virtual machine is running on a host in the virtualized computing system and a virtual network interface card of the virtual machine has a virtual media access control (MAC) address, and further comprising:

migrating the virtual machine from the host in the virtualized computing system to a host in the multi-tenant cloud computing system, without altering the virtual MAC address of the virtual network interface card of the virtual machine.

7. The method of claim 1, wherein the public network is the Internet, and translating comprises mapping the destination address to an Internet-facing address.

8. The method of claim 1, wherein the private network is a layer-2 (L2) network that is provisioned for a virtualized computing system, and the private network spans both the virtualized computing system and a virtual data center within the cloud computing system.

9. A non-transitory computer readable storage medium comprising instructions, which when executed in a multi-tenant cloud computing system causes the computing system to carry out the steps of:

for each tenant, configuring a private network between the tenant and the cloud computing system, wherein the private network is managed by a tenant-facing cloud gateway;

configuring the tenant-facing cloud gateways to preserve the source addresses of packets originating from the cloud computing system; and

configuring a multi-tenant cloud gateway to a public network to translate the source addresses of packets originating from the cloud computing system to addresses that are unique within the public network.

10. The non-transitory computer readable storage medium of claim 9, wherein the source addresses are media access control (MAC) addresses.

11. The non-transitory computer readable storage medium of claim 9, wherein the private network is delineated by a virtual network identifier (VNI) or a virtual local area network (VLAN) identifier.

12. The non-transitory computer readable storage medium of claim 9, wherein configuring the private network comprises provisioning the private network for a virtualized computing system.

13. The non-transitory computer readable storage medium of claim 12, wherein a first source address specifies a virtual machine that is included in the private network and is running in a host in the cloud computing system.

14. The non-transitory computer readable storage medium of claim 12, wherein a virtual machine is running on a host in the virtualized computing system and a virtual network interface card of the virtual machine has a virtual media access control (MAC) address, and further comprising:

migrating the virtual machine from the host in the virtualized computing system to a host in the multi-tenant cloud computing system, without altering the virtual MAC address of the virtual network interface card of the virtual machine.

15. The non-transitory computer readable storage medium of claim 9, wherein the private network is a layer-2 (L2) network that is provisioned for a virtualized computing system, and the private network spans both the virtualized computing system and a virtual data center within the cloud computing system.

17. The hybrid cloud computing system of claim 15, wherein the source addresses are media access control (MAC) addresses.

18. The hybrid cloud computing system of claim 15, wherein the private network is delineated by a virtual network identifier (VNI) or a virtual local area network (VLAN) identifier.

19. The hybrid cloud computing system of claim 15, wherein a first source address specifies a virtual machine that is included in a first private network and is running in a physical host computer in the cloud computing system.

20. The hybrid cloud computing system of claim 15, wherein the private network is a layer-2 (L2) network that spans both a first virtualized computing system and a virtual data center within the cloud computing system.

16. A hybrid cloud computing system comprising:

virtualized computing systems that each include a plurality of physical host computers in which one or more virtual machines are running, wherein each virtualized computing system corresponds to a different tenant;

a cloud computing system that includes a plurality of physical host computers in which one or more virtual machines are running; and

a hybridity director that allocate resources of cloud computing system between the tenants, wherein the hybridity director is configured to;

for each tenant, configure a private network between the corresponding virtualized computing system and the cloud computing system, wherein the private network is managed by a tenant-facing cloud gateway;

configure the tenant-facing cloud gateways to preserve the source addresses of packets originating from the cloud computing system; and

configure a multi-tenant cloud gateway to a public network to translate the source addresses of packets originating from the cloud computing system to addresses that are unique within the public network.