Scalable architecture for enterprise extension in a cloud topology

• US 8,619,779 B2
• Filed: 09/30/2009
• Issued: 12/31/2013
• Est. Priority Date: 09/30/2009
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Li, Li Erran, Woo, Thomas
• Primary Examiner(s): O CONNOR, BRIAN T
• Application Number:
  US12/571,257
• Publication Number:
  US 20110075674A1
• Time in Patent Office: 1,553 Days
• Field of Search: 370/238, 370/392, 370/401, 370/409
• US Class Current: 370/392
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation

Abstract

Various embodiments relate to a Cloud Data Center, a system comprising the Cloud Data Center, and a related method. The Cloud Data Center may include a logical customer edge router to send packets between addresses in a private enterprise network and addresses in a logical network within a cloud network. The logical network may have resources, known as virtual machines, allocated to the private enterprise network and may share a common IP address space with the private enterprise network. A directory at the Cloud Data Center may correlate the enterprise IP addresses of virtual machines with a cloud IP address and a location IP address within the logical network. The Cloud Data Center may double encapsulate packets with two specified headers, a cloudIP and locIP header, when sending a packet to a destination in the logical network.

Claims

1. A method of incorporating resources of a cloud network into a private enterprise network, the method comprising:

creating, by a Cloud Data Center, a logical customer edge router in the Cloud Data Center in the cloud network;

receiving, by the Cloud Data Center, an IP subnet that is within an address space of the private enterprise network;

allocating, by the Cloud Data Center, an IP address from the IP subnet to a plurality of resources within a logical network in the cloud network comprising resources allocated to the private enterprise network;

adding, by the logical customer edge router, a routing entry for said IP subnet at a virtual routing and forwarding table at the Cloud Data Center;

forwarding, by the logical customer edge router, the routing entry to at least one customer edge router in the private enterprise network; and

adding, by the logical customer edge router, a default entry in a directory server at the Cloud Data Center, the default entry mapping a plurality of IP addresses associated with devices belonging to the private enterprise network to at least one IP address of the logical customer edge router in the Cloud Data Center.

2. The method of claim 1, further comprising:

connecting the logical customer edge router in the Cloud Data Center to a logical customer edge router of the private enterprise network.

3. The method of claim 2, wherein the logical customer edge router in the Cloud Data Center and the customer edge router of the private enterprise network are connected through at least a provider edge router in a service provider network.

4. The method of claim 3, wherein the provider edge router is a virtual router.

5. The method of claim 1, wherein the resources in the logical network are logically isolated from other resources in the cloud network and not in the logical network.

6. A method of sending a packet received from a source in a private enterprise network to a destination in a cloud network allocated to the private enterprise network, said method comprising:

receiving, by a logical customer edge router in a Cloud Data Center in the cloud network, a packet from a source in the private enterprise network, wherein the logical customer edge router is located in a logical network in the cloud network comprising resources allocated to the private enterprise network;

querying, by the logical customer edge router, a directory server for the destination'"'"'s cloud IP address and location IP address;

encapsulating, by the logical customer edge router, the received packet when the logical customer edge router determines the destination is within the logical network, wherein the received packet is encapsulated with the destination'"'"'s corresponding cloud IP header;

further encapsulating, by the logical customer edge router , the received packet with the destination'"'"'s corresponding location IP header;

forwarding, by the logical customer edge router, the received packet to the destination, wherein the Cloud Data Center forwards the received packet through the destination location IP address to the destination cloud IP address.

7. The method of claim 6, further comprising:

decapsulating, by a switch at the destination'"'"'s location IP address, the location IP header of the received packet;

forwarding, by the destination switch, the received packet to the destination'"'"'s cloud IP address;

decapsulating, by a destination server at the destination'"'"'s cloud IP address, the cloud IP header of the received packet; and

forwarding, by the destination server, the packet to the destination within the destination server.

8. The method of claim 7, further comprising:

verifying, by a hypervisor in the destination server, that the received packet is from the same enterprise, wherein the hypervisor inspects a security token in the header of the received header; and

discarding, by the hypervisor, the packet when the packet'"'"'s security token is not verified.

9. The method of claim 8, wherein the security token comprises at least an enterprise-specific key, an enterprise ID, and a destination IP address.

10. The method of claim 6, wherein the logical customer edge router receives the packet from the source in the private enterprise network using Layer 3 protocols.

11. The method of claim 6, wherein the querying step comprises querying a directory at the directory server.

12. A method of forwarding a packet originating from a source in a cloud network allocated to a private enterprise network, said method comprising:

receiving, by a hypervisor in a server hosting a source virtual machine, a packet, the virtual machine being located in a logical network in the cloud network comprising resources allocated to the private enterprise network;

querying, by the hypervisor, a directory server in the logical network for a destination address when the packet'"'"'s destination address is not in a virtual routing and forwarding table at the server,

encapsulating, by the hypervisor, the packet with a cloud IP header, the cloud IP header corresponding to the destination'"'"'s cloud IP address received from the directory server;

further encapsulating, by the hypervisor, the packet with a location IP header, the location IP header corresponding to the destination'"'"'s cloud IP address received from the directory server; and

forwarding, by the hypervisor, the packet to the location IP address.

13. The method of claim 12, further comprising:

decapsulating, by a logical customer edge router in a Cloud Data Center, the location IP header of the packet; and

decapsulating, by the logical customer edge router, the cloud IP header of the packet.

14. The method of claim 12, further comprising:

computing, by the hypervisor, a security token comprising a combination of an enterprise-specific key, enterprise ID, and destination IP address; and

encapsulating, by the hypervisor, the packet with the security token.

15. The method of claim 14 further comprising:

decapsulating, by a customer edge router at the destination in the private enterprise network, the Layer 3 header;

verifying, by the customer edge router at the destination, the security token in the header of the received packet and discarding; and

discarding, by the customer edge router at the destination, the received packet when the security token is not verified.

16. The method of claim 13, further comprising:

encapsulating, by the logical customer edge router, a Layer 3 header corresponding to the destination'"'"'s IP address in the private enterprise network; and

forwarding, by the logical customer edge router, the packet to the destination in the private enterprise network.

17. The method of claim 16, wherein the Layer 3 header is an MPLS header.

18. The method of claim 16, further comprising:

decapsulating, by a customer edge router at the destination in the private enterprise network, the Layer 3 header.

19. A system extending a private enterprise network to a logical network in a cloud network comprising resources allocated to the private enterprise network, the system comprising:

a series of servers in the logical network sharing the same IP address space as the private enterprise network, at least one server including;

a virtual machine comprising resources on said server allocated to the private enterprise network, and

a hypervisor hosting the virtual machine, and

a logical customer edge router in the logical network sharing the same IP address space as the private enterprise network connecting the logical network to the private enterprise network; and

at least a customer edge router in the private enterprise network.

20. The system of claim 19, wherein the logical network is isolated from cloud resources outside the logical network.

21. The system of claim 19, wherein the virtual machine is located with a location IP address and a cloud IP address, the virtual machine receiving information through the cloud network with data packets encapsulated first with the corresponding cloud IP header and further encrypted with the corresponding location IP header.

22. The system of claim 19, wherein the logical network also includes at least a Data Center Interconnect switch operatively coupled to at least the series of servers and the logical customer edge router.

23. The system of claim 19, wherein the logical network further includes a switch connecting a least one of the servers to the logical customer edge router.

24. The system of claim 19, further comprising:

a service provider network comprising at least a provider edge router, the service provider network connecting the customer edge router in the private enterprise network and the logical customer edge router in the logical network in the cloud network.