Back to results
US 12,695,724 B2Granted
System and method for flow classification in multitenant VPN networks
AssigneeAlkira, Inc.
InventorShreyas Heranjal
Life of this patent
Estimating the term…
Abstract
A cloud exchange platform includes policy-based routing. Labeling (or tagging) on a multi-tenant virtual private network (VPN) facilitates recognition of active routes for a flow. The tags can be implemented such that flows are treated as having active routes across a multi-tenant VPN to enable a customer to treat flows as having an identifiable active route through the multi-tenant VPN. Thus, for example, BGP can be used as a generalized signaling protocol to carry information about flows through a multi-tenant VPN.
Claims11
A system comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the system to perform:
- computing a symmetric hash value based on packet header fields including source IP address, destination IP address, source port, destination port, and protocol field, wherein the symmetric hash is computed by sorting at least the IP addresses and port numbers of the packet header fields prior to hashing, such that both forward and reverse packets associated with a flow are mapped to a common service point attachment node (S-node);
- selecting the S-node based on the symmetric hash;
- configuring a branch node (B-node) router as a first exterior Border Gateway Protocol (eBGP) peer for a virtual private network (VPN) tunnel through a multitenant VPN network;
- configuring a service node (S-node) router as a second eBGP peer for the VPN tunnel through the multitenant VPN network, wherein the S-node router is configured to preserve information carried in tags applied at the B-node router such that the tag information is not forgotten across the VPN tunnel, thereby enabling enforcement of policy associated with the flow across the multitenant VPN network;
- tagging a first packet of the flow, bound for the selected S-node through the VPN tunnel of the multitenant VPN network via the B-node router, with a first tag;
- associating the first tag with the flow through the multitenant VPN network, wherein the association enables maintaining flow identity during scaling of S-nodes by employing a consistent hashing function;
- determining whether a second packet, received from a service provider via the S-node and bound for the B-node through the VPN tunnel, has the first tag;
- when the second packet has the first tag, identifying the second packet as belonging to the flow, and responsive to identifying the second packet as belonging to the flow based on the first tag, running eBGP pairing within the VPN tunnel between the first eBGP peer and the second eBGP peer;
- and
- when the second packet does not have the first tag, identifying the second packet as belonging to a different flow.
10 more elements
A system comprising:
- a multitenant virtual private network (VPN) gateway protocol labeling engine coupled to a multitenant VPN, wherein the multitenant VPN gateway protocol labeling engine is coupled to a branch node (B-node) router and a service node (S-node) router;
- a flow characteristics datastore coupled to the multitenant VPN gateway protocol labeling engine;
- a multitenant VPN gateway protocol routing engine coupled to the multitenant VPN;
- a routing datastore coupled to the multitenant VPN gateway protocol routing engine;
- a consistent hashing engine configured to compute a symmetric hash value based on packet header fields including source IP address, destination IP address, source port, destination port, and protocol field;
- a first exterior Border Gateway Protocol (eBGP) peer, coupled to the multitenant VPN gateway protocol labeling engine, that is configured to run through a VPN tunnel of the multitenant VPN;
- and
- a second eBGP peer, coupled to the multitenant VPN gateway protocol routing engine, that is configured to run through the VPN tunnel of the multitenant VPN;
- wherein, in operation:
- the consistent hashing engine computes the symmetric hash by sorting at least the IP addresses and port numbers of the packet header fields prior to hashing, such that both forward and reverse packets associated with a flow are mapped to a common service point attachment node (S-node);
- the consistent hashing engine selects the S-node using the symmetric hash;
- the multitenant VPN gateway protocol labeling engine tags a first packet of the flow, bound for the selected S-node through the VPN tunnel of the multitenant VPN via the B-node router, with a first tag that is identifiable using the flow characteristics datastore, wherein the S-node router is configured to preserve information carried in tags applied at the B-node router such that the tag information is not forgotten across the VPN tunnel, thereby enabling enforcement of policy associated with the flow across the multitenant VPN network;
- the multitenant VPN gateway protocol routing engine identifies the first packet as part of the flow by reading the first tag and enforces gateway protocol rules applicable to the flow when using the routing datastore to route the first packet, wherein association enables maintaining flow identity during scaling of S-nodes by employing a consistent hashing function;
- the multitenant VPN gateway protocol routing engine determines whether a second packet, received from a service provider via the S-node and bound for the B-node through the VPN tunnel, has the first tag;
- when the second packet has the first tag, the multitenant VPN gateway protocol routing engine identifies the second packet as belonging to the flow and enforces the gateway protocol rules applicable to the first flow when using the routing datastore to route the second packet, and responsive to the identification of the second packet as belonging to the flow based on the first tag, running eBGP pairing within the VPN tunnel between the first eBGP peer and the second eBGP peer;
- and
- when the second packet does not have the first tag, the multitenant VPN gateway protocol routing engine identifies the second packet as belonging to a different flow.
14 more elements
A method comprising:
- computing a symmetric hash value based on packet header fields including source IP address, destination IP address, source port, destination port, and protocol field, wherein the symmetric hash is computed by sorting at least the IP addresses and port numbers of the packet header fields prior to hashing, such that both forward and reverse packets associated with a flow are mapped to a common service point attachment node (S-node);
- selecting the S-node based on the symmetric hash;
- configuring a branch node (B-node) router as a first exterior Border Gateway Protocol (eBGP) peer for a virtual private network (VPN) tunnel through a multitenant VPN network;
- configuring a service node (S-node) router as a second eBGP peer for the VPN tunnel through the multitenant VPN network, wherein the S-node router is configured to preserve information carried in tags applied at the B-node router such that the tag information is not forgotten across the VPN tunnel, thereby enabling enforcement of policy associated with the flow across the multitenant VPN network;
- tagging a first packet of the flow, bound for the selected S-node through the VPN tunnel of the multitenant VPN network via the B-node router, with a first tag;
- associating the first tag with the flow through the multitenant VPN network, wherein the association enables maintaining flow identity during scaling of S-nodes by employing a consistent hashing function;
- determining whether a second packet, received from a service provider via the S-node and bound for the B-node through the VPN tunnel, has the first tag;
- when the second packet has the first tag, identifying the second packet as belonging to the flow, and responsive to identifying the second packet as belonging to the flow based on the first tag, running eBGP pairing within the VPN tunnel between the first eBGP peer and the second eBGP peer;
- and
- when the second packet does not have the first tag, identifying the second packet as belonging to a different flow.
7 more elements
Dependencies are inferred from the claim text.