Packet processing in a multi-tenant software defined network (SDN)
View Patent ↗An SDN controller associated with a switch maintains unique tenant/port association data, and pushes to the switch per-tenant policies. A per-tenant information processing port (IPP) on the switch enables traffic sent to or from a tenant to be distinguished from that of another tenant, even with respect to packet processing devices (PPDs) that share a particular switch. With the described approach, the properties of a non-overlay SDN are leveraged to support multi-tenancy in an efficient manner, preferably by associating a specific tenant with a specific port (on the virtual switch) once, rather than continuously parsing tenant data from the information flow. The technique enables the application of tenant-specific policy to tenant-specific network flows in a multi-tenant network.
1. A method to process packets in a multi-tenant Software Defined Network (SDN) having a switch, comprising:
for each tenant in a set of multiple tenants that use the SDN, assigning a particular port of the switch as an information processing port (IPP) for the tenant, the IPP for the tenant being unique to the tenant;
maintaining a data set that associates a particular port with a particular tenant;
configuring the switch according to information in the data set and at least one tenant-specific policy; and
applying the at least one tenant-specific policy to a tenant-specific packet flow based on the IPP for the tenant.
2. The method as described in claim 1 wherein configuring the switch includes coupling a packet processing device (PPD) to the information processing port for the tenant, the packet processing device being identified in the tenant-specific policy.
3. The method as described in claim 1 further including:
identifying a change in a particular tenant-specific security policy;
using information in the data set to determine whether the change is permitted;
responsive to determining that the change is not permitted, providing an alert;
responsive to determining that the change is permitted, updating the particular tenant-specific security policy and instantiating the updated tenant-specific security policy in the switch.
4. The method as described in claim 1 wherein a tenant-specific policy is distinct or used by more than one tenant.
5. The method as described in claim 1 wherein the switch is one of:
a physical switch, and a virtual switch.
6. The method as described in claim 1 wherein the at least one tenant-specific policy is applied to a tenant-specific packet flow without overlay network encapsulation.
7. The method as described in claim 1 wherein applying the at least one tenant-specific policy forwards the tenant-specific packet flow to one or more packet processing devices coupled to at least the IPP for the tenant.
8. Apparatus associated with a switch, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to process packets in a multi-tenant Software Defined Network (SDN) by:
for each tenant in a set of multiple tenants that use the SDN, assigning a particular port of the switch as an information processing port (IPP) for the tenant the IPP for the tenant being unique to the tenant;
maintaining a data set that associates a particular port with a particular tenant;
configuring the switch according to information in the data set and at least one tenant-specific policy; and
applying the at least one tenant-specific policy to a tenant-specific packet flow based on the IPP for the tenant.
9. The apparatus as described in claim 8 wherein configuring the switch includes coupling a packet processing device (PPD) to the information processing port for the tenant, the packet processing device being identified in the tenant-specific policy.
10. The apparatus as described in claim 8 wherein the computer program instructions are further operative to:
identify a change in a particular tenant-specific security policy;
use information in the data set to determine whether the change is permitted;
responsive to determining that the change is not permitted, provide an alert;
responsive to determining that the change is permitted, update the particular tenant-specific security policy and instantiate the updated tenant-specific security policy in the switch.
11. The apparatus as described in claim 8 wherein a tenant-specific policy is distinct or used by more than one tenant.
12. The apparatus as described in claim 8 wherein the switch is one of: a physical switch, and a virtual switch.
13. The apparatus as described in claim 8 wherein the at least one tenant-specific policy is applied to a tenant-specific packet flow without overlay network encapsulation.
14. The apparatus as described in claim 8 wherein applying the at least one tenant-specific policy forwards the tenant-specific packet flow to one or more packet processing devices coupled to at least the IPP for the tenant.
15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method to process packets in a multi-tenant Software Defined Network (SDN) having a switch, the method comprising:
for each tenant in a set of multiple tenants that use the SDN, assigning a particular port of the switch as an information processing port (IPP) for the tenant, the IPP for the tenant being unique to the tenant;
maintaining a data set that associates a particular port with a particular tenant;
configuring the switch according to information in the data set and at least one tenant-specific policy; and
applying the at least one tenant-specific policy to a tenant-specific packet flow based on the IPP for the tenant.
16. The computer program product as described in claim 15 wherein configuring the switch includes coupling a packet processing device (PPD) to the information processing port for the tenant, the packet processing device being identified in the tenant-specific policy.
17. The computer program product as described in claim 15 further including:
identifying a change in a particular tenant-specific security policy;
using information in the data set to determine whether the change is permitted;
responsive to determining that the change is not permitted, providing an alert;
responsive to determining that the change is permitted, updating the particular tenant-specific security policy and instantiating the updated tenant-specific security policy in the switch.
18. The computer program product as described in claim 15 wherein a tenant-specific policy is distinct or used by more than one tenant.
19. The computer program product as described in claim 15 wherein the switch is one of: a physical switch, and a virtual switch.
20. The computer program product as described in claim 15 wherein the at least one tenant-specific policy is applied to a tenant-specific packet flow without overlay network encapsulation.
21. The computer program product as described in claim 15 wherein applying the at least one tenant-specific policy forwards the tenant-specific packet flow to one or more packet processing devices coupled to at least the IPP for the tenant.