Virtualized connectivity in a cloud services environment

Abstract

A system and method of providing virtualized connectivity in a cloud services environment. A service provider network defines at least a first virtual private network and a second virtual private network for a respective first customer network and a second customer network. The service provider network includes at least one physical connection with a cloud services provider network where the at least one physical connection includes a first private virtual connection between the first virtual private network and the cloud services provider and a second private virtual connection between the second virtual private network and the cloud services provider.

1 . A computer-implemented method for providing virtualized cloud services across a service provider network, the computer-implemented method comprising:
 providing virtual private network (VPN) access across the service provider network for each of a plurality of customers of the service provider network; and   providing private access across the service provider network between at least one of the plurality of customers and at least one of a plurality of cloud service providers associated with the service provider network, the private access being over a shared physical connection between the service provider network and the at least one of the plurality of cloud providers.   
     
     
         2 . The computer-implemented method as recited in  claim 1 , further comprising implementing Virtual Forwarding and Routing (VRF) to enable a secure multi-tenancy environment in the service provider network among the plurality of customers and the plurality of cloud service providers. 
     
     
         3 . The computer-implemented method of  claim 2  further comprising:
 exporting a plurality of route targets from a cloud provider network configured to provide one or more services of the cloud provider to a first VRF of at least one first router of the service provider network; 
 exporting a plurality of route targets from a customer network of at least one of the plurality of customers to a second VRF of at least one second router of the service provider network; 
 importing the plurality of route targets from the first VRF at the second VRF; and 
 importing the plurality of route targets from the second VRF at the first VRF. 
 
     
     
         4 . The computer implemented method of  claim 3  wherein the at least one second router comprises a plurality of provider edge routers for a corresponding plurality of customer offices of the customer network, each of the plurality of routers including a VRF with the cloud provider network route targets such that the offices have secure private access to at least one service of the cloud provider. 
     
     
         5 . The computer-implemented method as recited in  claim 1 , further comprising implementing Network Address Translation (NAT) to enable scaling of private access between the plurality of customers and the plurality of cloud service providers across the service provider network. 
     
     
         6 . The computer-implemented method as recited in  claim 5 , further comprising causing an edge router in the service provider network to implement NAT between at least one of the plurality of customers and at least one of the plurality of cloud service providers. 
     
     
         7 . The computer-implemented method as recited in  claim 6  further comprising:
 establishing a border gateway protocol (BGP) session between the edge router in the service provider network and a second router of the service provider network, the second router having a physical connection with the cloud provider network; and 
 providing private shared access between each customer network and the cloud provider network using the BGP session and physical connection with the cloud provider network. 
 
     
     
         8 . The computer implemented method of  claim 7  further comprising: 
       establishing a plurality of virtual domains unique to each customer accessing the cloud provider network, the virtual domains at the edge router implementing the NAT of the hub of the cloud provider network. 
     
     
         9 . The computer-implemented method as recited in  claim 1 , further comprising:
 tagging a first unique identification to data packets being routed from a cloud provider network to a particular customer through a particular VPN of the service provider network;   tagging a second unique identification to data packets being routed from the particular customer through the particular VPN of the service provider network to the cloud provider network;   whereby the data packets being routed from the cloud provider network to the particular customer network, and the data packets being routed form the particular customer network and the cloud provider network are private between the particular customer network and the particular cloud provider network.   
     
     
         10 . The computer implemented method as recited in  claim 1  further comprising implementing class of service routing among packets distributed across the VPN between a particular cloud provider and a particular customer. 
     
     
         11 . A system of providing virtualized connectivity in a cloud services environment comprising a service provider network defining at least a first virtual private network and a second virtual private network for a respective first customer network and a second customer network, the service provider network including at least one physical connection with a cloud services provider network, the at least one physical connection including a first private virtual connection between the first virtual private network and the cloud services provider and a second private virtual connection between the second virtual private network and the cloud services provider. 
     
     
         12 . The system of  claim 11  further comprising:
 at least one first provider edge router having the at least one physical connection with the cloud services provider network; 
 at least one second provider edge router in communication with the first customer network and at least one third provider edge router in communication wit the second customer network; and 
 wherein the at least one first provider edge router includes at least one virtual routing forwarding table including routes of the first customer network and routes of the second customer network, the at least one second provider edge router includes a virtual routing and forwarding table with routes of the first customer network and the cloud services provider network and the at least one third provider edge router includes routes of the second customer network and the cloud services provider. 
 
     
     
         13 . The system of  claim 12  further comprising at least one fourth router including a NAT service, the at least one fourth router having a BGP session with the at least one first provider edge router. 
     
     
         14 . The system of  claim 13  wherein the at least one fourth router further includes a first virtual domain associated with the first customer network and a second virtual domain associated with the second customer network. 
     
     
         15 . The system of  claim 10  wherein the first customer network is associated with a first unique routing tag, the second customer network is associated with a second unique routing tag and the cloud provider network is associated with a third unique routing tag. 
     
     
         16 . The system of  claim 10  wherein the first private virtual connection and the second private virtual connection are layer 3 connections. 
     
     
         17 . The system of  claim 10  wherein the first private virtual connection and the second private virtual connection are layer 2 connections. 
     
     
         18 . The system of  claim 12  further comprising a provisioning portal in communication with the provider edge routers of the service provider network and allowing access by the cloud services provider network and the first customer network to exchange information, the portal configured to provision a virtual connection between the cloud services provider network and the fir 9 st customer network using the existing at least one physical connection when the first customer network requests such a connection.