Application Access Control for SD-WAN Egress Gateway Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing SD-WAN networks experience long access latencies due to limited routing configuration strategies and coarse-grained routing control, leading to erroneous traffic scheduling across regions.
Innovation Solution
An application access control method that pre-configures application information and egress gateway information, allowing clients to perform access control based on target access identifications, ensuring traffic is directed to the correct egress gateway for reduced latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If coarse-grained routing control is used in SD-WAN networks, then device complexity is reduced, but access latency increases due to erroneous traffic scheduling
Solution Approach 1:
The patent segments routing control into two levels: coarse-grained regional routing for overall traffic direction and fine-grained application-level routing for precise traffic scheduling. The regional router handles macroscopic routing between regions, while application routers handle microscopic routing for specific applications, dividing the routing function to simultaneously reduce complexity and improve precision.
Solution Approach 2:
The patent implements dynamic routing selection where the system automatically chooses between different routing paths based on real-time conditions. Application routers dynamically select optimal egress gateways and routing paths based on current network state, application requirements, and traffic characteristics, enabling adaptive routing that reduces latency without requiring complex static configurations.
2Loss of time
If fine-grained application-level routing control is implemented, then access latency is reduced through accurate traffic scheduling, but device complexity increases
Solution Approach 1:
The patent divides the routing system into hierarchical segments: regional routers that perform coarse-grained routing between geographic regions, and application routers that perform fine-grained routing for specific applications. This segmentation allows complex application-level routing to be handled by specialized components while simpler regional routing handles overall traffic flow, reducing overall system complexity.
Solution Approach 2:
The patent introduces application routers as intermediary components between regional routers and end applications. These intermediaries translate high-level application requirements into detailed routing instructions, handling the complexity of fine-grained routing control while presenting a simplified interface to both upper-layer applications and lower-layer regional routing infrastructure.
3Ease of operation
If traditional routing control is used, then ease of operation is maintained, but traffic scheduling accuracy deteriorates leading to detours
Solution Approach 1:
The patent performs preliminary routing configuration where application configuration information including egress gateway selections and routing parameters is pre-configured and stored in a database before runtime. This preliminary action enables the system to automatically retrieve and apply appropriate routing instructions without requiring complex real-time decision-making or manual intervention during operation, maintaining ease of use while improving accuracy.
Solution Approach 2:
The patent implements feedback mechanisms where routing performance is monitored and used to refine future routing decisions. The system collects information about actual traffic flow, latency, and routing effectiveness, then uses this feedback to optimize routing configurations and egress gateway selections, continuously improving scheduling accuracy while maintaining operational simplicity through automated adjustments.
Data Source
AI summary
The present disclosure provides an application access control method and apparatus, a device, a storage medium, and a program product. The method includes: obtaining application configuration information, where the application configuration information includes preset application information, and preset access identifications and egress gateway information corresponding to the preset application information; obtaining, in response to a connection request from a client of a security management application, a target access identification of the client; querying, based on the target access identification, corresponding target application information and target egress gateway information corresponding to the target application information from the application configuration information; and feeding the target application information and the target egress gateway information back to the client, to cause the client to perform access control on a first business application on a target terminal device based on the target application information and the target egress gateway information.