Application-Based Micro-Segmentation for Multi-Cloud Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing network access between resources in cloud networks using micro-segmentation is challenging due to tag management and reliability issues, which complicates security policies and scalability.
Innovation Solution
A controller with classification and rule generation logic determines virtual regions and creates application domains based on resource attributes, converting tags to IP addresses for precise network traffic control, enabling efficient micro-segmentation across multi-cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tag management is used to support micro-segmentation, then network access control between resources is enabled, but management complexity and reliability issues arise
Solution Approach 1:
The patent introduces an intermediary system that automatically discovers endpoints, determines their virtual regions, and generates routing rules without requiring manual tag management. This intermediary layer handles the complexity of resource identification and policy generation, allowing reliable micro-segmentation while reducing operational complexity.
Solution Approach 2:
The system performs self-service by automatically discovering endpoints, determining their locations, and generating appropriate routing rules without human intervention. The classification logic and rule generation logic work autonomously to establish micro-segments based on endpoint attributes, eliminating the need for manual tag management while maintaining reliability.
2Ease of operation
If manual tag management is performed for micro-segmentation, then security policies can be configured, but scalability and operational ease deteriorate
Solution Approach 1:
The system automatically discovers endpoints, determines their virtual regions through classification logic, and generates routing rules without manual intervention. This self-service capability enables easy configuration of security policies while maintaining high scalability, as the system adapts to new endpoints automatically rather than requiring manual policy configuration for each resource.
Solution Approach 2:
The system performs preliminary actions by pre-determining virtual regions and generating routing rules before actual traffic flows occur. The classification logic analyzes endpoint attributes in advance to establish the appropriate micro-segments, enabling rapid deployment and scaling without requiring manual policy configuration for each new resource.
3Adaptability or versatility
If current network infrastructures are used for micro-segmentation, then existing platforms can be leveraged, but management challenges and reliability issues persist
Solution Approach 1:
The system provides universal functionality across multi-cloud environments by using cloud-agnostic concepts like virtual regions and automated endpoint discovery. The classification logic can determine virtual regions in different cloud providers' infrastructures, and the rule generation logic creates appropriate routing rules for each environment, maintaining reliability while adapting to various cloud platforms.
Solution Approach 2:
The intermediary system acts as a universal layer between the administrator and the cloud infrastructure. It automatically discovers endpoints regardless of their cloud provider, determines their virtual regions through standardized classification, and generates appropriate routing rules, thereby maintaining management reliability across diverse multi-cloud environments without requiring provider-specific management approaches.
Data Source
AI summary
A system and method for controlling the handling of intra-VPC and inter-VPC communications is described. First, a destination of a communication is determined it resides within a first virtual private cloud network (VPC) of a source of the communication. If so, filtering communications between the destination and the source is controlled by native cloud constructs associated with a cloud service provider (CSP) underlay network for the first public cloud network. Otherwise, filtering communication between the destination and the source is controlled by a spoke gateway. The spoke gateway is part of a cloud overlay network configured to provide a communication path between the first virtual private cloud network and the second private cloud network and using micro-segmentation to set and manage security policies.