Centralized Controller Automates ACL Rule Distribution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Managing and administering access control list (ACL) rules in large data networks is labor-intensive and prone to errors, especially in segmented network environments using overlay technologies like VxLAN, as system administrators must manually configure each switch, leading to inefficiencies and potential misconfigurations.

Innovation Solution

Implementing a centralized data network controller that automates the management and distribution of ACL rules, allowing switches to autonomously receive and install rules close to the source of targeted data packets, reducing administrative workload and improving network performance by filtering packets early in the traffic flow.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If system administrators manually administer ACL rules on each switch, then ACL rules can be configured and updated, but the process becomes labor intensive and prone to errors in large networks

Engineering Contradiction:

ImproveACL rule administrationVSAvoidAdministrative efficiency

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

A centralized controller is introduced as an intermediary between administrators and network switches. The controller receives ACL rule updates from administrators and automatically distributes them to the appropriate switches, eliminating the need for manual per-switch configuration while maintaining accurate policy enforcement across the network.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If ACL rules are manually installed on each switch, then access control can be enforced, but the process is time consuming and error prone

Engineering Contradiction:

ImproveACL rule accuracyVSAvoidAdministration time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The centralized controller maintains a feedback loop with network switches, receiving their status information and automatically pushing updated ACL rules. This ensures accurate policy enforcement while reducing administration time through automated synchronization rather than manual intervention at each switch.

Inventive Principle:

Principle #23Feedback

3Productivity

If a centralized controller automatically distributes ACL rules, then administrative workload is reduced, but the system complexity increases

Engineering Contradiction:

ImproveAdministrative efficiencyVSAvoidNetwork management architecture

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The complex task of ACL rule distribution is extracted from individual switches and consolidated into a dedicated centralized controller. This separates the management function from the forwarding function, reducing the complexity burden on each switch while maintaining overall system manageability through a specialized control device.

Inventive Principle:

Principle #2Taking out (Extraction)

4Reliability

If ACL rules are distributed to all switches, then comprehensive access control is achieved, but unnecessary rules increase processing overhead

Engineering Contradiction:

ImproveAccess control coverageVSAvoidSwitch processing resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The centralized controller identifies and distributes only the ACL rules relevant to each specific switch based on its position and function in the network. This ensures comprehensive access control where needed while avoiding unnecessary rule processing on switches where the rules would not apply, thereby optimizing resource utilization.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS11671361B2Centralized management and distributed enforcement of policies for network segmentation

Publication Date: 2023.06.06 ARISTA NETWORKS INC

AI summary

A central controller in a data network can maintain a set of access control list (ACL) rules that represent traffic and data policies of the data network. The controller can autonomously propagate the set of ACL rules to switches in the data network. Each switch that receives the set of ACL rules can selectively install rules from the set based on criteria such as whether or not a given rule in the set is close to the source and device class.