Tag-Based Cloud Workload Policy Enforcement Without Packet Tag Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for policy enforcement in dynamic cloud environments introduce significant latency due to the constant need to identify workloads within traffic, which do not scale well with large amounts of dynamic workloads, and require constant tag information exchange, affecting Maximum Transmission Unit (MTU) size.
Innovation Solution
Implement tag-based policy enforcement systems that monitor traffic, perform tag lookups, and enforce policies at cloud-based nodes without constant tag exchange, using cloud connectors to synchronize tags and versions, and maintain cache for efficient policy application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If workload information is sent within each packet for policy enforcement, then policy enforcement is achieved, but latency increases significantly
Solution Approach 1:
The system performs tag lookups in advance and caches the results at network nodes. When a packet arrives, the node checks its local cache for the workload's tag information rather than extracting and processing workload information from each packet in real-time. This preliminary action of pre-fetching and caching tag data eliminates the latency associated with per-packet workload identification while maintaining accurate policy enforcement.
2Reliability
If workload information is constantly identified within traffic, then policy enforcement is maintained, but scalability is reduced in large cloud environments
Solution Approach 1:
The system segments the centralized workload identification function into distributed tag caches at multiple network nodes. Each node maintains its own local cache of tag information, allowing policy enforcement decisions to be made independently at each node without centralized coordination for every packet. This segmentation enables the system to scale horizontally across multiple nodes in large cloud environments while maintaining consistent policy enforcement.
3Reliability
If tag information is constantly exchanged between components, then policy enforcement is achieved, but MTU size negotiation is affected
Solution Approach 1:
The system performs tag information exchange during the TCP handshake phase, specifically utilizing the TCP SYN packet to transmit tag data from cloud connectors to network nodes. By completing the tag information transfer during this preliminary connection establishment phase, the system avoids the need for continuous tag exchanges during data transmission, thereby preventing any impact on MTU size negotiation and subsequent data flow.
Data Source
AI summary
Systems and methods for enforcing tag-based policy on dynamic workloads include monitoring, via a cloud-based system, traffic associated with one or more customers of the cloud-based system; receiving a packet from a workload associated with a customer of the one or more customers; performing a tag lookup at one or more nodes of the cloud-based system based on the packet; enforcing one or more policies based on the tag lookup. Based on no tags being found for the workload during the tag lookup at the one or more nodes, the nodes are adapted to drop the packet; query the one or more cloud connectors for workload information; and receive, in a next packet, all tags and a version associated with the workload.