Container Network Security via Service Type Traffic Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Containerized computing environments face challenges in distinguishing and securing North-South and East-West network traffic due to IP address conflicts and shared subnets, which complicates the implementation of appropriate security policies, especially with Network Address Translation (NAT) devices.
Innovation Solution
A method and system that monitor and assign IP addresses to separate lists based on service types, applying distinct security policies for North-South and East-West network traffic, using an intrusion prevention system (IPS) to detect and manage traffic flows, ensuring appropriate security measures are in place for each type of traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Network Address Translation (NAT) is used to prevent IP address conflicts, then IP address conflicts between containers and network devices are prevented, but the ability to identify North-South and East-West network traffic based on IP addresses or subnets is compromised
Solution Approach 1:
The patent introduces an intermediary mechanism (service type determination and list assignment system) that sits between the NAT layer and the security policy enforcement layer. This intermediary translates the obscured traffic information into a form that security policies can understand, by assigning containers to different lists based on their service types without requiring changes to the NAT implementation itself.
Solution Approach 2:
The patent segments the container population into different groups (first list and second list) based on their service types. This segmentation allows the system to apply different security policies to different segments of traffic, enabling North-South and East-West traffic differentiation even when IP addresses are obscured by NAT.
2Ease of operation
If a single security policy is applied to all network traffic, then policy implementation is simplified, but the ability to provide differentiated security for North-South and East-West traffic is lost
Solution Approach 1:
The patent applies the local quality principle by assigning different security policies to different local groups of containers. Containers in the first list receive one security policy while containers in the second list receive another security policy, allowing localized security treatment based on service type without requiring complex global policy management.
3Productivity
If IP addresses are shared between containers and network devices, then network resource utilization is improved, but the ability to distinguish traffic sources and apply appropriate security policies is compromised
Solution Approach 1:
The patent changes the parameter used for traffic classification from IP address (which is shared and ambiguous) to service type (which is unique and meaningful). By determining service types and assigning containers to different lists based on these service types, the system achieves precise traffic source identification despite IP address sharing.
Data Source
AI summary
A method comprises monitoring a computing environment including a plurality of containers, determining, for one of the containers, a service type and an IP address, assigning the IP address of the container having the determined service type to a first list of IP addresses, assigning an IP address of each of the containers to a second list of IP addresses, applying a first security policy for a first source of network traffic for processing by the container having the determined service type and the IP address assigned to the first list of IP addresses, and applying a second security policy for a second source of network traffic for processing by the containers having the IP addresses assigned to the second list of IP addresses.