Container Traffic Identification via Network Layer Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies lack the ability to uniquely identify and isolate container-based workloads on the network layer, preventing effective policy enforcement and management of container traffic, as IP addresses and ports are insufficient for distinguishing between containers offering different services on the same compute node or across nodes.
Innovation Solution
A system and method that extracts container identification data from packet data fields, such as IPv6 extension headers or Network Service Headers, to apply policies on a per-container or per-container-flow basis, enabling QoS, prioritization, accounting, and cloud-based classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If IP addresses and TCP/UDP ports are used for identification, then network communication is simplified, but the ability to uniquely identify and isolate container traffic is lost
Solution Approach 1:
The patent segments the network identification space by introducing a unique container identifier (such as a modified TCP port field or custom header) that divides traffic identification into two levels: traditional IP/port for host-level routing and container-specific identifiers for container-level isolation. This segmentation allows each container to be uniquely identified even when sharing the same compute node and application port.
Solution Approach 2:
The patent adds another dimension to network identification by embedding container-specific identifiers within existing packet structures (such as using the TCP port field or adding custom headers). This dimensional addition enables differentiation of container traffic without fundamentally changing the underlying IP addressing scheme, thus maintaining compatibility while improving identification precision.
2Productivity
If containers share the same compute node and application port, then resource utilization is improved, but the ability to apply per-container policies is lost
Solution Approach 1:
The patent applies local quality by associating specific identification markers with individual container traffic flows. Each container's traffic is tagged with its unique identifier at the network layer, allowing network components to apply differentiated policies (such as QoS, routing, or security rules) to specific containers while they share the same physical infrastructure and application ports.
Solution Approach 2:
The patent introduces an intermediary identification mechanism (container-specific identifier embedded in packet headers) that mediates between the shared resource environment and the need for individualized policy control. This intermediary allows the network to distinguish and control individual container traffic without requiring separate physical or application-level resources.
3Reliability
If container identification is implemented at the network layer, then policy enforcement capability is improved, but packet processing complexity increases
Solution Approach 1:
The patent applies preliminary action by embedding container identification information in packet headers at the source (network layer) before packets traverse the network. This pre-tagging approach allows intermediate network devices to quickly identify and apply appropriate policies without performing complex analysis or lookups during packet processing, thus reducing processing complexity while maintaining enforcement effectiveness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a system and method of providing transport-level identification and isolation of container traffic. The method includes receiving, at a component in a network, a packet having a data field, extracting, at a network layer, container identification data from the data field and applying a policy to the packet at the component based on the container identification data. The data field can include one of a header, an IPv6 extension header, a service function chaining container identification, a network service header, and an optional field of an IPv4 packet.