Cross-Domain Policy Orchestration with Macro and Micro-Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network environments face challenges in orchestrating policies across distinct domains due to differing policies and protocols, leading to inflexible solutions that lack adaptability and create dependencies, making network deployment and policy enforcement difficult.
Innovation Solution
A cross-domain automation (CDA) controller performs macro-segmentation based on metadata mapping and micro-segmentation using a merged policy matrix to enable policy independence and flexibility across domains, allowing administrators to visualize and adjust policies seamlessly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If common policies are enforced at each domain to ensure interworking, then interworking between domains is achieved, but policy independence between domains is lost and policies become too restrictive or unrestrictive
Solution Approach 1:
The patent divides policy management into two segments: macro-segmentation of domains and micro-segmentation of group-based policies within domains. This segmentation allows each domain to maintain its own policy characteristics while still achieving interworking through the structured policy hierarchy.
Solution Approach 2:
The patent introduces a cross-domain policy orchestration system that acts as an intermediary between domains. This orchestration system enables policy translation and coordination between domains with different policies, allowing interworking without requiring identical policies at each domain.
2Adaptability or versatility
If domains maintain different policies to preserve policy independence, then adaptability and flexibility are improved, but interworking communications between domains become difficult
Solution Approach 1:
The cross-domain policy orchestration system serves as a mediator that translates between different domain policies. It receives policy information from multiple domains, reconciles differences, and enables interworking communications without requiring domains to adopt common policies, thus preserving policy independence while achieving interoperability.
Solution Approach 2:
The patent changes the parameter of policy enforcement from uniform across domains to variable by domain. Each domain can maintain its own policy parameters while the orchestration system coordinates interactions, allowing policy independence to be maintained without sacrificing interworking capability.
3Adaptability or versatility
If macro-segmentation and micro-segmentation are implemented for cross-domain policy orchestration, then policy independence and flexibility are achieved, but system complexity increases
Solution Approach 1:
The patent implements segmentation at two levels: macro-segmentation dividing the network into domains, and micro-segmentation dividing policies into group-based policies within domains. This hierarchical segmentation manages complexity by breaking down the overall policy management task into smaller, more manageable segments that can be independently configured and enforced.
Solution Approach 2:
The cross-domain policy orchestration system provides universal functionality by handling multiple domains with different policies through a single unified platform. This multi-functionality reduces overall system complexity by consolidating policy management capabilities rather than requiring separate mechanisms for each domain.
Data Source
AI summary
A method of cross-domain policy orchestration may include executing, with a cross-domain automation (CDA) controller, a macro-segmentation of a plurality of domains based at least in part on metadata defining a mapping to a corresponding plurality of domain controllers, and executing, with the CDA controller, a micro-segmentation of policies within a group based at least in part on a merged policy matrix obtained from policies of the domain controllers.