Distributed Firewall Policy Enforcement Using Stateless Switches
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls face computational burden and increased traffic due to computationally expensive packet inspection and the need to transfer traffic for policy enforcement, while network elements like TOR switches have underutilized resources that are not capable of performing stateful packet inspection.
Innovation Solution
Distribute traffic control policy enforcement from firewalls to network elements such as TOR switches, allowing offloading of policy actions determined by firewalls through a firewall flow distribution agent, using a publish-subscribe architecture and heartbeat messages to maintain flow sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packet inspection is performed at the firewall to enforce traffic control policies, then policy enforcement accuracy is improved, but computational burden on the firewall increases
Solution Approach 1:
The patent segments the firewall system into multiple components: a control plane (firewall) that performs packet inspection and policy decision-making, and data plane elements (network switches) that enforce policies. This segmentation allows the computationally intensive inspection to be separated from the enforcement function, reducing the computational burden on the firewall while maintaining enforcement accuracy.
Solution Approach 2:
The patent extracts the policy enforcement function from the firewall and relocates it to network switches. The firewall extracts only the essential policy rules and forwards them to switches, which then handle the actual packet filtering and enforcement. This extraction reduces the firewall's computational load while maintaining policy enforcement capabilities at the network edge.
2Reliability
If traffic is transferred from network elements to the firewall for policy enforcement, then policy control is improved, but network traffic volume increases
Solution Approach 1:
The patent implements preliminary action by having the firewall perform packet inspection and determine policy actions before forwarding only the essential policy rules to network switches. This preliminary decision-making allows switches to enforce policies locally without needing to transfer actual data traffic to the firewall, thereby reducing network traffic volume while maintaining policy control.
Solution Approach 2:
The patent introduces a message broker as an intermediary between the firewall and network switches. The broker facilitates the exchange of policy rules and enforcement decisions without requiring direct traffic transfer between firewall and switches. This intermediary mechanism enables policy control to be distributed while minimizing network traffic overhead.
3Reliability
If stateful packet inspection is performed at the firewall, then security enforcement is improved, but hardware resource utilization at network elements remains underutilized
Solution Approach 1:
The patent enables network switches to self-serve by equipping them with the capability to enforce security policies locally. Switches receive policy rules from the firewall and autonomously perform packet filtering and enforcement without requiring continuous firewall intervention. This self-service approach utilizes the hardware resources of network switches, improving overall system productivity while maintaining security enforcement quality.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for distributing policy enforcement in a network are disclosed. Embodiments may allow the distribution of enforcement of policies from firewalls to other network elements to allow the offloading of the enforcement of actions of those policies for flows to network elements, where the applicability of those policies to those flows was determined by the firewall.