Distributed Traffic Steering with Encapsulated Headers for Scalable Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions face challenges in efficiently steering and enforcing network traffic in high-bandwidth environments without requiring network redesign, especially in enterprise networks with diverse computing resources like virtual machines and containers, while maintaining original network information for accurate security policy application.
Innovation Solution
The implementation of distributed traffic steering and enforcement techniques that encapsulate and reroute network traffic through a security platform, using eBPF/XDP to modify packets within the kernel, and utilize SmartNICs for efficient traffic management, allowing for transparent operation across various computing environments including bare metal, virtual machines, and containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional security solutions are deployed in high-bandwidth enterprise networks, then security enforcement can be performed, but network traffic steering efficiency deteriorates and latency increases
Solution Approach 1:
The system segments security enforcement by deploying lightweight tunneling agents at individual network nodes rather than relying on a single centralized security appliance. Each node independently encapsulates and forwards traffic, enabling distributed security processing that reduces latency and improves scalability in high-bandwidth networks.
Solution Approach 2:
The patent introduces an intermediary encapsulation layer (using protocols like Geneve or VXLAN) between the original network traffic and the security enforcement point. This intermediary layer carries original network information while enabling traffic steering to security services, resolving the contradiction between maintaining network information and achieving efficient traffic management.
2Device complexity
If network traffic is steered through centralized security appliances, then security policy application is simplified, but device complexity and scalability worsen
Solution Approach 1:
The centralized security architecture is segmented into distributed lightweight agents deployed at multiple network nodes. Each agent handles local traffic independently, enabling the system to scale with network size while maintaining manageable complexity through standardized encapsulation protocols.
Solution Approach 2:
The encapsulation agents perform multiple functions: traffic steering, original network information preservation, and security policy enforcement. This multi-functionality reduces overall system complexity by consolidating responsibilities into a universal protocol rather than requiring separate specialized components.
3Measurement precision
If original network information is preserved during traffic steering, then security policy accuracy is improved, but data processing overhead increases
Solution Approach 1:
The patent embeds original network information (headers, metadata) within the encapsulation structure of the traffic tunnel. This nested arrangement preserves complete network context for accurate security policy matching while minimizing data processing overhead by avoiding deep packet inspection of the original traffic payload.
Data Source
AI summary
In some embodiments, a system, process, and/or computer program product includes encapsulating an original traffic header for a monitored flow from/to an entity in a virtualized environment; rerouting the flow from the entity in the virtualized environment to a security platform of a security service, wherein the security platform includes a virtualized firewall; performing security analysis at the security platform using the original traffic header; and rerouting the flow back to the entity in the virtualized environment for routing to an original destination based on the original traffic header, wherein the flow is rerouted over a network tunneling protocol to the security platform of the security service to isolate and protect workloads, application stacks, and/or services, and wherein an enforcement point is remote from a decision point using distributed traffic steering and enforcement via a distributed set of virtualized firewalls provided by the security service to facilitate application level segmentation.