Dynamic Security Group Updates via IP Prefix Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security approaches, such as the principle of least privilege, face challenges in dynamically managing user access and network security in complex environments like 5G cloud-based networks, particularly with non-native traffic routing that masks true traffic source labels, leading to inefficiencies in maintaining secure communication and coordination between network resources.
Innovation Solution
An automated process for IP-based filtering is implemented, using prefix lists and notification services to dynamically update communication permissions between network functions, allowing or blocking IP addresses based on instance instantiation and termination, and utilizing load balancers to enforce least privilege access and manage network communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual IP planning and security group updates are used to maintain least privilege access, then network security is maintained, but maintenance work increases and the system becomes unwieldy at scale
Solution Approach 1:
The system automatically discovers network resources and updates security groups without manual intervention. The security management system self-services by receiving notifications of resource changes and autonomously updating the prefix lists and security group rules to maintain least privilege access, eliminating the need for manual IP planning and security updates.
Solution Approach 2:
The system pre-configures security groups with placeholder rules and automatically populates them with actual IP addresses when resources are discovered. This preliminary action allows security policies to be established in advance while deferring the specific IP address configuration until resources are actually deployed, reducing initial maintenance complexity.
2Ease of operation
If preplanned IP networks with assumed trust are used, then coordination between deployments is simplified, but the ability to enforce least privilege access deteriorates
Solution Approach 1:
The system implements continuous feedback loops where security management systems notify resource management systems of changes, which then update security groups. This feedback mechanism ensures that least privilege access is dynamically maintained based on actual network resource states, replacing the static assumed trust model with an adaptive security approach.
Solution Approach 2:
The patent introduces a intermediary notification mechanism that mediates between resource deployment events and security group updates. This intermediary layer automatically translates resource changes into security policy updates, maintaining least privilege access without requiring direct coordination between deployments while still ensuring security compliance.
3Adaptability or versatility
If non-native traffic routing is used in cloud environments, then network flexibility is improved, but the functionality of native security tools deteriorates due to masked traffic source labels
Solution Approach 1:
The system moves security enforcement from the network packet dimension (which lacks source labels in non-native routing) to the application layer dimension. By implementing security groups at the application layer that can dynamically resolve and filter based on actual source identities, the system maintains security functionality despite the loss of native network-level source label information.
Data Source
AI summary
IP prefix lists are used as a source for filtering with near real-time updates to prefix lists associated with particular network functions. Network functions are deployed with one or more prefix lists based on communication need, a messaging queue for receiving work to updates for the prefix list, a maintenance worker, and a notification service. When a network function expands or contracts and has a change in IP scope, the listening network functions are alerted. When the event is detected, a message is transmitted by the network function's notification service. Listener queues subscribed to the upstream network function receive the change notification and invoke the maintenance worker to update the prefix list based on the message. The invoked process digests the message and adjusts the prefix list for the listening load balancer accordingly, resulting in adding or removing permitted traffic flow.