Multi-Tenant Edge Router Security Using Local Tenant Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenanted networks, applying zone-based firewalls is complex due to overlapping VPN IDs and inconsistent VPN presence across edge routers, leading to difficulties in implementing firewall configurations between different VPNs.
Innovation Solution
Introduce the concept of local identifiers generated by edge nodes to identify applicable zones, using overlay routing protocols to learn and map VPN IDs to VRFs, enabling precise zone-based firewall configurations without relying on containers or namespaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If zone-based firewalls are implemented in multi-tenanted networks using traditional VPN ID mapping, then traffic segmentation between tenants is achieved, but implementation complexity increases due to overlapping VPN IDs and inconsistent VPN presence across edge routers
Solution Approach 1:
The patent introduces a controller as an intermediary component that centralizes the management of local identifiers and their mapping to VPN IDs and VRFs. The controller receives local identifier assignments from edge routers, stores them in a data structure, and uses this information to program firewall configurations. This intermediary approach resolves the complexity of distributed VPN ID mapping by centralizing the coordination of identifier assignments across multiple edge routers, thereby maintaining reliable traffic segmentation without requiring complex local configurations at each edge router.
2Ease of operation
If traditional VPN ID-based firewall configurations are used, then firewall policies can be applied between VPNs, but accuracy decreases when VPN IDs overlap or are inconsistently present across different edge routers
Solution Approach 1:
The patent segments the identifier space by introducing local identifiers that are unique to each edge router's context. Instead of relying on globally unique VPN IDs that may overlap or be inconsistently present, each edge router assigns local identifiers to locally present VRFs. This segmentation approach ensures that traffic flow identification is accurate within each edge router's domain, as the local identifier directly corresponds to a locally present VRF, eliminating the ambiguity caused by overlapping or missing VPN IDs.
Solution Approach 2:
The patent changes the identification parameter from VPN ID to local identifier for firewall configuration purposes. The controller programs the firewall to match on local identifiers rather than VPN IDs, fundamentally changing the parameter used for traffic flow identification. This parameter change resolves the accuracy issues inherent in VPN ID-based matching, as local identifiers are guaranteed to be present and unique within each edge router's context, ensuring precise traffic flow identification and accurate firewall policy application.
3Reliability
If zone-based firewalls are deployed across multiple tenants with varying VPN configurations, then security isolation between tenants is achieved, but scalability is reduced due to manual configuration requirements for each tenant's unique VPN ID scheme
Solution Approach 1:
The patent creates a universal framework for zone-based firewall deployment that works across multiple tenants with varying VPN configurations. The controller implements a standardized data structure and programming approach that handles local identifier to VPN ID mapping generically, without requiring tenant-specific customization. This universal approach maintains security isolation by correctly mapping local identifiers to the appropriate VPN IDs and VRFs for each tenant, while simultaneously improving scalability by eliminating the need for manual configuration adjustments when new tenants are added to the network.
Data Source
AI summary
In one embodiment, a method includes onboarding, by an edge router, a first tenant from a network management system and determining, by the edge router, a mapping of a tenant identifier associated with the first tenant to a controller identifier associated with a controller. The method also includes reserving, by the edge router, a port number in a kernel for the first tenant and inserting, by the edge router, the tenant identifier into a first control packet. The method further includes communicating, by the edge router, the first control packet to the controller via an encrypted control connection during a first peering session. The first peering session shares the encrypted control connection with a second peering session.