Endpoint Identity Across Layer 3 Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud networking implementations face challenges in accurately identifying endpoints across Layer 3 networks due to limitations in visibility, as L3 networking devices can change L2 network addresses and many networks dynamically allocate limited IP addresses to multiple endpoints, leading to incorrect identification of endpoint traffic.
Innovation Solution
A network management system that maintains a database of IP-MAC address mappings to uniquely identify endpoints by correlating Internet Protocol (IP) addresses and Media Access Control (MAC) addresses, continuously updating the database to reflect the current state of endpoints, and utilizing protocols like SNMP to retrieve and analyze L3-L2 network address mappings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If L3 networking devices dynamically allocate IP addresses to multiple endpoints, then network resource utilization is improved, but endpoint identification accuracy deteriorates
Solution Approach 1:
The patent transitions from single-dimensional IP address identification to two-dimensional IP-MAC address pair identification. By combining Layer 3 (IP) and Layer 2 (MAC) address information, the system achieves accurate endpoint identification even when IP addresses are dynamically allocated to multiple devices, resolving the contradiction between network resource utilization and identification accuracy.
Solution Approach 2:
The patent introduces MAC address information as an intermediary element between IP addresses and actual endpoints. The network management system uses MAC address mapping information to disambiguate which endpoint currently holds a given IP address, enabling accurate identification while allowing dynamic IP allocation.
2Adaptability or versatility
If L3 networking devices change L2 network addresses, then network flexibility is improved, but visibility of endpoints deteriorates
Solution Approach 1:
The patent implements preliminary action by proactively querying for MAC address mapping information from L3 networking devices before endpoint identification is needed. The network management system requests and stores this mapping information in advance, ensuring that visibility is maintained even when devices dynamically change their L2 addresses.
Solution Approach 2:
The patent employs feedback mechanisms where the network management system continuously queries L3 networking devices for updated MAC address mapping information. This feedback loop ensures that the system always has current visibility information about which MAC addresses are associated with which endpoints, maintaining accuracy despite address changes.
3Measurement precision
If network management systems query L3-L2 address mappings continuously, then endpoint identification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by having L3 networking devices autonomously provide their own MAC address mapping information to the network management system. The devices themselves maintain and update their forwarding tables with accurate MAC-to-IP mappings, eliminating the need for complex external probing mechanisms while ensuring identification accuracy.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Systems and methods provide for determining unique identities of endpoints across L3 networks. For example, a first networking device of a network management system in a first L3 network can receive a mapping of a first L3 network address to a first L2 network address from a second networking device in a second L3 network. The system can determine that the first L2 network address is associated with a third networking device. The system can receive a mapping of the L3 address to a second L2 network address from the third device. The system can determine that the second L2 address is associated with an endpoint. The system can store the L3 address and the second L2 address as an identity of the endpoint. The system can present network utilization information of the endpoint using traffic to/from the L3 address correlated to the endpoint based on its identity.