Fabric-Based Virtual Air Gap Provisioning for Network Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network fabrics lack effective isolation methods to secure communication between isolated networks, leading to vulnerabilities from both external and internal threats, and existing virtual air gap solutions compromise the integrity of the air gap by allowing direct communication.
Innovation Solution
A network configuration device is used to instantiate sub-fabrics within a network fabric, implementing a virtual air gap policy that defines isolation criteria, and provisions a virtual air gap around the sub-fabric using a fabric provisioning module to ensure internal packets remain isolated, creating a DMZ-like environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physically isolated networks are implemented to secure communication, then security is improved, but hardware costs and maintenance overhead increase significantly
Solution Approach 1:
The network fabric is segmented into multiple virtual sub-fabrics that are logically isolated from each other. Each sub-fabric can be configured with different security policies and isolation levels, allowing secure communication without requiring physical separation of hardware infrastructure.
Solution Approach 2:
A virtual air gap mechanism acts as an intermediary between isolated sub-fabrics, enabling controlled data exchange while maintaining security boundaries. This virtual mediator allows selective communication without compromising the isolation architecture.
2Productivity
If virtual air gap is implemented to allow communication between isolated networks, then data transfer capability is improved, but the integrity of the air gap is compromised
Solution Approach 1:
The virtual air gap is implemented as a dynamic, configurable isolation mechanism rather than a static barrier. The isolation level and communication permissions can be adjusted in real-time based on security requirements, allowing the system to adapt between strict isolation and controlled data exchange.
Solution Approach 2:
The system changes the isolation parameter dynamically, allowing the virtual air gap to transition between different states of connectivity. This enables data transfer when needed while maintaining the ability to restore full isolation when security requirements demand.
3Reliability
If multiple duplicative networks are implemented for different security levels, then security isolation is improved, but cost and maintenance overhead increase
Solution Approach 1:
A single physical network fabric infrastructure is designed to serve multiple security levels and isolation requirements simultaneously. The same hardware resources are universally utilized across different virtual sub-fabrics, eliminating the need for duplicative physical networks for each security level.
Data Source
AI summary
A device configured to or programmed to instantiate an isolated sub-fabric is presented. A network configuration device uses a virtual air gap policy to instantiate a sub-fabric from a fabric of networking nodes. The sub-fabric is configured with an internal routing policy that respects the nature of the defined isolation. Further, the fabric is provisioned with a virtual air gap that ensures the external networking nodes respect the isolation of the sub fabric.