Distributed Firewall Policy Enforcement via TOR Switch Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls face computational burdens and increased traffic due to computationally expensive packet inspection and the need to transfer traffic for policy enforcement, while network elements like TOR switches have underutilized resources that are not capable of performing stateful packet inspection.
Innovation Solution
Distribute traffic control policy enforcement from firewalls to network elements like TOR switches, allowing them to enforce policy actions determined by firewalls through offloading, reducing the computational burden on firewalls and unnecessary traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewalls perform stateful packet inspection to enforce traffic control policies, then policy enforcement accuracy is improved, but computational burden and traffic transfer requirements increase
Solution Approach 1:
The patent segments the firewall functionality by distributing policy enforcement decisions to network elements (TOR switches) through flow offloading. The firewall performs initial packet inspection and policy determination, then segments the enforcement task by installing flow entries at network elements, which handle subsequent packet processing locally without requiring continuous firewall involvement.
Solution Approach 2:
The patent introduces flow offloading as an intermediary mechanism between the firewall and network elements. The firewall determines policies for flows and installs these policies at network elements through a controlled offloading process, allowing network elements to act as intermediaries that enforce policies locally without requiring constant firewall inspection for each packet.
2Reliability
If firewalls inspect all packets to enforce traffic control policies, then policy compliance is improved, but network traffic volume and processing requirements increase
Solution Approach 1:
The patent applies preliminary action by having the firewall perform packet inspection and policy determination upfront during flow establishment. Once a flow is established and its policy is determined, the firewall installs the flow entry at the network element, allowing subsequent packets to be handled by the network element without requiring firewall inspection, thus reducing overall traffic volume through the firewall.
Solution Approach 2:
The patent extracts the policy enforcement function from the firewall and transfers it to network elements. By taking out the enforcement task and installing it at network elements through flow offloading, the system reduces the quantity of traffic that must pass through the firewall for inspection, as network elements can locally enforce policies on their own.
3Adaptability or versatility
If network elements perform packet inspection to enforce policies, then enforcement capability is improved, but device complexity requirements increase
Solution Approach 1:
The patent applies copying by having the firewall create flow entries that replicate policy information at network elements. Instead of requiring network elements to perform complex packet inspection, the firewall copies the enforcement decisions into flow entries installed at network elements, simplifying the requirements for network element hardware and software capabilities.
Solution Approach 2:
The patent enables network elements to serve themselves by installing flow entries at their own locations through the offloading process. Network elements use their local resources to enforce policies without requiring complex packet inspection capabilities, as the policy decisions are pre-installed through the flow offloading mechanism.
Data Source
AI summary
Systems and methods for distributing policy enforcement in a network are disclosed. Embodiments may allow the distribution of enforcement of policies from firewalls to other network elements to allow the offloading of the enforcement of actions of those policies for flows to network elements, where the applicability of those policies to those flows was determined by the firewall.