Cloud Template-Aware Firewall Rule Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing enterprise firewall policy model is inadequate for supporting private cloud and automation scenarios, leading to scalability and performance issues due to rule and dynamic group overload, as well as management complexity, especially when handling hundreds of application instances created from the same template, resulting in frequent rule changes and mismanagement of firewall rules.
Innovation Solution
Introducing cloud template awareness in the service policy framework with service rule processing engines that support template-specific dynamic groups and rules, allowing for dynamic security tags and seamless association of data compute nodes with dynamic component groups, enabling efficient processing and management of service rules defined in terms of template identifiers, instance identifiers, and match criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewall policy model is used for each template instance, then instance-specific security control is achieved, but rule quantity and management complexity increase exponentially
Solution Approach 1:
The patent merges security rules from multiple template instances into a single aggregated rule set. Instead of maintaining separate firewall rules for each template instance, the system combines rules that have identical match criteria and actions, representing them as a single rule with a count indicator showing how many instances it applies to. This dramatically reduces the total number of rules while maintaining instance-specific security control through the aggregation mechanism.
Solution Approach 2:
The patent creates universal firewall rules that apply to multiple template instances simultaneously. A single rule can be applied to N template instances through the aggregation mechanism, making the rule system multi-functional. The same rule structure serves both individual instance security requirements and bulk rule management needs, eliminating the need for separate rule copies for each instance.
2Reliability
If firewall rules are created for each template instance, then precise security control is achieved, but scalability deteriorates due to rule overload
Solution Approach 1:
The system merges firewall rules across template instances by identifying rules with identical match criteria (source, destination, port, protocol) and combining them into a single aggregated rule. The aggregation includes a count parameter indicating how many instances the rule covers. This approach maintains precise security control for each instance while improving scalability by reducing the total rule count from O(N) to O(1) for identical rules.
3Reliability
If dynamic groups are created for each template instance, then instance isolation is achieved, but dynamic group churn increases constantly
Solution Approach 1:
The patent merges dynamic group management across template instances by aggregating instances that share the same template into single dynamic groups. Instead of creating separate dynamic groups for each instance, the system creates one dynamic group per template that contains multiple instances. This maintains instance isolation through the group structure while eliminating constant creation and deletion of dynamic groups, reducing churn significantly.
4Reliability
If firewall rules are updated for each template instance, then up-to-date security policy is achieved, but policy change propagation becomes challenging
Solution Approach 1:
The patent merges policy change propagation by implementing a single point of modification for aggregated rules. When a firewall rule needs to be updated, the administrator modifies the single aggregated rule in the rule console, and the change automatically propagates to all N template instances that the rule covers. This eliminates the need to update rules individually for each instance, making policy changes simple while ensuring all instances receive updates simultaneously.
Solution Approach 2:
The system performs preliminary aggregation of rules during rule creation, organizing them by match criteria and associated template instances. This preliminary structuring enables efficient bulk propagation of changes later, as the aggregation metadata (which instances each rule applies to) is already established. When updates are needed, the system uses this pre-computed information to propagate changes to all relevant instances in a single operation.
5Device complexity
If traditional firewall model is used, then simple policy structure is maintained, but cloud template awareness is lost
Solution Approach 1:
The patent extends the traditional firewall policy model to make it cloud-template aware while maintaining its simple structure. The firewall rules are enhanced with template identifiers and aggregation metadata, allowing them to function both as traditional instance-specific rules and as cloud-template-aware bulk rules. This multi-functionality enables the same rule structure to work in both traditional and cloud environments without increasing complexity.
Solution Approach 2:
The patent segments the firewall rule structure into two independent layers: the match criteria layer (source, destination, port, protocol, action) and the template aggregation layer (template identifier, instance count, associated instances). This segmentation allows the traditional simple match criteria to remain unchanged while adding cloud template awareness through the separate aggregation layer. The two layers work together without interfering with each other, maintaining simplicity while enabling cloud functionality.
Data Source
AI summary
Some embodiments of the invention introduce cloud template awareness in the service policy framework. Some embodiments provide one or more service rule processing engines that natively support (1) template-specific dynamic groups and template-specific rules, and (2) dynamic security tag concepts. A service rule processing engine of some embodiments natively supports template-specific dynamic groups and rules as it can directly process service rules that are defined in terms of dynamic component groups, template identifiers, template instance identifiers, and/or template match criteria. Examples of such services can include any kind of middlebox services, such as firewalls, load balancers, network address translators, intrusion detection systems, intrusion prevention systems, etc.