Flow-Based Forwarding Element Whitelist Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Constructing and managing firewall rules in a Software-Defined Networking (SDN) environment is complex due to rule precedence, which can lead to security vulnerabilities when hundreds or thousands of workloads need to adhere to different security policies.
Innovation Solution
Implementing a flow-based forwarding element that uses a whitelist set of flow entries with match fields and actions to allow communication over allowed paths, eliminating the need for complex rule precedence and conventional firewall engines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional firewall rules with rule precedence are used to protect virtual machines, then security coverage can be achieved, but the complexity of constructing and managing firewall rules increases significantly
Solution Approach 1:
The patent inverts the conventional firewall approach by using a whitelist model instead of a blacklist model. Instead of defining what traffic should be blocked, the system defines what traffic should be allowed. This inversion eliminates the need for complex rule precedence logic, as the default deny-all behavior provides automatic security while the explicit allow rules are simple and straightforward to manage.
Solution Approach 2:
The patent introduces an intermediary component (the flow-based forwarding element or virtual switch) that sits between the hypervisor and the virtual machines. This intermediary handles all packet filtering and forwarding decisions, eliminating the need for firewall engines on each hypervisor and simplifying the overall architecture by centralizing security policy enforcement.
2Reliability
If firewall engines are deployed on each hypervisor to protect virtual machines, then security enforcement is achieved, but the overhead and resource consumption increase
Solution Approach 1:
The patent extracts the firewall engine functionality from the hypervisor and relocates it to a dedicated flow-based forwarding element (virtual switch). This separation allows the hypervisor to focus on virtualization tasks while the forwarding element handles packet filtering and forwarding, reducing the computational overhead on each hypervisor and improving overall system efficiency.
Solution Approach 2:
The flow-based forwarding element serves multiple functions: it acts as a virtual switch for packet forwarding, a firewall for security enforcement, and a flow table manager for policy implementation. By consolidating these functions into a single component, the system reduces resource consumption compared to having separate firewall engines on each hypervisor.
3Reliability
If hundreds or thousands of workloads need to adhere to different security policies, then comprehensive security coverage is achieved, but the difficulty of managing and constructing firewall rules increases
Solution Approach 1:
The patent segments security policies into workload-specific flow entries in a flow table. Each workload or group of workloads can have its own set of flow entries with specific match fields and actions. This segmentation allows for granular security control while simplifying management, as policies can be defined and applied at the workload level without affecting other workloads.
Solution Approach 2:
The patent uses parameter changes in flow table entries to dynamically adapt security policies. By modifying match fields (such as source/destination IP addresses, ports, protocols) and actions in flow entries, the system can efficiently handle different security requirements for hundreds or thousands of workloads without requiring complex rule construction or manual management intervention.
Data Source
AI summary
Example methods are provided for flow-based forwarding element configuration in a network environment. An example method may comprise obtaining a set of security policies associated with the group of workloads; and based on the set of security policies, identifying an allowed forwarding path between a destination and a first workload. The method may also comprise configuring a whitelist set of flow entries and sending configuration information to the flow-based forwarding element to cause the flow-based forwarding element to apply the whitelist set. The whitelist set may include a first flow entry specifying match fields and a first action to allow communication over the allowed forwarding path, but excludes a second flow entry specifying a second action to block communication over a forbidden forwarding path between the destination and the second workload. The match fields may include transport layer information and network layer information.