Flow Differentiation Using Origin IDs for Overlapping IP Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for distinguishing between devices with overlapping IP addresses in large-scale networks face scalability challenges due to memory limitations and strong coupling between senders and receivers, especially in cloud environments with load balancers.
Innovation Solution
Deploy agents at each site to encapsulate outbound packets with a unique identifier, such as a VPC or branch identifier, and use a session manager on security appliances to create sessions based on a 6-tuple that includes this identifier and other packet attributes, enabling scalable flow differentiation and security policy enforcement without preconfiguring network components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If zones and interfaces are preconfigured in each worker to uniquely identify branches or VPCs, then flow differentiation accuracy is improved, but device complexity and memory requirements increase significantly
Solution Approach 1:
The patent extracts the zone/interface identification functionality from the worker nodes and relocates it to the packet encapsulation agents at the network edges. Only the essential encapsulation logic remains at workers, while the complex zone/interface mapping is handled by the agents that have direct access to site identifier information.
Solution Approach 2:
The patent introduces packet encapsulation agents as intermediary components between the packet sources and the worker nodes. These agents perform the function of adding origin identifiers to packets, thereby mediating the flow differentiation task without requiring workers to store extensive zone/interface configuration data.
2Reliability
If all workers are preconfigured with all zones and interfaces defined for the network, then complete flow identification capability is improved, but scalability deteriorates in large-scale networks
Solution Approach 1:
The patent segments the flow identification function across multiple components: packet encapsulation agents at each site, the encapsulation process itself, and the worker nodes. This segmentation allows each component to have a simplified role, with agents handling site-specific identifier insertion and workers handling packet processing based on these identifiers, thereby enabling network scalability.
Solution Approach 2:
The patent performs the identification setup action in advance by deploying packet encapsulation agents at each site with their local site identifiers. This preliminary action eliminates the need for workers to be preconfigured with all network zones and interfaces, as the identification information is already embedded in packets by the time they reach workers.
3Measurement precision
If a dedicated worker node is designated for specific VPCs or branches, then flow management precision is improved, but system coupling increases between senders and receivers
Solution Approach 1:
The patent makes worker nodes universal by enabling them to handle packets from any VPC or branch through load balancing, rather than dedicating specific workers to specific VPCs. The packet encapsulation agents ensure that origin identifiers are preserved throughout the network, allowing any worker to accurately identify and manage flows from any source.
Solution Approach 2:
The patent implements a feedback mechanism where packet encapsulation agents continuously add origin identifiers to outbound packets, and worker nodes use these identifiers to route and manage packets. This feedback loop ensures accurate flow management without requiring static worker-VPC assignments, thereby reducing system coupling.
Data Source
AI summary
Flows corresponding to an overlapping IP address are differentiated via scalable techniques for appropriate enforcement security policies. Agents deployed to each site of a network (e.g., each VPC or branch router) encapsulate outbound packets with a header that includes an identifier that uniquely identifies the site as the origin of the packets, such as a VPC identifier or branch identifier. A session manager executing on a security appliance receives the encapsulated packets and determines the origin identifier and other packet attributes, including source/destination IP addresses, source/destination ports, and protocol. The session manager creates an N-tuple (e.g., a 6-tuple) comprising the origin identifier and packet attributes and creates a session for the flow with the N-tuple as the session key. The security appliance then enforces a security policy for the packets and subsequent packets that are part of the flow and match to the created session.