Gateway Switch Multicast Segmentation via Role-Based Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In overlay networks, efficiently segmenting multicast traffic is challenging due to gateway switches not being aware of role information and segmentation policies, leading to unnecessary bandwidth usage as multicast data packets are forwarded to hosts that are not allowed to receive traffic.
Innovation Solution
Providing segmentation policies to gateway switches and incorporating role information into control and data packets, allowing switches to determine if hosts are allowed to receive traffic and pruning multicast routes based on role information and policies, ensuring only valid hosts receive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multicast traffic is forwarded through gateway switches in overlay networks, then traffic delivery coverage is improved, but bandwidth efficiency deteriorates due to unnecessary forwarding to unauthorized hosts
Solution Approach 1:
The patent incorporates role information into control packets (Type-6 routes) before multicast data is forwarded. Gateway switches use this pre-provided role information to perform segmentation policy checks in advance, determining which hosts are authorized to receive traffic. This preliminary action prevents unnecessary data forwarding to unauthorized hosts, resolving the contradiction between broad traffic delivery coverage and bandwidth efficiency.
Solution Approach 2:
The patent introduces role information as an intermediary element that mediates between multicast traffic forwarding and segmentation policy enforcement. By embedding role identifiers in control packets and using them as the basis for policy decisions, the system enables gateway switches to efficiently determine authorized recipients without directly examining host identities, thus improving bandwidth efficiency while maintaining comprehensive traffic delivery coverage.
2Ease of operation
If gateway switches forward multicast data packets without role information, then forwarding simplicity is improved, but traffic segmentation control deteriorates
Solution Approach 1:
The patent introduces role information as an intermediary that simplifies the gateway switch's forwarding decision process. Instead of complex host-by-host authorization checks, the gateway switch only needs to compare the role information in the control packet with segmentation policies. This intermediary mechanism maintains forwarding simplicity while enabling effective traffic segmentation control.
Solution Approach 2:
The patent changes the parameter used for forwarding decisions from host identities to role identifiers. By transforming the decision basis from complex host-specific information to simplified role categories, the gateway switch can enforce segmentation policies with simpler operations, resolving the contradiction between forwarding simplicity and segmentation control capability.
3Reliability
If role information is incorporated into control packets, then segmentation policy enforcement is improved, but control packet complexity increases
Solution Approach 1:
The patent uses role information that serves multiple functions simultaneously: it identifies the source's role for segmentation policy enforcement, enables authorized host determination, and provides the basis for route pruning decisions. This multi-functionality justifies the added control packet complexity, as the same information element supports multiple critical operations, improving segmentation policy enforcement reliability without proportionally increasing overall system complexity.
Data Source
AI summary
A system for enforcement of a set of segmentation policies at a gateway switch of a network is provided. Here, the segmentation policies can indicate which other roles are allowed to communicate with a respective role, which can indicate a set of privileges in the network. During operation, the switch can receive a first message associated with a join request for a multicast group from a host. The switch can also receive a second message comprising data from a source of the multicast group. The first and second messages can indicate first and second roles, respectively, of the host and source. Based on the first and second roles and a corresponding segmentation policy, the system can determine whether the host is allowed to receive the data from the source. If not allowed, the system can prevent the second message from being forwarded to the host from the gateway switch.