Group-Based Policy Synthesis for Unknown Network Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network segmentation technologies face challenges in enforcing group-based policies (GBPs) for unknown flows, particularly in scenarios with multicast, unknown-unicast, or broadcast traffic, where the destination address does not indicate an individual host, making it difficult for switches to determine whether to forward packets based on configured policies.
Innovation Solution
The system synthesizes a set of policies from user-configured policies, transforming them to allow input of a source role and traffic attributes to output a list of allowed destination roles, creating an equivalent decision model that can enforce GBPs even when the destination role is unknown, by re-orienting user-configured policies into a transposed matrix form, handling overlaps, implosion, and pruning to optimize policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional network segmentation is used for unknown flows, then destination-based policy enforcement is maintained, but the system cannot determine whether to forward packets when destination address does not indicate an individual host
Solution Approach 1:
The patent inverts the traditional destination-based policy enforcement approach by synthesizing policies that take source role as input and output allowed destination roles. This inversion allows the system to handle unknown flows by reversing the decision logic: instead of asking 'what policy applies to this destination?', the system asks 'what destinations are allowed for this source?', enabling adaptability while managing complexity through synthesis operations.
2Reliability
If group-based policies are synthesized from user-configured policies, then policy enforcement for unknown flows is enabled, but processing complexity increases due to matrix transposition, overlap detection, and pruning operations
Solution Approach 1:
The patent applies preliminary action by pre-synthesizing policies during configuration time rather than in real-time during packet forwarding. The synthesis operations (matrix transposition, overlap detection, pruning) are performed upfront to create a simplified decision model that can quickly enforce policies during actual traffic flow, trading initial processing time for faster runtime enforcement.
3Adaptability or versatility
If wildcard expansion is performed on traffic attributes, then policy matching coverage is improved, but the quantity of policy entries increases due to overlap and duplication
Solution Approach 1:
The patent applies merging by combining multiple expanded policy entries that have overlapping traffic attributes into single consolidated entries. The pruning operation identifies and merges redundant policies resulting from wildcard expansion, maintaining comprehensive policy matching coverage while reducing the total quantity of policy entries to manageable levels.
4Ease of operation
If synthesized policies are created to handle unknown destinations, then forwarding decisions can be made for multicast and broadcast traffic, but equivalence with original decision model must be maintained
Solution Approach 1:
The patent applies feedback by systematically verifying that the synthesized policy decision model produces equivalent results to the original user-configured policies. The synthesis process includes validation steps that ensure the transformed policies maintain the same forwarding decisions, providing feedback loops to confirm equivalence while enabling easier operation for unknown flows.
Data Source
AI summary
A system determines a first set of policies, wherein at least one policy entry for a destination role comprises a source role, a traffic attribute, and an action to be taken for the packet. The system represents the policies as a matrix, wherein a first entry in the matrix indicates the source and destination role, the traffic attribute, and the action of the at least one policy entry. The system replaces, in the first entry, the action with the destination role if the action indicates to allow the packet, and with a null value if the action indicates to deny the packet, to obtain a first data structure with entries indicating, for a respective source role, traffic attributes and corresponding sets of allowed destination roles. The system resolves an overlapping pair comprising a first and a second traffic attribute to obtain a second set of synthesized policies.