Hierarchical Security Classes for SDN Policy Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional data center networks face challenges in migrating security policies to software-controlled networks (SDNs) due to the need for a large number of contracts or policies, which burdens the controller and degrades performance, especially when maintaining flood domains and communications policies across multiple subnets.
Innovation Solution
Implementing hierarchical security classes by creating master endpoint groups for security zones and local endpoint groups within bridge domains, where nodes inherit policies from master classes, reducing the number of contracts required and improving scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ACL-based security policies are deployed across multiple subnets in SDN, then security enforcement is maintained, but the number of contracts increases significantly burdening the controller
Solution Approach 1:
The patent segments security policies into two distinct planes: a control plane where the controller maintains global security policy information, and a forwarding plane where switches enforce policies locally using cached rules. This segmentation reduces controller burden by eliminating the need for numerous individual contracts while maintaining comprehensive security enforcement across multiple subnets.
Solution Approach 2:
The patent introduces a security policy cache in the forwarding plane that acts as an intermediary between the controller and the actual packet forwarding decisions. This cache stores pre-computed security rules, allowing switches to enforce policies locally without continuous controller intervention, thereby reducing the number of active contracts needed.
2Reliability
If numerous contracts are created to maintain flood domains and communication policies across subnets, then network security is preserved, but controller performance degrades
Solution Approach 1:
The patent implements preliminary action by pre-computing and caching security policy rules in the forwarding plane before packets arrive. The controller pushes security rules to switches in advance, enabling local enforcement without real-time controller involvement for each packet, thus maintaining network security while preserving controller performance.
Solution Approach 2:
The forwarding plane switches perform self-service by autonomously enforcing security policies using locally cached rules. This eliminates the need for the controller to process numerous individual contracts for each security decision, maintaining comprehensive security enforcement while preventing controller performance degradation.
3Adaptability or versatility
If hierarchical security classes with master and local endpoint groups are implemented, then scalability is improved and controller burden is reduced, but system architecture complexity increases
Solution Approach 1:
The patent introduces a hierarchical dimension to security policy organization by creating master endpoint groups that contain multiple local endpoint groups. This hierarchical structure adds an organizational dimension that improves scalability by allowing policies to be defined once at the master level and automatically applied to multiple local groups, reducing the number of individual contracts needed.
Solution Approach 2:
The master endpoint group serves multiple functions by acting as a parent container that can hold security rules applicable to multiple local endpoint groups. This universal structure allows a single set of security policies to enforce rules across numerous subnets and endpoint groups simultaneously, improving scalability while the controller manages the hierarchical relationships efficiently.
Data Source
AI summary
Techniques for hierarchical security policies are disclosed. A first network configuration is received, where the first network configuration includes a plurality of subnets and a plurality of security zones. An updated network configuration is generated based on the first network configuration by generating, for a first security zone of the plurality of security zones, a first master class, and generating, for each respective subnet of the plurality of subnets, a respective bridge domain. For each respective bridge domain, a respective local endpoint group (EPG) corresponding to the first security zone is created, and the first master class is assigned to the respective local EPG. Finally, one or more contracts are generated for the first master class based on the first network configuration.