Ingress Filtering Using Security Group Information
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Access Control Lists (ACLs) in network security are inflexible and require frequent updates due to changes in network topology, leading to increased complexity, processing costs, and a higher risk of network outages, especially with the need to manage numerous IP addresses and permissions, which complicates network manageability and security policy enforcement.
Innovation Solution
Implementing Role-Based Access Control Lists (RBACLs) that move the point of access control from the egress node to the ingress node, using security groups to enforce permissions based on the roles of network entities, thereby reducing unnecessary network traffic and allowing for dynamic adaptation to network changes without requiring extensive hardware or software updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional ACLs are applied at the egress node, then security policy enforcement is achieved, but network traffic traverses the core unnecessarily increasing bandwidth consumption and latency
Solution Approach 1:
The patent applies access control filtering at the ingress node before packets traverse the network core, rather than at the egress node. This preliminary action prevents unauthorized packets from entering the network core, thereby reducing unnecessary bandwidth consumption and latency while maintaining security policy enforcement.
Solution Approach 2:
The patent introduces a mapping mechanism that translates destination IP addresses to egress interface identifiers at the ingress node. This intermediary mapping system enables the ingress node to make intelligent forwarding decisions and apply security filters without requiring full ACL complexity at each node, reducing core traffic while maintaining enforceability.
2Adaptability or versatility
If ACLs are updated frequently to adapt to network topology changes, then security policy currentness is maintained, but processing overhead and risk of network outages increase
Solution Approach 1:
The patent segments the ACL management function into two parts: a simplified ingress filtering mechanism at the ingress node and a mapping database at the egress node. This segmentation allows the ingress node to apply lightweight filters without processing full ACL complexity, reducing the burden of frequent updates while maintaining security policy currentness through the mapping mechanism.
Solution Approach 2:
The patent creates a mapping copy of destination IP address to egress interface relationships, stored in a database at the egress node. This mapping copy enables the ingress node to perform simple lookups rather than processing complex ACL rules, reducing the computational overhead and risk associated with frequent ACL updates while maintaining adaptability to topology changes.
3Productivity
If ingress filtering is implemented, then network traffic is reduced and security is enhanced, but additional processing requirements are introduced at the ingress node
Solution Approach 1:
The patent changes the filtering parameters from complex multi-dimensional ACL rules to simple destination IP address-based filters at the ingress node. This parameter simplification reduces the processing power required at the ingress node while still achieving traffic reduction and security enhancement through the mapping mechanism that translates these simple filters to the appropriate egress interfaces.
Data Source
AI summary
A method and apparatus for ingress filtering using security group information are disclosed. The method includes performing access control processing on a packet and sending access control information to an ingress node of the packet in response to the access control processing. The access control information includes security group information and an address of a network node. The security group information identifies a security group. The network node is a member of the security group and is a destination of the packet.