Micro-segmentation Policy Generation via Flow Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deploying micro-segmentation in datacenters is challenging due to the complexity of intra-application communications and the lack of documentation, making it difficult for security teams to create granular access control rules without understanding all communication flows between application components.
Innovation Solution
A multistep flow monitoring and analysis method that identifies and analyzes packet flows to create micro-segmentation policies, using deep packet inspection and application templates to define security policies for both new and existing applications, enabling granular control within the datacenter.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If micro-segmentation policies are created manually by security administrators, then security control precision is improved, but the time and complexity required to identify all intra-application communications increases significantly
Solution Approach 1:
The system performs preliminary flow monitoring and analysis to automatically discover intra-application communications before policies need to be created. By proactively collecting and analyzing packet flows during a monitoring period, the system prepares the necessary communication data in advance, eliminating the time-consuming manual identification process while maintaining precise security control.
Solution Approach 2:
The system enables self-service by automatically generating micro-segmentation policies through flow analysis without requiring security administrators to manually identify all communications. The automated policy generation engine analyzes collected flows and creates appropriate security policies, reducing both time and human effort while maintaining precision through systematic analysis.
2Loss of information
If flow monitoring is performed on all VMs in the datacenter, then complete visibility of intra-application communications is achieved, but the complexity and resource consumption of the monitoring system increases
Solution Approach 1:
The system segments the monitoring approach by first identifying seed VMs that constitute specific applications, then monitoring flows only for those targeted applications. This selective segmentation provides sufficient visibility into intra-application communications without the need to monitor all VMs in the datacenter, thereby reducing system complexity and resource consumption while maintaining effective visibility.
Solution Approach 2:
The system applies local quality by tailoring the monitoring scope to specific applications and their communication patterns rather than uniformly monitoring all VMs. By focusing monitoring resources on relevant application flows and using application templates to guide analysis, the system achieves complete visibility where needed while minimizing unnecessary monitoring elsewhere, reducing overall complexity.
3Measurement precision
If deep packet inspection is used to identify application traffic, then accuracy of application identification is improved, but the processing time and computational resources required increase
Solution Approach 1:
The system applies partial action by performing deep packet inspection selectively on packet flows that are already filtered and identified as relevant to specific applications. Rather than applying DPI to all traffic, the system first narrows down to application-specific flows using less intensive methods, then applies DPI only where needed to achieve accurate identification without excessive processing overhead.
Solution Approach 2:
The system performs preliminary filtering and classification of packet flows before applying deep packet inspection. By pre-identifying application traffic through less resource-intensive methods and only then applying DPI to confirm and refine identification, the system achieves high accuracy while minimizing the computational burden and maintaining productive policy creation speeds.
4Measurement precision
If granular access control rules are created for each application component, then security granularity is improved, but the number of rules and administrative overhead increase significantly
Solution Approach 1:
The system merges multiple granular access control requirements into unified security policies by analyzing communication patterns and grouping related flows. Instead of creating separate rules for each individual communication, the system consolidates them into broader policy statements that maintain the necessary granularity for security while reducing the total number of rules and simplifying administration.
Solution Approach 2:
The system creates universal security policies that can apply to multiple application components and communication patterns simultaneously. By designing policies with multi-functionality that cover various scenarios within a single rule set, the system maintains granular security control where needed while avoiding the proliferation of numerous individual rules, thereby reducing administrative overhead.
Data Source
AI summary
A method of creating micro-segmentation policy for a network is provided. The method monitors the network packet traffic to identify network traffic types and patterns. The method, based on the network traffic types and patterns, identifies a set of components as an affinity group associated with each application. The method generates an application template that includes a set of application components for each application based on information provided by the vendor of the application. The method creates micro-segmentation policy for the network based on a mapping of the components of each affinity group into the components of the template generated for the associated application.