Policy Enforcement on Multi-Destination Packets in Distributed Tunnel Fabric
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication networks face challenges in enforcing access policies on multi-destination packets received from tunnels, as they lack efficient methods to determine the appropriate destination roles for forwarding such packets, leading to difficulties in managing and enforcing group-based policies across distributed tunnel fabrics.
Innovation Solution
A system that synthesizes policies to indicate the set of destination roles allowed to receive traffic from a source role, generates filter identifiers for these roles, and associates ports with these identifiers to determine the correct forwarding paths for multi-destination packets, enabling efficient policy enforcement in distributed tunnel fabrics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional policy enforcement methods are used on multi-destination packets in distributed tunnel fabrics, then policy management becomes complex and inefficient, but the system lacks the capability to effectively determine destination roles for forwarding packets
Solution Approach 1:
The system performs preliminary synthesis of policies at the ingress tunnel endpoint before packets are forwarded through the distributed tunnel fabric. By pre-determining the set of destination roles allowed to receive traffic from a source role and generating filter identifiers in advance, the system eliminates the need for complex real-time policy evaluation at intermediate switches, thereby improving policy enforcement efficiency while maintaining manageable complexity
Solution Approach 2:
The invention introduces filter identifiers as intermediary elements that mediate between synthesized policies and packet forwarding decisions. These filter identifiers represent sets of destination roles and enable switches to enforce policies through simple identifier matching rather than complex policy evaluation, resolving the contradiction between operational efficiency and management complexity
2Measurement precision
If the system synthesizes policies and generates filter identifiers for all possible destination roles, then policy enforcement accuracy improves, but the computational overhead and memory requirements increase
Solution Approach 1:
The system merges multiple destination roles into consolidated sets represented by single filter identifiers. Instead of maintaining separate policy entries for each individual destination role, the synthesis process combines roles that share common forwarding requirements into unified filter identifier groups, thereby maintaining precise destination role identification while reducing the overall volume of policy data that must be stored and processed
Solution Approach 2:
Filter identifiers serve multiple functions simultaneously: they represent sets of destination roles, enable policy enforcement decisions, and facilitate efficient packet forwarding. This multi-functionality allows the system to achieve high identification accuracy using a compact data structure, as each filter identifier encapsulates multiple roles and their associated forwarding rules in a single reusable element
Data Source
AI summary
A system for policy management in a switch is provided. During operation, the system can generate, from a first policy defined for the switch, a second policy. The first policy can indicate whether a type of traffic is allowed from a source role to a destination role via an overlay tunnel. The second policy can indicate a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel. Upon identifying a host associated with a role at a port of the switch, the system can determine whether the role belongs to the plurality of destination roles based on the second policy. If the role belongs to the plurality of allowed destination roles, the system can allow the port to forward a multi-destination packet, which is received via the overlay tunnel and associated with the type of traffic.