Network Policy Abstraction via Device Configuration Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network policies are not effectively applied to devices as they move between ports, leading to mismatches and failures in policy enforcement due to manual assignment and lack of automation in tracking device connections.
Innovation Solution
A network element detects attached devices, determines their configuration characteristics, and generates a device configuration signature to dynamically apply a port-based network policy, ensuring policies follow the device regardless of port changes, either due to re-cabling or virtual machine migration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual policy binding to ports is used, then policy configuration is simple, but policy enforcement fails when devices move between ports
Solution Approach 1:
The system automatically detects devices on ports, determines device configuration signatures, and applies appropriate policies without manual intervention. The network element performs self-configuration by monitoring port connections and autonomously binding policies to devices based on their identifiers, eliminating the need for manual policy binding while maintaining reliability.
Solution Approach 2:
The system continuously monitors port connections and device identifiers, using this feedback to dynamically update policy bindings. When a device moves between ports, the system detects the change and automatically adjusts the policy application, ensuring continuous reliable enforcement without manual reconfiguration.
2Adaptability or versatility
If manual port-to-policy binding is used, then configuration is straightforward, but policies do not follow migrating devices
Solution Approach 1:
The system transitions from static port-to-policy binding to dynamic device-to-policy binding. Policies are associated with device identifiers rather than fixed ports, allowing automatic adaptation when devices migrate. The system dynamically updates policy bindings based on real-time device detection and port assignment.
Solution Approach 2:
The system introduces a device configuration signature as an intermediary between the device and the policy. This signature serves as a portable identifier that travels with the device across different ports and network elements, enabling automatic policy following without requiring direct manual configuration at each location.
3Manufacturing precision
If policies are bound to specific ports, then initial setup is simple, but errors occur when devices connect to wrong ports
Solution Approach 1:
The system replaces manual mechanical policy binding operations with automated software-based device identification and signature matching. Instead of manually configuring each port, the system uses automatic device detection, configuration signature generation, and algorithmic policy selection to achieve precise device-policy matching.
Solution Approach 2:
The system changes the binding parameter from static port identifiers to dynamic device configuration signatures. This parameter transformation enables accurate device identification and policy matching regardless of physical port location, improving matching accuracy while enabling automated operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and apparatus of a device that determines a network policy for an attached device based on one or more characteristics of the attached device is described. In one example, a network element detects a device on a port coupled to a link connecting the network element and the device. In response to the detecting of the device on the port, the network element further determines a device configuration signature from the device, where the device configuration signature based on a configuration of the device. The network element additionally determines a port-based network policy based on the device configuration signature. The network element applies the port-based network policy to the port, wherein the network element applies the port-based network policy to process network data communicated through the port.