Network Address Role Mapping for Scalable Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for assigning roles to compute entities in a network environment, particularly for virtual entities and services, are inefficient and resource-intensive, especially when using Ternary Content-Addressable Memory (TCAM) resources, and do not scale well with growing groups of compute entities.
Innovation Solution
A controller in the control plane determines roles of compute entities based on Internet Protocol (IP) addresses using a role identification data structure that maps aggregations of IP addresses to respective roles, programming this information into network address mapping tables like MAC and ARP tables for use in the data plane to enforce group-based policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TCAM resources are used to map roles to IP addresses, then role identification accuracy is improved, but resource consumption and cost increase
Solution Approach 1:
The patent extracts the role mapping function from TCAM resources and implements it using standard forwarding table structures (FIB, ARP, MAC address tables) that are already present in network devices. This removes the dependency on expensive TCAM resources while maintaining role identification capability.
Solution Approach 2:
The patent creates role mapping information as a copy of existing forwarding table entries by adding role identifiers to standard network address mapping tables. This allows role identification to be performed using replicated data structures rather than requiring dedicated TCAM resources.
2Manufacturing precision
If manual role assignment is performed for each compute entity, then role assignment precision is improved, but administrative complexity and time consumption increase
Solution Approach 1:
The patent performs preliminary role mapping by pre-configuring role identifiers in the forwarding information base and address resolution tables during network setup. This preliminary action enables automated role determination later without requiring manual intervention for each compute entity.
Solution Approach 2:
The system enables self-service role assignment by automatically determining roles based on IP address matching against pre-configured role mapping tables. The network device autonomously performs role identification without administrator intervention, reducing administrative time while maintaining precision.
3Device complexity
If role mapping information is stored in traditional forwarding tables, then device complexity is reduced, but role identification speed decreases
Solution Approach 1:
The patent merges role mapping information with existing forwarding table structures (FIB, ARP, MAC address tables) that are already optimized for high-speed lookup. By combining role identification data with standard networking data structures, the system maintains simplicity while leveraging existing hardware optimization for fast access.
Data Source
AI summary
In some examples, a controller obtains an Internet Protocol (IP) address of a compute entity that is to communicate over a network, and determines a role for the compute entity by accessing, using the obtained IP address, a role mapping data structure that maps IP addresses to roles. The controller adds the determined role to network address mapping information in the network, the network address mapping information including entries having respective network addresses, the determined role in the network address mapping information for use by a network device of the network in applying policy enforcement for traffic through the network device.