Overlay Network Access Control via Identity Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network infrastructure lacks effective access control mechanisms in virtualized environments, particularly in overlay networks, which are vulnerable to security risks such as ARP cache poisoning and fail to enforce identity and access management policies, leading to potential unauthorized connections and data breaches.
Innovation Solution
Implementing an access control service within the encapsulation layer of overlay networks that uses identity and access management to evaluate policies associated with resource instances, determining whether connections are allowed based on the identities and roles of entities, thereby providing secure and isolated communication paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtualization technologies are used to share computing resources among multiple clients, then resource utilization efficiency is improved, but security risks increase due to lack of access control mechanisms
Solution Approach 1:
The patent introduces an access control service as an intermediary component between virtual machine instances and network communication. This service evaluates policies and determines whether connections are allowed, acting as a mediator that enables secure resource sharing while preventing unauthorized access. The access control service receives connection requests, evaluates them against defined policies, and selectively permits or blocks communications, thus resolving the security risks introduced by virtualization.
2Adaptability or versatility
If overlay networks are implemented for virtual private networking, then network flexibility and isolation are improved, but vulnerability to security attacks such as ARP cache poisoning increases
Solution Approach 1:
The patent implements preliminary security evaluation by the access control service before allowing network communications to proceed. Policies are defined and evaluated in advance, and the access control service performs preliminary checks on connection requests against these pre-defined policies. This preliminary action prevents unauthorized communications and security attacks like ARP cache poisoning before they can compromise the overlay network, while maintaining the network's flexibility and isolation properties.
3Device complexity
If traditional network infrastructure is used without access control services, then system simplicity is maintained, but unauthorized connections and data breaches cannot be prevented
Solution Approach 1:
The access control service implements self-service mechanisms by automatically evaluating policies and making access decisions without requiring manual intervention. The service autonomously receives connection requests, evaluates them against defined policies, and enforces access control decisions. This self-service capability provides reliable protection against unauthorized access while maintaining relative system simplicity, as the service operates automatically without complex manual configuration or intervention for each access decision.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and apparatus for providing identity and access management-based access control for connections between entities in virtual (overlay) network environments. At the encapsulation layer of the overlay network, an out-of-band connection creation process may be leveraged to enforce access control and thus allow or deny overlay network connections between sources and targets according to policies. For example, resources may be given identities, identified resources may assume roles, and policies may be defined for the roles that include permissions regarding establishing connections to other resources. When a given resource (the source) attempts to establish a connection to another resource (the target), role(s) may be determined, policies for the role(s) may be identified, and permission(s) checked to determine if a connection from the source to the target over the overlay network is to be allowed or denied.