Packet Handler Attribute Discovery for Micro-Segmented Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In micro-segmented network environments, users may overlook or be unaware of additional attributes in network packet traffic, leading to misidentification and mishandling of packets due to incomplete attribute definitions.
Innovation Solution
A method and system that process network packet traffic to identify and add additional attributes, which may not be initially known or provided by the user, to enhance the definition of packet handling policies, thereby reducing misidentification and mishandling by deep packet inspection and user selection of additional attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users define attributes for packet traffic manually, then the system is easy to operate, but the measurement precision of packet identification deteriorates due to overlooked or unknown attributes
Solution Approach 1:
The system automatically performs deep packet inspection to discover additional attributes that are not manually defined by users. The packet handler inspects packet payloads and extracts relevant attributes (such as application layer information) automatically, allowing the system to self-enhance its attribute set without requiring complete manual specification by users.
Solution Approach 2:
The system implements a feedback mechanism where packet inspection results are used to identify additional attributes that should be added to the policy definition. The packet handler continuously monitors packet traffic, discovers new attributes, and provides this information back to the policy enforcement mechanism, improving identification accuracy over time based on observed traffic patterns.
2Measurement precision
If deep packet inspection is performed to discover additional attributes, then the measurement precision of packet identification improves, but the processing time and device complexity increase
Solution Approach 1:
The system performs deep packet inspection selectively rather than on all packets uniformly. It focuses inspection efforts on packets where additional attribute discovery is most beneficial, such as when initial attribute matching is inconclusive or when policy decisions require more granular classification. This partial application of DPI reduces overall processing complexity while maintaining high identification accuracy where needed.
3Measurement precision
If more attributes are inspected in packet payloads, then the accuracy of packet identification improves, but the processing speed deteriorates
Solution Approach 1:
The packet processing system is segmented into multiple stages: initial fast filtering using readily available header attributes, followed by selective deep inspection of packet payloads for additional attributes, and finally policy decision-making. This segmentation allows most packets to be processed quickly using superficial attributes, while only specific packets requiring higher accuracy undergo the more time-consuming payload inspection process.
Data Source
AI summary
The technology disclosed herein enables the enhancement of attributes used to identify network packet traffic exchanged with micro segmented guests. In a particular embodiment, a method provides receiving a plurality of attributes from a user. The plurality of attributes describes first network packet traffic that should be handled in a first manner. The method further provides processing network packet traffic to identify the first network packet traffic using the plurality of attributes. While processing the network packet traffic, the method provides identifying one or more additional attributes shared among the first network packet traffic and adding at least a portion of the one or more additional attributes to the plurality of attributes.