Policy-Based Packet Inspection on SmartNICs and DPUs for Zero-Trust Workloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional perimeter-based security models are inadequate in modern networks due to the dispersion of data and access points beyond traditional boundaries, making it difficult to enforce effective security controls and allowing cyber threats to bypass defenses and move laterally within the network.
Innovation Solution
Implementing a transparent endpoint protection service using SmartNICs or DPUs with intercepting agents that perform policy-based deep packet inspection, injecting security policies from a control plane to enforce continuous verification and block malicious content at the network interface without user awareness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If perimeter-based security models are used, then network boundary protection is provided, but security controls cannot be effectively enforced when data and access points are dispersed beyond traditional network perimeter
Solution Approach 1:
The patent segments security enforcement from the traditional network perimeter and distributes it to individual endpoints and workloads. Each endpoint receives a tailored security policy from the security service, enabling security controls to be enforced locally at each segment rather than relying on a centralized perimeter defense that cannot protect dispersed resources.
2Measurement precision
If deep packet inspection is performed to detect malicious content, then security detection accuracy is improved, but network performance may deteriorate due to processing overhead
Solution Approach 1:
The patent introduces a security service as an intermediary between the network interface and the deep packet inspection process. The security service receives network traffic, applies security policies, and only subjects suspicious or policy-violating packets to deep packet inspection. This intermediary layer filters out benign traffic before it reaches the inspection engine, maintaining detection accuracy while reducing overall processing overhead.
3Reliability
If transparent endpoint protection service is implemented, then security verification is continuous and malicious content is blocked, but system complexity increases due to intercepting agents and policy management infrastructure
Solution Approach 1:
The patent implements self-service mechanisms where endpoints automatically receive and apply security policies from the security service without manual configuration. The intercepting agents are automatically deployed and configured based on the security policies received from the control plane, reducing the operational complexity of managing security across dispersed endpoints while maintaining continuous verification.
Data Source
AI summary
Disclosed are systems, apparatuses, methods, and computer-readable media for policy-based transparent packet inspection for last mile zero-trust workload protection. The method comprises receiving a packet on a network interface of a provisioned resource in a data center or a user device within a network; determining, by a first intercepting agent provisioned within the network interface, whether to inspect the packet based on rules received from a control plane of the network, wherein the network interface comprises a smart network interface card (SmartNIC) or a data processing unit (DPU) and is configured with the first intercepting agent based on the control plane; selectively invoking a deep packet inspection of the packet based on inspection of the packet by the first intercepting agent using the rules from the control plane; and blocking the packet at the network interface based on the deep packet inspection identifying malicious content within the packet.