Public Cloud Communication Graph Analytics for Micro-Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing platforms face challenges in securing and optimizing network communications due to a lack of comprehensive communication visibility within subscriptions, which is essential for securing the internal network and preventing breaches.
Innovation Solution
A communication analytics system that utilizes programmable network interface cards (NICs) to record connection summaries, generating dynamic communication graphs to enable micro-segmentation, principal component analysis, and counterfactual analysis, providing detailed insights into network communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive monitoring of network communications is implemented within cloud subscriptions, then network security and communication visibility are improved, but resource cost and performance are adversely impacted
Solution Approach 1:
The patent divides the cloud subscription into micro-segments based on communication patterns, allowing selective monitoring and security policies to be applied to specific resource groups rather than entire subscriptions. This segmentation enables comprehensive security coverage while reducing overall monitoring overhead by focusing only on relevant communication flows.
Solution Approach 2:
The patent introduces an intermediary communication analytics system that sits between the monitored resources and the security analysis layer. This intermediary aggregates and processes communication data, providing comprehensive visibility without requiring direct intervention in resource operations, thereby minimizing performance impact while maintaining security monitoring.
2Loss of information
If comprehensive monitoring of network communications is implemented within cloud subscriptions, then communication visibility is improved, but resource performance is adversely impacted
Solution Approach 1:
The patent implements monitoring at the appropriate level of detail - collecting connection summary information (source/destination addresses, ports, protocols) without capturing every packet payload. This partial action provides sufficient communication visibility for security analysis while avoiding the performance overhead of deep packet inspection on all traffic.
Solution Approach 2:
The patent performs preliminary aggregation of communication data at the network interface level before data reaches the analytics system. Connection summaries are pre-processed and filtered, providing comprehensive visibility information in advance while reducing the computational burden on downstream analysis resources.
3Measurement precision
If detailed connection information is collected for all connections, then communication analysis capability is improved, but data processing complexity is worsened
Solution Approach 1:
The patent extracts only the essential connection summary information (local address, remote address, data information) from full network traffic, discarding redundant data such as packet payloads and protocol-specific details that are not needed for high-level communication analysis. This extraction maintains analytical capability while significantly reducing data processing complexity.
Solution Approach 2:
The patent transforms raw network traffic data into standardized connection summary parameters with consistent structure and format. By changing the data representation from complex packet streams to simplified connection records with fixed parameters, the system achieves precise communication analysis with reduced processing complexity.
Data Source
AI summary
Securing and optimizing communications for a cloud service provider includes collecting connection summary information at network interface devices associated with host computing devices for a group of resources allocated to a customer of the cloud computing environment. The connection summary information includes local address information, remote address information, and data information, each connection established via the network interface devices. At least one communication graph is generated for the group of resources using the connection summary information. The graph includes nodes that represent communication resources of the group of resources and edges extending between nodes that characterize communication between the nodes. At least one analytics process is performed on data from the graph to identify at least one of a micro-segmentation strategy, a communication pattern, and a flow prediction for the group of resources.