SD-WAN Policy Mapping for Tagged Cloud Workloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to apply security policies to cloud workloads at a granular level, leading to imprecise security measures, increased data loss, and latency in policy enforcement when new workloads are instantiated.
Innovation Solution
A system that associates cloud workloads with customizable tag attributes, using SD-WAN controllers to propagate security policies based on these tags, ensuring precise policy enforcement through edge routers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security policies are applied to cloud workloads using traditional methods (IP addresses, subnets, ports), then security coverage is achieved, but granularity and precision of security control deteriorates
Solution Approach 1:
The patent segments cloud workloads into granular units by associating them with specific tag attributes (e.g., workload type, department, environment). This allows security policies to be applied to individual workloads or groups of workloads based on their tags, rather than broad IP address ranges, thereby improving precision without proportionally increasing complexity.
Solution Approach 2:
The patent introduces tag attributes as an intermediary layer between cloud workloads and security policies. These tags serve as a common language that both the cloud workload management system and the SD-WAN security system can understand and act upon, simplifying the mapping process and improving policy application precision.
2Reliability
If security policies are manually configured for each cloud workload, then policy precision is improved, but policy enforcement time and operational overhead increases
Solution Approach 1:
The patent implements preliminary action by pre-configuring security policies in the SD-WAN controller based on tag attributes before cloud workloads are instantiated. When new workloads are created with specific tags, the corresponding security policies are automatically applied without manual intervention, eliminating policy enforcement latency while maintaining precision.
Solution Approach 2:
The patent establishes a feedback mechanism where the SD-WAN controller continuously monitors cloud workload tag attributes and automatically updates security policy enforcement accordingly. This real-time feedback loop ensures that security policies remain synchronized with the actual state of cloud workloads, maintaining reliability without requiring manual reconfiguration.
3Adaptability or versatility
If traditional security policies are applied to cloud workloads, then basic security coverage is achieved, but granular security control and adaptability deteriorates
Solution Approach 1:
The patent makes tag attributes universal by designing them to serve multiple functions: workload identification, security policy selection, and SD-WAN routing decisions. This multi-functionality allows a single tagging system to provide granular security control across diverse cloud workloads without requiring separate management mechanisms for each function, thereby improving adaptability while controlling complexity.
Data Source
AI summary
Methods and systems are described herein for dynamically applying a security policy based on one or more tag attributes. The method comprises receiving, at a network controller, information about an instance of a cloud workload instantiated at a cloud provider. The cloud workload is associated with a tag attribute. The method further comprises querying the cloud provider for at least one IP address associated with the tag attribute and learning the at least one IP address associated with the tag attribute, including the IP address for the instance of the cloud workload. The method further comprises associating a security policy with the at least one IP address associated with the tag attribute and propagating the security policy to at least one edge router for implementation.