SD-WAN Context Sharing for Cloud Security Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SD-WAN technologies fail to extend complex segmentation and micro-segmentation from SD-WAN domains to cloud environments, leading to inconsistent security policies and loss of contextual information when packets exit the SD-WAN fabric, and lack of efficient methods to share and enforce per-packet metadata across different security service edge (SSE) providers.
Innovation Solution
Implementing a secure application programming interface (API) to pull VPN and SGT context from the SD-WAN controller, using TLV metadata in standard IPsec and GRE packets to transmit contextual data to cloud security providers, enabling consistent policy definition and enforcement across SD-WAN and SSE domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SD-WAN uses centralized controller architecture for control and data plane separation, then scalability and single pane of glass management are improved, but complex segmentation and micro-segmentation cannot be extended to cloud security provider environments
Solution Approach 1:
The patent introduces a cloud security provider (CSP) as an intermediary between SD-WAN domains and cloud security provider environments. The CSP receives contextual data from the SD-WAN controller via a secure API and enforces security policies in the cloud environment, thereby extending segmentation capabilities across domain boundaries without losing contextual information.
Solution Approach 2:
The patent extends security policy enforcement from the traditional SD-WAN control plane to a new dimension - the cloud security provider environment. By projecting SD-WAN contextual data (VPN identifiers, SGTs) into the cloud security domain through a secure API, the system maintains segmentation consistency across multiple dimensional spaces (SD-WAN domain and cloud security domain).
2Adaptability or versatility
If location and sub-location concepts are used for security policies, then some degree of segmentation is achieved, but micro-segmentation is less useful in datacenters of SIG/SSE providers
Solution Approach 1:
The patent makes security group tags (SGTs) universal across both SD-WAN and cloud security provider environments. SGTs, which provide fine-grained micro-segmentation in SD-WAN, are preserved and enforced in the cloud security domain through the secure API integration. This allows a single tagging mechanism to serve multiple functions across different network domains without increasing policy complexity.
3Reliability
If contextual data is not shared with cloud security provider, then security policies are inconsistent across domains, but sharing contextual data requires efficient methods for metadata transmission
Solution Approach 1:
The patent performs preliminary actions by collecting and preparing contextual data (VPN identifiers, SGTs) at the SD-WAN controller before transmission to the cloud security provider. The controller pre-processes and structures this data in a format suitable for cloud security policy enforcement, ensuring consistency is established before data leaves the SD-WAN domain.
Solution Approach 2:
The patent replaces complex manual configuration mechanisms with an automated secure API-based data sharing system. The secure API automatically transmits contextual data from the SD-WAN controller to the cloud security provider, eliminating the need for manual policy synchronization and reducing the complexity of inter-domain data sharing while ensuring consistency.
Data Source
AI summary
The present technology provides solutions for enabling software-defined wide area network (SD-WAN) policies on a cloud security provider. An example method includes collecting, by a SD-WAN controller, contextual data associated with at least one user account of a SD-WAN, wherein the contextual data includes at least one of a virtual private network (VPN) identifier or a security group tag; and transmitting, by the SD-WAN controller, the contextual data over a secure application programming interface to a cloud security engine of a cloud network for enforcement of security policies on the cloud network based on the contextual data. Systems and computer-readable media are also provided.