Security Group Tag Assignment for Network Infrastructure Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network segmentation technologies face challenges in differentiating network infrastructure packets from client packets, leading to incorrect access privileges and tag loss in CPU-generated and CPU-reforwarded packets, which complicates dynamic segmentation and security control.
Innovation Solution
A reserved tag is used to identify infrastructure packets, and mechanisms are implemented to preserve tags in CPU-reforwarded packets, ensuring accurate access privileges and segmentation by updating MAC address tables and policy enforcement based on source roles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network segmentation is used to separate user traffic, then network isolation is improved, but infrastructure packets cannot be differentiated from client packets leading to incorrect access privileges
Solution Approach 1:
The patent applies local quality by assigning different security group tags to different packet types. Infrastructure packets are tagged with specific SGIDs (e.g., SGID 65534) while client packets receive different tags based on their source roles. This localized differentiation mechanism allows the system to maintain reliable network isolation while precisely identifying packet types for appropriate access privilege assignment.
Solution Approach 2:
The patent introduces security group tags as an intermediary mechanism between network segmentation and access control. These tags act as mediators that carry source role information through the network, enabling infrastructure packets to be differentiated from client packets without compromising network isolation. The tags are preserved through encapsulation and decapsulation processes, maintaining their differentiating function across network boundaries.
2Reliability
If security group tags are assigned to packets for access control, then security management is improved, but tags are lost in CPU-generated and CPU-reforwarded packets
Solution Approach 1:
The patent applies preliminary action by pre-assigning reserved security group tags to infrastructure packets before they are generated or reforwarded by the CPU. When the control plane generates infrastructure packets or reforwards snooped packets, the system proactively assigns appropriate SGIDs based on the packet type and source role, ensuring tags are present before any potential loss can occur. This preventive tagging mechanism maintains security management integrity throughout the packet lifecycle.
Solution Approach 2:
The patent implements feedback mechanisms where the control plane continuously monitors and updates security group tag assignments based on packet inspection results. When CPU-reforwarded packets are processed, the system inspects the packets, determines their source roles, and assigns appropriate security group tags based on this feedback information. This closed-loop approach ensures tags are correctly maintained and updated, preventing information loss while preserving access control reliability.
3Reliability
If dynamic segmentation is implemented with role-based policies, then network security is improved, but device complexity increases due to multiple encapsulation and decapsulation operations
Solution Approach 1:
The patent applies universality by designing a unified security group tag mechanism that handles multiple packet types and scenarios through a single framework. The same security group tag assignment and preservation logic applies to client packets, infrastructure packets, CPU-generated packets, and CPU-reforwarded packets. This universal approach simplifies the overall system architecture compared to implementing separate mechanisms for each packet type, reducing device complexity while maintaining robust network security through role-based policies.
Data Source
AI summary
The system determines a first source MAC associated with a switch. The system updates a MAC address table by mapping the first source MAC to a first tag which indicates a source role corresponding to a network infrastructure. A processor associated with the switch generates a first packet which indicates the first source MAC. The system performs a first search in the MAC address table based on the indicated first source MAC to obtain the first tag, and performs a second search in a policy table based on the first tag for a policy which indicates an action to be applied to the first packet. If the second search is not successful, the system modifies a header of the first packet by adding the first tag. If the second search is successful, the system determines that the indicated action comprises allowing the first packet and transmits the first packet.