Segmentation Policy Enforcement Allocation Between Hosts and Network Devices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional segmentation systems face inefficiencies in enforcing network communication policies due to limitations in resource allocation between host endpoints and network devices, leading to suboptimal use of memory, computing resources, and network bandwidth.

Innovation Solution

A segmentation server allocates management instructions for enforcing communication rules between workloads by determining the optimal enforcement location between host endpoints and network devices based on various allocation strategies, such as latency sensitivity, resource constraints, and rule types, to efficiently manage and enforce segmentation policies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If segmentation policy enforcement is distributed to host endpoints, then policy control flexibility is improved, but resource consumption on hosts increases

Engineering Contradiction:

Improvepolicy control flexibilityVSAvoidresource consumption on hosts

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

The patent divides segmentation policy enforcement into two segments: host-based enforcement agents that generate policy compliance information and network device enforcement points that apply segmentation rules. This segmentation allows flexible policy control at the host level while offloading resource-intensive enforcement to network devices, resolving the contradiction between policy flexibility and host resource consumption

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces network devices as intermediary enforcement points between hosts and network traffic. These intermediaries receive policy compliance information from hosts and handle the actual packet inspection and enforcement, reducing the resource burden on hosts while maintaining centralized policy control capabilities

Inventive Principle:

Principle #24Intermediary (Mediator)

2Use of energy by moving object

If segmentation policy enforcement is centralized on network devices, then resource efficiency on hosts is improved, but policy control flexibility deteriorates

Engineering Contradiction:

Improveresource efficiency on hostsVSAvoidpolicy control flexibility

Core Design Contradiction:

Use of energy by moving objectVSAdaptability or versatility

Solution Approach 1:

The patent enables hosts to self-report policy compliance information through enforcement agents that automatically generate and transmit compliance data to network devices. This self-service mechanism reduces the need for centralized host management while maintaining policy flexibility, as hosts autonomously provide the information needed for network-level enforcement decisions

Inventive Principle:

Principle #25Self-service

3Manufacturing precision

If all segmentation rules are enforced at host endpoints, then policy enforcement precision is improved, but network bandwidth utilization deteriorates

Engineering Contradiction:

Improvepolicy enforcement precisionVSAvoidnetwork bandwidth utilization

Core Design Contradiction:

Manufacturing precisionVSLoss of energy

Solution Approach 1:

The patent implements preliminary policy compliance verification at host endpoints before traffic enters the network. Enforcement agents pre-assess traffic against segmentation policies and only transmit compliance information for traffic that requires network-level enforcement. This preliminary action reduces network bandwidth consumption by eliminating redundant policy checks at network devices for already-compliant traffic

Inventive Principle:

Principle #10Preliminary action

4Productivity

If segmentation policy enforcement is distributed across multiple points, then resource utilization is improved, but system complexity increases

Engineering Contradiction:

Improveresource utilizationVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent designs network devices with multi-functional capabilities to handle both traditional networking tasks and segmentation policy enforcement. The same network infrastructure performs routing, switching, and security policy enforcement, reducing the need for separate enforcement hardware and simplifying the overall system architecture while maintaining distributed enforcement benefits

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10785115B2Allocating enforcement of a segmentation policy between host and network devices

Publication Date: 2020.09.22 ILLUMIO INC

AI summary

A segmentation server configures enforcement of a segmentation policy by allocating enforcement of management instructions between network devices and hosts. The segmentation policy comprises rules that control communications between workloads. For a particular workload, the segmentation server generates management instructions for controlling communications to and from the particular workload in accordance with the rules. The segmentation server determines an allocation of management instructions between enforcement on a host on which the particular workload executes and enforcement on a network device upstream from the workload. The segmentation server sends configuration information to at least one of the host and the network device in accordance with the allocation to enable enforcement of the management instructions.