Static IP Assignment for Edge Security Traffic Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamically changing IP addresses of user devices in wireless communication networks complicate the routing of traffic for edge-based security services like SASE, making it difficult to enforce security policies in real-time.
Innovation Solution
Assigning static IP addresses to user devices through a control plane authentication process, mapping subscriber IDs to these addresses, and providing them to edge-based security services for secure data sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic IP address assignment is used for user devices in wireless networks, then network flexibility and resource utilization are improved, but edge-based security services cannot effectively route traffic and enforce security policies in real-time
Solution Approach 1:
The system performs preliminary action by assigning static IP addresses to user devices before they access edge-based security services. The control plane authenticates the device and assigns a static IP address in advance, which is then provided to the edge-based security service. This preliminary assignment ensures that when the device connects, the security service already has a consistent address to route traffic to, enabling real-time security policy enforcement without waiting for dynamic address allocation.
Solution Approach 2:
The patent introduces an intermediary mechanism - a mapping between subscriber ID and static IP address - that bridges the authentication system and the edge-based security service. The control plane acts as an intermediary that authenticates the device, assigns the static IP, and communicates it to the security service. This intermediary layer ensures that the security service receives reliable addressing information without being directly involved in the dynamic address allocation process.
2Reliability
If static IP addresses are assigned to user devices, then edge-based security services can effectively route traffic and enforce security policies, but network flexibility and dynamic resource allocation are reduced
Solution Approach 1:
The system applies local quality by providing static IP addresses selectively - only to devices that require edge-based security services - rather than assigning static addresses to all devices in the network. The control plane determines which devices qualify for static IP assignment based on their service requirements. This localized application of static addressing maintains network flexibility for devices that don't need edge security while ensuring reliable addressing for those that do.
3Productivity
If dynamic IP addresses are used, then IP addresses can be reused and allocated efficiently, but consistent device identification for security services becomes difficult
Solution Approach 1:
The system performs preliminary action by assigning static IP addresses to devices before they access edge-based security services. The control plane authenticates the device and assigns a static IP address in advance, which is then provided to the edge-based security service. This preliminary assignment ensures that when the device connects, the security service already has a consistent address to route traffic to, enabling real-time security policy enforcement without waiting for dynamic address allocation.
Data Source
AI summary
Various embodiments include a wireless communication network that comprises a network controller, an authentication server, and a user plane. The network controller authenticates a subscriber Identifier (ID) for a user device received in a registration request. In response to authentication, the network controller detects that the user device qualifies for an edge-based security service and static Internet Protocol (IP) address assignment. The authentication server maps the subscriber ID for the user device to a static IP address and assigns the static IP address to the device. The user plane provides the static IP address and the subscriber ID to the edge-based security service. The user plane exchanges user data with the user device and with the edge-based security service. The edge-based security service enforces security policies for the data session of the user device on the communication network.