Switch Policy Engine for Network Security Bottleneck
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer network security systems lack efficient mechanisms to dynamically enforce high-level security policies across switches, leading to resource-intensive interventions for every communication, which can overwhelm distributed security processors and hinder optimized communication flows.
Innovation Solution
Implementing a system where a policy engine writes entries in a switch's forwarding table via an API to forward initial data packets to an enforcement point for security checks, configuring the table to allow or drop subsequent packets based on policy violations, thereby optimizing communication by reducing unnecessary interventions from the distributed security processor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed security processors intervene for every communication, then security policy enforcement is ensured, but resource consumption increases and network efficiency decreases
Solution Approach 1:
The patent introduces a switch with a policy engine as an intermediary between hosts and the distributed security processor. The switch's forwarding table is configured to intercept and forward packets to the security processor for policy evaluation. When policies are violated, the switch drops packets or forwards them to security functions without involving the distributed security processor, thus reducing its resource load while maintaining enforcement capability.
Solution Approach 2:
The system segments security enforcement into two layers: a first layer at the switch level using forwarding tables for high-level policy enforcement, and a second layer at the distributed security processor level for detailed rule evaluation. This segmentation allows the switch to handle routine enforcement locally, reducing the burden on the distributed security processor and improving overall network efficiency.
2Reliability
If distributed security processors handle all security checks, then comprehensive security monitoring is achieved, but resource load on security processors increases
Solution Approach 1:
The switch acts as an intermediary that performs preliminary security filtering before packets reach the distributed security processor. The policy engine in the switch evaluates high-level policies and only forwards packets that require detailed inspection to the security processor, significantly reducing its resource consumption while maintaining comprehensive monitoring capability.
Solution Approach 2:
The system performs preliminary security filtering at the switch level using forwarding tables configured by the policy engine. High-level policies are enforced before packets reach the distributed security processor, allowing the processor to focus only on packets that require detailed rule evaluation, thus reducing its resource load.
3Productivity
If switches forward all packets directly, then communication efficiency is maximized, but security policy enforcement is compromised
Solution Approach 1:
The switch's forwarding table is dynamically configured by the policy engine based on security policy evaluations. The forwarding entries are updated in real-time to reflect current security requirements, allowing the switch to efficiently forward approved packets while automatically redirecting or dropping packets that violate policies, thus maintaining both efficiency and security.
Solution Approach 2:
The policy engine continuously monitors network traffic and security policy compliance, using this feedback to dynamically update the switch's forwarding table. This feedback mechanism ensures that the switch can adapt its forwarding behavior to enforce security policies while maintaining optimal communication efficiency for approved traffic.
Data Source
AI summary
Some embodiments include methods comprising: writing entries in a forwarding table of a switch through an application programming interface (API) of the switch, such that first data packets from a first host and directed to a second host are forwarded by the switch to an enforcement point; receiving the first data packets; forwarding the first data packets to the enforcement point using the forwarding table; determining whether the first data packets violate a high-level security policy using a low-level rule set; configuring the forwarding table through the API such that second data packets are forwarded by the switch to the second host, in response to determining the first data packets do not violate the security policy; configuring the forwarding table through the API such that the second data packets are dropped or forwarded to a security function by the switch, in response to the determining.