Hardware Switch Security Policy Enforcement via Host Agents
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Software-Defined Networking (SDN) systems face challenges in integrating physical workloads with logical networks and applying consistent security policies, particularly due to the stateless nature of hardware switches which hinders efficient management of network data flows.
Innovation Solution
A method is introduced to apply security policies to managed hardware forwarding elements (MHFEs) by generating access control list (ACL) rules based on defined security policies and configuring these rules on MHFEs, along with managed software forwarding elements (MSFEs), to enforce security policies across physical and virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a stateful firewall mechanism is employed on a hardware switch, then network security can be improved, but it requires a large amount of cache memory which increases cost and complexity
Solution Approach 1:
The patent introduces a security agent as an intermediary component that runs on host machines rather than embedding stateful firewall functionality directly in the hardware switch. This mediator handles the stateful inspection requirements while allowing the hardware switch to remain stateless, thus improving network security without increasing switch complexity or cache memory requirements.
Solution Approach 2:
The security agent on each host machine independently performs stateful firewall functions for traffic involving that host. This self-service approach distributes the stateful inspection workload across multiple hosts rather than concentrating it in the hardware switch, eliminating the need for large cache memory in the switch while maintaining security.
2Reliability
If security policies are applied to physical machines through a centralized stateful firewall, then security enforcement is improved, but the hardware switch becomes more complex and costly
Solution Approach 1:
The patent segments the security enforcement function by deploying security agents on individual host machines rather than implementing a centralized stateful firewall in the hardware switch. Each security agent handles security policy enforcement for its local host, dividing the overall security function into distributed components that maintain policy enforcement while reducing hardware switch complexity.
Solution Approach 2:
Security agents act as intermediaries between the hardware switch and physical machines, translating and enforcing security policies at the host level. This intermediary layer enables effective security policy enforcement without requiring the hardware switch to implement complex stateful firewall mechanisms.
3Speed
If network data flows are tracked on a stateless hardware switch, then forwarding speed is maintained, but security management becomes difficult
Solution Approach 1:
The security agent serves as an intermediary that performs stateful inspection and tracking of network data flows on host machines. This allows the hardware switch to maintain its stateless, high-speed forwarding operation while the security agent handles the complex task of tracking and managing security-relevant flow state information.
Solution Approach 2:
The patent segments the network processing functions by keeping the high-speed stateless forwarding in the hardware switch while moving the stateful tracking and security management functions to software-based security agents on host machines. This segmentation allows each component to operate in its optimal mode without compromising the other.
Data Source
AI summary
Some embodiments provide a method for applying a security policy defined for a logical network to an MHFE that integrates physical workloads (e.g., physical machines connected to the MHFE) with the logical network. The method applies the security policy to the MHFE by generating a set of ACL rules based on the security policy's definition and configuring the MHFE to apply the ACL rules on the network traffic that is forwarded to and/or from the physical machines. In order to configure an MHFE to implement the different LFEs of a logical network, some embodiments propagate an open source database stored on the MHFE, using an open source protocol. Some embodiments propagate a particular table of the database such that each record of the table creates an association between a port of an LFE stored in a logical forwarding table and one or more ACL rules stored in an ACL table.