Tag-Based Group Policy for Non-VXLAN Network Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques fail to provide micro-segmentation and macro-segmentation in non-VXLAN deployments, consuming computing and networking resources, and are unable to handle security threats from unknown packets effectively.
Innovation Solution
A network device receives tags assigned to host devices, generates filters based on these tags, and propagates policies to other network devices, enabling micro-segmentation and macro-segmentation while dropping unknown flows at the network ingress.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If current techniques are used in non-VXLAN deployments, then network operations can proceed without additional complexity, but micro-segmentation and macro-segmentation cannot be achieved and computing resources are consumed inefficiently
Solution Approach 1:
The patent introduces VXLAN Network Identifiers (VNI) as an intermediary mechanism to enable group-based policy in non-VXLAN deployments. The VNI acts as a mediator that translates traditional VLAN tagging into a format compatible with VXLAN-based micro-segmentation, allowing policies to be enforced without requiring actual VXLAN infrastructure. This resolves the contradiction by providing segmentation capability through an intermediary layer rather than direct implementation.
Solution Approach 2:
The patent implements macro-segmentation by creating hierarchical policy groups that divide network traffic into broader categories, and micro-segmentation by creating more granular policy groups within those categories. This multi-level segmentation approach enables both types of segmentation simultaneously, resolving the contradiction between achieving segmentation and maintaining system simplicity.
2Reliability
If current techniques are used for handling unknown packets, then network traffic flows freely, but security threats from unknown packets cannot be effectively handled
Solution Approach 1:
The patent implements preliminary security actions by establishing default-deny policies that automatically drop unknown packets before they can cause security threats. The system pre-configures security rules that identify and drop packets from unrecognized sources or with unrecognized patterns, preventing potential security incidents before they occur. This resolves the contradiction by taking preliminary security measures that protect the network while maintaining throughput for legitimate traffic.
3Ease of manufacture
If traditional policy enforcement methods are used, then implementation is straightforward, but computing and networking resources are consumed excessively
Solution Approach 1:
The patent creates simplified copies of policy enforcement mechanisms that operate at the network layer rather than requiring deep packet inspection at each device. By copying and propagating policy rules through the network infrastructure using standardized protocols, the system reduces computing resource consumption at individual devices while maintaining comprehensive policy enforcement. This resolves the contradiction by using lightweight policy copies rather than resource-intensive local analysis.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A network device may receive, from a server device, a first tag assigned to a first host device, and may generate a first filter based on the first tag. The network device may receive a second filter generated based on a second tag assigned to a second host device, and may generate a policy based on the first filter and the second filter. The network device may propagate the first filter and the second filter to one or more other network devices, and may receive a packet. The network device may derive a source tag and a destination tag associated with the packet, and may determine an action for the packet based on the policy, the source tag, and the destination tag. The network device may perform the action.