Tag-Based Network Policy for Non-VXLAN Micro-Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques fail to provide micro-segmentation and macro-segmentation in non-VXLAN deployments, consuming computing and networking resources, and are unable to handle security threats from unknown packets effectively.
Innovation Solution
A network device receives and generates filters based on host device tags, propagates policies across network devices, and determines actions for packets based on source and destination tags, dropping unknown flows at the network ingress to conserve resources and ensure security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If group based policy is implemented in non-VXLAN deployments, then micro-segmentation and macro-segmentation are achieved, but computing and networking resources are consumed
Solution Approach 1:
The network device performs preliminary actions by receiving tags from host devices in advance, generating filters based on these tags before actual packet processing occurs. This allows the device to pre-establish policy rules and segmentations, so when packets arrive, the enforcement of micro-segmentation and macro-segmentation can proceed efficiently without consuming excessive computing resources at packet processing time.
Solution Approach 2:
The patent implements segmentation by dividing network traffic into different groups based on tags received from host devices. The network device generates filters that segment traffic flows according to these tags, enabling micro-segmentation (fine-grained traffic separation) and macro-segmentation (coarse-grained network division). This segmentation approach allows policies to be applied to specific traffic groups rather than processing all packets uniformly, reducing overall resource consumption.
2Productivity
If traditional packet handling is used, then all packets are processed through the network, but security threats from unknown packets cannot be handled effectively and resources are wasted
Solution Approach 1:
The network device performs preliminary filtering by generating filters based on tags received from host devices before unknown packets can cause security threats. These pre-generated filters enable the device to identify and drop unknown or malicious packets at the network ingress point, preventing them from consuming network bandwidth and processing resources throughout the network.
Solution Approach 2:
The patent extracts and removes harmful unknown packets from the network stream by using tag-based filters at the network device. Instead of allowing all packets to pass through traditional processing, the system extracts malicious or unknown packets based on tag mismatches or policy violations and drops them immediately, protecting the network from security threats while maintaining throughput for legitimate traffic.
3Reliability
If detailed packet inspection is performed to ensure security, then security is enhanced, but bandwidth and storage are consumed
Solution Approach 1:
The network device performs preliminary security checks by using tag-based filters to identify and drop unknown or malicious packets at the network ingress point, before these packets can consume bandwidth and storage resources throughout the network. This preliminary action ensures security without requiring detailed inspection of every packet that traverses the network.
Solution Approach 2:
Instead of performing detailed inspection on all packets, the patent applies partial action by using tag-based filtering to handle only the security-critical aspect of packet identification. The system performs just enough inspection (checking tags against filters) to ensure security, without excessive detailed analysis of packet contents, thereby maintaining security while conserving bandwidth and storage resources.
Data Source
AI summary
A network device may receive, from a server device, a first tag assigned to a first host device, and may generate a first filter based on the first tag. The network device may receive a second filter generated based on a second tag assigned to a second host device, and may generate a policy based on the first filter and the second filter. The network device may propagate the first filter and the second filter to one or more other network devices, and may receive a packet. The network device may derive a source tag and a destination tag associated with the packet, and may determine an action for the packet based on the policy, the source tag, and the destination tag. The network device may perform the action.