Trunk Port Promotion for PVLAN Isolation in MAC-Based VLANs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network environments struggle to implement Private VLANs (PVLANs) on trunk ports of network devices, which are typically used for multiple VLAN assignments, necessitating a solution to enhance security and manageability.
Innovation Solution
Network devices are configured to promote trunk ports to behave as access ports, supporting PVLANs by associating them with multiple VLANs based on dynamic or static configuration changes, leveraging MAC-based VLAN assignment (MBVA) and 802.1X authentication to enforce granular access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If trunk ports are used for multiple VLAN assignments, then network versatility and traffic management are improved, but Private VLAN implementation and security isolation are lost
Solution Approach 1:
The patent segments the trunk port functionality by introducing a promotion mechanism that divides VLAN handling into two distinct modes: traditional trunk mode for general VLAN assignments and promoted access mode for PVLAN implementations. This segmentation allows the same physical port to support both multi-VLAN versatility and PVLAN security isolation by activating the appropriate mode based on configuration requirements.
Solution Approach 2:
The patent inverts the traditional port role assignment by allowing trunk ports to be promoted to behave as access ports when PVLAN functionality is required. This inversion enables the port to enforce strict access control and security isolation while still maintaining the underlying capability for multiple VLAN assignments, thus resolving the contradiction between versatility and security.
2Reliability
If PVLANs are implemented on trunk ports, then security and segmentation are improved, but port configuration complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring PVLAN membership relationships and defining promotion criteria before the actual port promotion occurs. The system prepares the PVLAN structure in advance, so when a trunk port needs PVLAN functionality, the promotion can be executed smoothly with all necessary configurations already in place, reducing the perceived complexity for users.
Solution Approach 2:
The patent enables self-service through automated port promotion based on predefined conditions and configurations. When a trunk port meets the criteria for PVLAN implementation, the system can automatically promote it without requiring manual reconfiguration of each parameter, thereby reducing configuration complexity while maintaining security isolation.
3Ease of operation
If dynamic VLAN assignment is used, then network manageability and security are improved, but authentication overhead and processing time increase
Solution Approach 1:
The patent reduces authentication overhead by performing preliminary actions: pre-establishing VLAN-to-PVLAN mappings and pre-configuring promotion rules before dynamic VLAN assignment occurs. When a device authenticates and receives a VLAN assignment, the system can quickly determine PVLAN membership and port promotion status using pre-computed information, significantly reducing processing time while maintaining security.
Solution Approach 2:
The patent optimizes the dynamic VLAN assignment process by making the port promotion status dynamic rather than static. The promotion state can change based on real-time conditions such as VLAN assignment, traffic patterns, and security requirements. This dynamic approach allows the system to balance authentication overhead with security needs, promoting ports only when necessary rather than maintaining a fixed promotion state.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Network devices and methods for their operation are disclosed whereby embodiments may allow a trunk port on the network device to behave as an access port with respect to conforming with the standards of Virtual Local Area Networks (VLANs), including Private VLANs (PVLANs). In this manner PVLANs can be supported on ports that are associated with multiple untagged VLANs, such as when using Media Access Control (MAC) based VLAN assignment (MBVA) with those ports.