Tunnel-Based Network Segmentation for Flexible Switch Port Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network segmentation technologies require physical switches to be configured with virtual local area networks (VLANs) on specific ports, limiting flexibility and efficiency in device placement.
Innovation Solution
Establishing tunnels between network devices and switch ports using GRE or VXLAN, facilitating security operations like authentication, and performing network segmentation based on the results, allowing devices to be plugged into any port without specific configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VLANs are configured on physical ports of a physical switch, then network segmentation can be achieved, but device placement flexibility is reduced and port configuration restrictions increase
Solution Approach 1:
The patent introduces a tunnel (GRE or VXLAN) as an intermediary between the physical switch port and the network device. The tunnel encapsulates traffic and carries VLAN tags, allowing the physical switch to forward frames without port-based VLAN configuration while maintaining network segmentation through the tunnel endpoint that performs authentication and segment assignment.
2Reliability
If VLANs are configured on physical ports, then network segmentation is established, but deployment complexity and configuration mistakes increase
Solution Approach 1:
The system enables self-service network segmentation where the network device automatically performs authentication (e.g., 802.1X), receives segment assignment from the authentication server, and configures its own VLAN membership. This eliminates the need for manual port configuration and reduces deployment complexity while maintaining reliable segmentation.
Solution Approach 2:
The patent implements preliminary authentication and segment assignment before the device is fully integrated into the network. The authentication server pre-determines the appropriate network segment based on device credentials, and the tunnel is established with the correct VLAN configuration before data traffic flows, preventing configuration errors.
3Reliability
If port-based VLAN configuration is used, then network segmentation works, but security operations become less flexible
Solution Approach 1:
The patent implements dynamic network segmentation where VLAN assignment is not static but changes based on authentication results and security policies. The system can dynamically assign devices to different segments, update segment memberships, and adjust security policies in real-time based on device identity, behavior, and security requirements, providing flexible security operations.
Data Source
AI summary
Embodiments of a device and method are disclosed. In an embodiment, a method for network segmentation of a network deployed at a customer site involves establishing a tunnel between a network device of the network deployed at the customer site and a network port of a switch of the network deployed at the customer site, when a wired device is plugged into the network port of the switch, transmitting network traffic between the wired device and the network device through the tunnel, facilitating a security operation regarding the wired device, and based on a result of the security operation, performing a network segmentation operation regarding the wired device.