Tunneled Security Groups for Scalable Network Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control methods in networks, relying on Access Control Lists (ACLs), face scalability issues due to the need for frequent updates and increased processing costs as the number of users grows, especially with flexible network access technologies like VPNs, where static IP addresses limit the feasibility of relying on ACL-based solutions.
Innovation Solution
Implementing a tunneled security group (TSG) system that assigns a security group identifier (SGI) to packets, allowing classification and management without altering packet formats, and using tunnels to manage access control, reducing the need for frequent ACL updates and supporting larger numbers of security groups within existing network equipment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACL-based access control is used to manage network security, then access control functionality is provided, but processing cost and complexity increase quadratically with the number of users
Solution Approach 1:
The patent segments the network access control problem by introducing tunnel endpoints that create separate tunnel paths for different security groups. Instead of managing individual ACLs for each user, the system divides users into security groups and creates tunnel segments that aggregate traffic from multiple users, thereby reducing the quadratic growth of ACL complexity.
Solution Approach 2:
The patent introduces tunnel endpoints as intermediary devices between users and the core network. These endpoints perform local access control and traffic aggregation, acting as mediators that reduce the burden on core network ACLs. The tunnel endpoints translate individual user access requirements into consolidated tunnel-level control policies.
2Adaptability or versatility
If ACLs are updated frequently to accommodate flexible network access, then access control accuracy is maintained, but processing overhead increases significantly
Solution Approach 1:
The patent performs preliminary action by pre-establishing tunnel paths and configuring tunnel endpoints before users need access. Security group memberships and tunnel configurations are set up in advance, allowing the core network to maintain stable ACLs while the tunnel endpoints handle dynamic user access requirements through local policy enforcement.
Solution Approach 2:
The patent introduces dynamics by allowing tunnel endpoints to dynamically adjust local access policies based on user authentication and security group membership, while the core network maintains static tunnel-level ACLs. This dynamic adaptation at the edge combined with static core control resolves the conflict between flexibility and processing efficiency.
3Device complexity
If static IP address mapping is used in ACLs, then ACL implementation is simplified, but scalability is limited by the need for unique IP addresses
Solution Approach 1:
The patent extracts the IP address mapping function from the core network ACLs and relocates it to tunnel endpoints. Tunnel endpoints maintain local mappings between user IPs and security group identifiers, allowing the core network to use abstract security group identifiers in ACLs without requiring unique IP address tracking, thereby enabling scalability without increasing core network complexity.
Solution Approach 2:
The patent uses copying by creating virtual tunnel interfaces at tunnel endpoints that replicate the functionality of physical interfaces. These virtual interfaces carry security group identifiers and maintain local IP-to-group mappings, allowing multiple users to share the same tunnel resource while maintaining individual access control, thus enabling scalability without requiring proportional increases in core ACL entries.
4Reliability
If communication is required from ingress access point to each egress router upon user authentication, then access control accuracy is maintained, but network overhead increases
Solution Approach 1:
The patent merges multiple individual access control communications into a single tunnel establishment communication. Instead of requiring the ingress access point to communicate with each egress router separately for every user authentication, the system creates a single tunnel that aggregates traffic to multiple egress routers, consolidating control plane communications and reducing overall network overhead.
Data Source
AI summary
A method for providing security groups based on the use of tunneling is disclosed. The method includes assigning a security group identifier (SGI) to a packet and classifying the packet based on the packet's SGI.