Virtual Air Gap Sub-Fabrics for Secure Network Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network fabrics lack effective isolation mechanisms, leading to vulnerabilities from both external and internal threats, necessitating costly physical separation and inefficient data transfer between isolated networks.
Innovation Solution
A network configuration device instantiates sub-fabrics within a network fabric using a virtual air gap, defined by fabric isolation criteria, ensuring internal communication isolation and provisioning a virtual air gap around the sub-fabric to create a DMZ, allowing for secure communication while using a single set of networking nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physical isolation is implemented to secure networks from threats, then security is improved, but hardware cost and maintenance overhead increase significantly
Solution Approach 1:
The patent segments a single physical network fabric into multiple isolated virtual sub-fabrics using virtualization technology. Each sub-fabric operates as an independent logical network with its own routing policies and isolation rules, eliminating the need for multiple physical networks while maintaining security isolation. This directly resolves the contradiction by providing network segmentation through virtualization rather than physical separation.
Solution Approach 2:
The patent introduces a fabric manager as an intermediary component that enforces isolation policies between sub-fabrics. The fabric manager monitors and controls communication between sub-fabrics, applying virtual air gap policies to prevent unauthorized data transfer while allowing legitimate communication through controlled channels. This intermediary mechanism provides security without requiring physical isolation of hardware.
2Reliability
If multiple physically isolated networks are deployed to prevent internal threats, then security isolation is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The patent makes a single physical network fabric serve multiple security zones simultaneously by creating virtual sub-fabrics. The same physical infrastructure supports multiple isolated networks with different security requirements, reducing architectural complexity while maintaining isolation effectiveness. The fabric manager provides universal control over all sub-fabrics, simplifying maintenance compared to managing multiple separate physical networks.
Solution Approach 2:
The patent transitions from physical spatial isolation to virtual logical isolation by adding a virtualization dimension to the network architecture. Instead of separating networks physically in space, the patent creates isolation in the virtual layer through sub-fabric segmentation and virtual air gap policies, reducing physical complexity while maintaining security boundaries.
3Productivity
If virtual air gap is implemented using shared memory for data transfer, then communication capability is improved, but security isolation is compromised
Solution Approach 1:
The patent extracts the data transfer function from the isolated sub-fabrics and routes it through controlled intermediary channels managed by the fabric manager. Instead of allowing direct shared memory access between sub-fabrics (which would compromise isolation), the patent extracts communication through sanctioned pathways that maintain security boundaries while enabling necessary data transfer for productivity.
Data Source
AI summary
A device configured to or programmed to instantiate an isolated sub-fabric is presented. A network configuration device uses a virtual air gap policy to instantiate a sub-fabric from a fabric of networking nodes. The sub-fabric is configured with an internal routing policy that respects the nature of the defined isolation. Further, the fabric is provisioned with a virtual air gap that ensures the external networking nodes respect the isolation of the sub fabric.