VNIC Zero-Trust Routing With NSG Rule Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Protecting data in cloud computing environments from exfiltration is challenging due to complex network configurations and the difficulty in maintaining up-to-date security policies, which can be compromised by misconfigurations, leading to exposure of sensitive data.
Innovation Solution
Implementing zero trust packet routing (ZPR) using virtual network interface cards (VNICs) with intent-based policies defined in Zero Trust Packet Routing Policy Language (ZPL), which translates policies into rules enforced by Network Security Groups (NSGs) across enforcement points to secure data flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security rules and policies are created at each network layer, then data protection coverage is improved, but system complexity and difficulty of maintenance increase significantly
Solution Approach 1:
The patent segments security policy enforcement to the network interface level (VNIC) rather than requiring configuration at each network layer. Each VNIC becomes an independent enforcement point with its own security rules, eliminating the need for complex multi-layer policy management while maintaining comprehensive data protection coverage.
Solution Approach 2:
The patent introduces VNICs as intermediary components between applications and the network infrastructure. These VNICs act as enforcement points that implement security policies locally, serving as mediators that simplify the overall system architecture by centralizing policy enforcement at the interface level rather than requiring complex coordination across multiple network layers.
2Reliability
If comprehensive network security rules are deployed, then data exfiltration protection is improved, but time and resources required for updates increase
Solution Approach 1:
The patent implements self-service security enforcement at each VNIC level, where local enforcement points automatically apply and update security rules without requiring manual intervention for each policy change. This distributed architecture allows individual VNICs to independently manage their security configurations, significantly reducing the time and resources required for comprehensive policy updates across the entire network.
3Reliability
If detailed network policies are configured at multiple layers, then security enforcement capability is improved, but ease of operation and policy management deteriorate
Solution Approach 1:
The patent segments the security enforcement function to individual VNICs, allowing administrators to manage policies at a granular, interface-level rather than dealing with complex multi-layer configurations. This segmentation simplifies policy management by breaking down the overwhelming task of network-wide security configuration into manageable, independent units that can be configured and maintained separately.
Data Source
AI summary
Techniques are described for enforcing the flow of traffic between VNICs using ZPR policy. A method includes accessing a ZPR policy that specifies how a flow of traffic is enforced between endpoints within the one or more networks, wherein the policy includes one or more layer 4 rules and one or more layer 7 rules; identifying from the ZPR policy, a ZPR statement that specifies a connection between a first virtual network interface card (VNIC) and an endpoint; generating, based on the ZPR statement, one or more network security group (NSG) rules; and distributing at least one of the one or more NSG rules to a first NSG associated with the first VNIC.