Zero-Trust Packet Routing Across Gateways and Enforcement Points
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments face challenges in protecting data due to complex network configurations and misconfigurations, leading to potential exposure of sensitive data, and maintaining up-to-date security policies is resource-intensive.
Innovation Solution
Implementing a zero-trust packet routing (ZPR) platform that enables intent-based security policies, translated into rules enforced at multiple enforcement points within the network, using a Zero Trust Packet Routing Policy Language (ZPL) to control traffic flows and protect sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security rules and policies are created and enforced at each network layer, then data protection coverage is improved, but system complexity and maintenance costs increase significantly
Solution Approach 1:
The patent segments network security enforcement into multiple distributed enforcement points (EPs) deployed at different network layers and locations. Each EP independently enforces security policies for specific traffic flows, replacing the traditional monolithic rule management approach. This segmentation allows comprehensive data protection while distributing system complexity across multiple manageable components rather than concentrating it in a single complex rule management system.
2Reliability
If comprehensive network security rules are implemented at all network layers, then data security is improved, but policy maintenance time and resources increase
Solution Approach 1:
The patent implements self-service capabilities where enforcement points automatically receive policy updates from the control plane and autonomously enforce security rules without requiring manual intervention. When policies need updating, the control plane distributes new rules to affected EPs, which automatically adjust their enforcement behavior. This eliminates the time-consuming manual policy maintenance previously required at each network layer while maintaining comprehensive data security.
3Manufacturing precision
If manual configuration of security policies is performed, then policy precision is improved, but ease of operation deteriorates due to complexity
Solution Approach 1:
The patent introduces a control plane as an intermediary between network administrators and the distributed enforcement points. The control plane provides a simplified interface for defining security policies in terms of high-level intent (source, destination, action) rather than requiring manual configuration of complex low-level rules at each enforcement point. This intermediary automatically translates administrator intent into precise enforcement rules distributed to appropriate EPs, maintaining policy precision while dramatically improving ease of operation.
4Adaptability or versatility
If security policies are updated frequently to match changing network requirements, then adaptability is improved, but productivity decreases due to continuous maintenance overhead
Solution Approach 1:
The patent implements a dynamic policy management system where the control plane continuously monitors network conditions and automatically updates enforcement points as needed. Policies are not static configurations but dynamically adapted responses to changing network requirements. This dynamic approach allows the system to maintain high adaptability to network changes while improving productivity by eliminating the manual intervention and continuous maintenance overhead that previously slowed down policy updates.
Data Source
AI summary
Techniques are described for enforcing the flow of traffic through one or more gateways using ZPR policy. A method includes accessing a ZPR policy, identifying from the ZPR policy, one or more ZPR statements that specify one or more gateways and a connection between one or more first endpoints a first virtual cloud network (VCN) and one or more second endpoints that are external from the first VCN; generating rules to enforce the flow of traffic; and distributing one or more first rules of the rules to at least one of the one or more gateways to enforce the flow of traffic, and one or more second rules of the rules to a first enforcement point (EP) associated with the first VCN and one or more third rules or the rules to a second EP associated with the one or more second endpoints.