Distributed computer network zone based security architecture

Patent metadata

Field	Value
Publication number	US-9419941-B2
Application number	US-201313849315-A
Country	US
Kind code	B2
Filing date	Mar 22, 2013
Priority date	Mar 22, 2012
Publication date	Aug 16, 2016
Grant date	Aug 16, 2016

Abstract

A method and apparatus is disclosed herein for distributed zone-based security. In one embodiment, the method comprises: determining an ingress security zone associated with an ingress of a first network device based on a first key and a media access control (MAC) address of a source of a packet; determining an egress security zone of a second network device based on a MAC address of a destination for the packet and a second key; performing a policy lookup based on the ingress security zone and the egress security zone to identify a policy to apply to the packet; and applying the policy to the packet.

First claim

We claim:

1. A method comprising:
binding individual ports of a first network device to a security zone;
determining an ingress security zone associated with a packet received at an ingress port of the first network device based on a first key that identifies the first network device and a media access control (MAC) address of a source of a packet, wherein the ingress port of the first network device is bound to a first security zone prior to receipt of the packet at the ingress port, wherein the first security zone for the ingress port is defined by a first security level and the first key;
determining, from a MAC address for a destination of the packet, a second key that identifies a second network device that has an egress port for communicating the packet to the destination, wherein a software defined network (SDN) protocol is queried to determine the destination for the packet;
determining an egress security zone associated with the egress port of the second network device based on the egress port and the second key, wherein the egress port of the second network device is bound to a second security zone prior to transmission of the packet at the egress port, wherein the second security zone for the egress port is defined by a second security level and the second key;
performing a policy lookup based on the first security level and the first key of the ingress security zone and the second security level and the second key of the egress security zone in a policy table, wherein the policy lookup identifies a policy to apply to the packet when first security level and the second security level are different security levels, and wherein the policy lookup identifies a second policy allowing the forwarding of the packet when first security level of the first security zone and the second security level of the second security zone are at a same security level regardless of values of the first key and the second key;
applying the policy to the packet based on the first security level and the second security level when the ingress security zone and the egress security zone are different security zones; and
sending the packet to the destination based on the second key and an identifier of the destination, wherein layer 2 (L2) processing is performed at the destination to determine a final physical egress port for the packet, and wherein the L2 processing comprises a MAC lookup operation.

2. The method defined in claim 1 wherein the first network device is a security gateway device.

3. A network device for use in a distributed network environment having a plurality of network devices, the network device comprising:
a memory;
a network interface to receive IP packets; and
a processor, coupled to the memory and the network interface, operable to bind individual ports of a first network device to a security zone;
determine an ingress security zone associated with a packet received at an ingress port of the first network device based on a first key that identifies the first network device and a media access control (MAC) address of a source of a packet, wherein the ingress port of the first network device is bound to a first security zone prior to receipt of the packet at the ingress port, wherein the first security zone for the ingress port is defined by a first security level and the first key;
determine, from a MAC address for a destination of the packet, a second key that identifies a second network device that has an egress port for communicating the packet to the destination, wherein a software defined network (SDN) protocol is queried to determine the destination for the packet;
determine an egress security zone associated with the egress port of the second network device based on the egress port and the second key, wherein the egress port of the second network device is bound to a second security zone prior to transmission of the packet at the egress port, wherein the second security zone for the egress port is defined by a second security level and the second key;
perform a policy lookup based on the first security level and the first key of the ingress security zone and the second security level and the second key of the egress security zone in a policy table, wherein the policy lookup identifies a policy to apply to the packet when first security level and the second security level are different security levels, and wherein the policy lookup identifies a second policy allowing the forwarding of the packet when first security level of the first security zone and the second security level of the second security zone are at a same security level regardless of values of the first key and the second key;
apply the policy to the packet based on the first security level and the second security level when the ingress security zone and the egress security zone are different security zones; and
send the packet to the destination based on the second key and an identifier of the destination, wherein layer 2 (L2) processing is performed at the destination to determine a final physical egress port for the packet, and wherein the L2 processing comprises a MAC lookup operation.

4. The network device defined in claim 3 wherein the processor performs one or more security processing operations to the packet.

5. A computer-readable non-transitory storage medium having instructions stored therein, which when executed by a network device, cause the network device to perform a method, the method comprising:
binding individual ports of a first network device to a security zone;
determining an ingress security zone associated with a packet received at an ingress port of the first network device based on a first key that identifies the first network device and a media access control (MAC) address of a source of a packet, wherein the ingress port of the first network device is bound to a first security zone prior to receipt of the packet at the ingress port, wherein the first security zone for the ingress port is defined by a first security level and the first key;
determining, from a MAC address for a destination of the packet, a second key that identifies a second network device that has an egress port for communicating the packet to the destination, wherein a software defined network (SDN) protocol is queried to determine the destination for the packet;
determining an egress security zone of a second network device based on the egress port and the second key, wherein the egress port of the second network device is bound to a second security zone prior to transmission of the packet at the egress port, wherein the second security zone for the egress port is defined by a second security level and the second key;
performing a policy lookup based on the first security level and the first key of the ingress security zone and the second security level and the second key of the egress security zone in a policy table, wherein the policy lookup identifies a policy to apply to the packet when first security level and the second security level are different security levels, and wherein the policy lookup identifies a second policy allowing the forwarding of the packet when first security level of the first security zone and the second security level of the second security zone are at a same security level regardless of values of the first key and the second key;
applying the policy to the packet based on the first security level and the second security level when the ingress security zone and the egress security zone are different security zones; and
sending the packet to the destination based on the second key and an identifier of the destination, wherein layer 2 (L2) processing is performed at the destination to determine a final physical egress port for the packet, and wherein the L2 processing comprises a MAC lookup operation.

Assignees

• Sun Yi
• Xu Meng
• Cheung Lee
• Wang Hsisheng
• Shieh Chuong-Yaw Michael
• Varmour Networks Inc

Inventors

• Sun Yi
• Xu Meng
• Cheung Lee
• Wang Hsisheng
• Shieh Chuong-Yaw Michael

Classifications

• H04L63/0209 Primary

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L63/104

  Grouping of entities · CPC title