Back to results
US 12,719,827 B2Granted
Binding flows to unique addresses or ports
AssigneeCisco Technology, Inc.
InventorsKyle Andrew Donald Mestery, Vincent E. Parla
Life of this patent
Estimating the term…
Abstract
Techniques for binding communication flows to unique addresses and/or ports, and configuring networking devices internal to a network to apply policy without the need to further introspect a given stream. Further, by creating mappings of unique addresses and/or ports to flows, the network devices are able to enforce policy without needing to coordinate with an edge node of the network at which the communication session terminates. Further, the techniques may include providing an SDN controller with a mapping between a unique address/port and a network flow, determining flow-specific policy to enforce on the flow, and programming one or more network devices to enforce the flow-specific policy in the network using the unique address/port.
Claims20
A system comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, from a termination device, a Domain Name System (DNS) request to resolve a domain name on behalf of a source device into a destination Internet Protocol (IP) address associated with a destination device in a network;
- receiving, from the termination device, first context data associated with a first network flow sent from a source device and destined for the destination device;
- generating a first 5-tuple identifier that corresponds to the first network flow;
- storing a first mapping between the first 5-tuple identifier and at least one of the first context data or a first network policy determined for the first network flow;
- sending the first 5-tuple identifier to the termination device;
- detecting the first network flow in the network, wherein the first network flow has the first 5-tuple identifier in a first unencrypted field;
- applying the first network policy to the first network flow based at least in part on the first mapping;
- receiving, from the termination device, second context data associated with a second network flow, wherein the second network flow and the first network flow were multiplexed by the source device into a single stream and sent to the termination device;
- generating a second 5-tuple identifier that corresponds to the second network flow;
- storing a second mapping between the second 5-tuple identifier and at least one of the second context data or a second network policy determined for the second network flow;
- sending the second 5-tuple identifier and to the termination device;
- detecting the second network flow in the network, wherein the second network flow has the second 5-tuple identifier in a second unencrypted field;
- and
- applying the second network policy to the second network flow based at least in part on the second mapping, the second network policy being different than the first network policy.
14 more elements
A method comprising:
- receiving, from a termination device, a Domain Name System (DNS) request to resolve a domain name on behalf of a source device into a destination Internet Protocol (IP) address associated with a destination device in a network;
- receiving, from the termination device, first context data associated with a first network flow sent from a source device and destined for the destination device;
- generating a first 5-tuple identifier that corresponds to the first network flow;
- storing a first mapping between the first 5-tuple identifier and at least one of the first context data or a first network policy determined for the first network flow;
- sending the first 5-tuple identifier to the termination device;
- detecting the first network flow in the network, wherein the first network flow has the first 5-tuple identifier in a first unencrypted field;
- applying the first network policy to the first network flow based at least in part on the first mapping;
- receiving, from the termination device, second context data associated with a second network flow, wherein the second network flow and the first network flow were multiplexed by the source device into a single stream and sent to the termination device;
- generating a second 5-tuple identifier that corresponds to the second network flow;
- storing a second mapping between the second 5-tuple identifier and at least one of the second context data or a second network policy determined for the second network flow;
- sending the second 5-tuple identifier and to the termination device;
- detecting the second network flow in the network, wherein the second network flow has the second 5-tuple identifier in a second unencrypted field;
- and
- applying the second network policy to the second network flow based at least in part on the second mapping, the second network policy being different than the first network policy.
11 more elements
One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
- receiving a Domain Name System (DNS) request to resolve a domain name on behalf of a source device into a destination Internet Protocol (IP) address associated with a destination device in a network;
- receiving first context data associated with a first network flow sent from a source device and destined for the destination device;
- generating a first 5-tuple identifier that corresponds to the first network flow;
- storing a first mapping between the first 5-tuple identifier and at least one of the first context data or a first network policy determined for the first network flow;
- detecting the first network flow in the network, wherein the first network flow has the first 5-tuple identifier in a first unencrypted field;
- applying the first network policy to the first network flow based at least in part on the first mapping;
- receiving second context data associated with a second network flow, wherein the second network flow and the first network flow were multiplexed by the source device into a single stream;
- generating a second 5-tuple identifier that corresponds to the second network flow;
- storing a second mapping between the second 5-tuple identifier and at least one of the second context data or a second network policy determined for the second network flow;
- detecting the second network flow in the network, wherein the second network flow has the second 5-tuple identifier in a second unencrypted field;
- and
- applying the second network policy to the second network flow based at least in part on the second mapping, the second network policy being different than the first network policy.
9 more elements
Dependencies are inferred from the claim text.