US 12,756,716 B2 · Network security using primary and secondary security group tags

Abstract

Techniques and architecture are described that provide secondary identifiers or group tags, e.g., security group tags (SGTs). Control security policies may then be provided for entities within a networking arrangement and separate policies per entity may be provided. This results in assigning a primary SGT per entity and secondary SGTs per entity, wherein the secondary SGT categories are the same at each entity. For example, the secondary SGTs may represent a location, a person, an organization, a partner of the organization, a service, a database, a type of record, etc. Generally, the primary SGTs may represent a location, an entity, an organization, a partner of the organization, a person, etc. Utilizing the “hierarchal” SGT arrangement described herein, security may be efficiently enforced once at an ingress network node using primary SGTs and again at the egress network node using secondary SGTs.

Claims20

Dependent claims

A method comprising:

receiving, at a first node of a network from a first host, a packet, wherein the packet comprises a first group tag and a second group tag, and wherein the packet is destined for a second host that is associated with a third group tag;
based at least in part on the first group tag and the third group tag, determining, by the first node of the network using a first control rule, if the packet may be forwarded to the second host;
upon determining that the packet may be forwarded to the second host, dropping, by the first node of the network, the first group tag from the packet;
forwarding, by the first node to a second node of the network, the packet;
based at least in part on the second group tag and a fourth group tag, determining, by the second node of the network, if the packet may be forwarded to the second host;
and
upon determining by the second node that the packet may be forwarded to the second host, forwarding, by the second node of the network, the packet to the second host.

4 more elements

A system comprising:

one or more processors;
and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
receiving, at a first node of a network from a first host, a packet, wherein the packet comprises a first group tag and a second group tag, and wherein the packet is destined for a second host that is associated with a third group tag;
based at least in part on the first group tag and the third group tag, determining, by the first node of the network using a first control rule, if the packet may be forwarded to the second host;
upon determining that the packet may be forwarded to the second host, dropping, by the first node of the network, the first group tag from the packet;
forwarding, by the first node to a second node of the network, the packet;
based at least in part on the second group tag and a fourth group tag, determining, by the second node of the network, if the packet may be forwarded to the second host;
and
upon determining by the second node that the packet may be forwarded to the second host, forwarding, by the second node of the network, the packet to the second host.

7 more elements

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising:

receiving, at a first node of a network from a first host, a packet, wherein the packet comprises a first group tag and a second group tag, and wherein the packet is destined for a second host that is associated with a third group tag;
based at least in part on the first group tag and the third group tag, determining, by the first node of the network using a first control rule, if the packet may be forwarded to the second host;
upon determining that the packet may be forwarded to the second host, dropping, by the first node of the network, the first group tag from the packet;
forwarding, by the first node to a second node of the network, the packet;
based at least in part on the second group tag and a fourth group tag, determining, by the second node of the network, if the packet may be forwarded to the second host;
and
upon determining by the second node that the packet may be forwarded to the second host, forwarding, by the second node of the network, the packet to the second host.

4 more elements

Dependencies are inferred from the claim text.

Network security using primary and secondary security group tags

Life of this patent

Network security using primary and secondary security group tags

Life of this patent

Abstract

Claims20