Back to results
US 8,146,148 B2Granted
Tunneled security groups
AssigneeCisco Technology, Inc.
InventorDavid R. Cheriton
Life of this patent
Estimating the term…
Abstract
A method for providing security groups based on the use of tunneling is disclosed. The method includes assigning a security group identifier (SGI) to a packet and classifying the packet based on the packet's SGI.
Claims32
A network device comprising:
- a processor;
- a first memory, wherein
- said processor and said first memory are coupled to one another,
- said processor is configured to dynamically set up a tunnel comprising detecting that no tunnel exists between a first ingress router and an egress router specified by a packet, and
- said processor is configured to create the tunnel in response to the detecting, wherein
- all network traffic received via the tunnel is associated with the security group;
- a tunnel classification stage, wherein
- said processor is coupled to control said tunnel classification stage,
- said tunnel classification stage comprises
- a packet processing section comprising at least one processor,
- a security group identifier identification unit, coupled to said packet processing section, and
- a tunnel classification unit, coupled to said packet processing section and said security group identifier identification unit,
- said security group identifier is configured to identify a security group of a sender of said packet,
- said security group comprises a plurality of senders,
- said plurality of senders comprises said sender, and
- said packet processing section is configured to
- classify said packet, wherein
- said classifying comprises selecting a network layer of a plurality of network layers at which said packet is to be classified, and
- said classifying is based, at least in part, on a destination of said packet and a security group identifier (SGI) assigned to said packet,
- said SGI identifies a security group of a sender of said packet, determine a routing of said packet based on a result of said classifying, wherein
- said packet processing section is configured to determine said routing by virtue of being configured to identify a tunnel using said destination address;
- identifying a tunnel identifier of said tunnel based on said routing of said packet, wherein said tunnel identifier uniquely identifies said runnel;
- determine whether forwarding said packet via said runnel is permitted, wherein
- said packet processing section is configured to determine whether said forwarding is permitted based, by selecting an entry of an access control list (ACL) using at least said SGI and said tunnel identifier, and
- forward said packet via said tunnel, if said forwarding said packet via said tunnel is permitted.
22 more elements
A method comprising:
- dynamically setting up a tunnel comprising detecting that no tunnel exists between a first ingress router and an egress router specified by a packet;
- creating the tunnel in response to the detecting, wherein all network traffic received via the tunnel is associated with the security group;
- assigning a security group identifier (SGI) to said packet, wherein
- said SGI is assigned based, at least in part, on a security group of a sender of said packet,
- said SGI identifies said security group,
- said security group comprises a plurality of senders, and
- said plurality of senders comprises said sender;
- classifying said packet, wherein
- said classifying comprises selecting a network layer of a plurality of network layers at which said packet is to be classified, and
- said classifying is based, at least in part, on a destination of said packet and said SGI;
- determining a routing of said packet based on a result of said classifying, wherein said determining said routing comprises identifying a tunnel using said destination address;
- identifying a tunnel identifier of said tunnel based on said routing of said packet, wherein
- said tunnel identifier uniquely identifies said tunnel;
- determining whether forwarding said packet via said tunnel is permitted,
- wherein said determining whether said forwarding is permitted comprises selecting an entry of an access control list (ACL) using at least said SGI and said tunnel identifier;
- and
- forwarding said packet via said tunnel, if said forwarding of said packet via said tunnel is permitted.
14 more elements
A computer system comprising:
- a processor;
- a non-transitory computer readable storage medium coupled to said processor;
- and
- computer code, encoded in said non-transitory computer readable storage medium, configured to cause said processor to:
- dynamically set UP a tunnel comprising detecting that no tunnel exists between a first ingress router and an egress router specified by a packet,
- wherein all network traffic received via the tunnel is associated with a security group;
- assign a security group identifier (SGI) to said packet,
- wherein said SGI is assigned based, at least in part, on a security group of a sender of said packet,
- said SGI identifies said security group, said security group comprises a plurality of senders, and
- said plurality of senders comprises said sender;
- generate a classification of said packet by virtue of being configured to classify said packet,
- wherein classifying said packet comprises selecting a network layer of a plurality of network layers at which said packet is to be classified, and classifying said packet is based, at least in part, on a destination of said packet and said SGI;
- determine a routing of said packet based on a result of said classifying, wherein determining said routing comprises identifying a tunnel using said destination address;
- identify a tunnel identifier of said tunnel based on routing of said packet, wherein said tunnel identifier uniquely identifies said tunnel;
- determine whether said packet can be sent via a tunnel by selecting an entry of an access control list (ACL) using at least said SGI and said tunnel identifier:
- and forward said packet via said tunnel, if said forwarding said packet via said tunnel is permitted.
13 more elements
A computer program product, wherein said computer program product comprises a non-transitory computer-readable storage medium, and further comprising:
- a plurality of instructions, comprising
- a first set of instructions, executable on a computer system, configured to dynamically setting UP a tunnel comprising detecting that no tunnel exists between a first ingress router and an egress router specified by a packet;
- and creating the tunnel in response to the detecting, wherein all network traffic received via the tunnel is associated with the security group,
- a second set of instructions, executable on a computer system, configured to assign a security group identifier (SGI) to said packet, wherein said first set of instructions are further configured to assign said SGI based, at least in part, on a security group of a sender of said packet,
- said SGI identifies said security group,
- said security group comprises a plurality of senders, and
- said plurality of senders comprises said sender,
- a third set of instructions, executable on said computer system, configured to classify said packet, wherein
- classifying said packet comprises selecting a network layer of a plurality of network layers at which said packet is to be classified, and
- classifying said packet is based, at least in part, on a destination of said packet and said SGI,
- a fourth set of instructions, executable on said computer system, configured to determine a routing of said packet based on a result of said classifying, wherein
- said determining said routing comprises identifying a tunnel using said destination address,
- said third set of instructions configured to identify a tunnel identifier of said tunnel based on said routing of said packet, wherein said tunnel identifier uniquely identifies said tunnel;
- a fifth set of instructions, executable on said computer system, configured to determine whether forwarding said packet via said tunnel is permitted, wherein
- said fourth set of instructions is further configured to select an entry of an access control list (ACL) using at least said SGI and said tunnel identifier, and
- a six set of instructions, executable on said computer system, configured to forward said packet via said tunnel, if said forwarding said packet via said tunnel is permitted;
- and
- said computer-readable storage medium, wherein said instructions are encoded in said computer-readable storage medium.
15 more elements
Dependencies are inferred from the claim text.