TECHNIQUES FOR IDENTITY AND POLICY BASED ROUTING

• US 20150143458A1
• Filed: 01/30/2015
• Published: 05/21/2015
• Est. Priority Date: 08/26/2010
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Brown, Jeremy Ray, Sabin, Jason Allen, Kranendonk, Nathaniel Brent, Larsen, Kal A., Burch, Lloyd Leon, Carter, Stephen R.
• Granted Patent: US 9,848,017 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/302 Route determination based on requested QoS
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for identity and policy based routing are presented. A resource is initiated on a device with a resource identity and role assignments along with policies are obtained for the resource. A customized network is created for the resource using a device address for the device, the resource identity, the role assignments, and the policies.

Claims

1. (canceled)

2. A method, comprising:

creating a customized network with one or more customized routes based on a resource identity; and

providing access over the one or more customized routes for a resource associated with the resource identity to access other resources over a network connection.

3. The method of claim 2, wherein creating further includes creating the customized network based on role assignments and policies.

4. The method of claim 2, wherein creating further includes creating the customized network as a Virtual Private Network (VPN).

5. The method of claim 4 further comprising, defining all devices and all additional resources that the resource can access when the resource access the VPN.

6. The method of claim 5, wherein creating further includes initially creating the customized network with just the resource and dynamically adding the other resources.

7. The method of claim 2, wherein providing further includes dynamically y adding an additional resource to the customized network.

8. The method of claim 2, wherein providing further includes identifying the resource as a workload.

9. The method of claim 2, wherein providing further includes providing o le or more customized routes to one or more network routers as a routing table.

10. The method of claim 2 further comprising, detecting a new role assigned to the resource identity and updating one or more customized routes based on the new role.

11. The method of claim 2 further comprising, provisioning network services to support the resource communicating over the customized network.

12. A method, comprising:

registering a machine executing a resource based on a machine identity and a resource identity; and

establishing a custom network for the resource, wherein the custom network defines other resources and other devices that the resource can access over the custom network.

13. The method of claim 12, wherein establishing further includes building the custom network based on role assignments and policies associated with the resource and the machine.

14. The method of claim 12, wherein establishing further includes establishing the custom network as a virtual network.

15. The method of claim 12, wherein establishing further includes dynamically adding an additional resource to the custom network.

16. The method of claim 12, wherein establishing further includes dynamically changing network routes for the custom network based on a detected change in one of:

a role assignment and a policy change.

17. The method of claim 12, wherein establishing further includes building the custom network as custom routes defined in a routing table.

18. The method of claim 17 further comprising, dynamically pushing the routing table to network routers.

19. The method of claim 19, wherein pushing further includes providing the routing table in formats recognized and processed by each of the network routers.

20. A system, comprising:

a processor; and

a provision service configured to;

i) execute on the processor, ii) establish a custom network for a resource based on a resource identity, and iii) dynamically add one or more additional resources to the custom network.

21. The system of claim 20, wherein the provision service is further configured, in ii), to:

build the custom network as a virtual network comprising network routes.