METHODS AND SYSTEMS FOR MULTI-TENANT CONTROLLER BASED MAPPING OF DEVICE IDENTITY TO NETWORK LEVEL IDENTITY

• US 20160080212A1
• Filed: 09/16/2015
• Published: 03/17/2016
• Est. Priority Date: 09/16/2014
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Cloudgenix, Inc. (Palo Alto Networks Incorporated)
• Inventors: Yadav, Navneet, Ramasamy, Arivu, Ramachandran, Kumar, Anand, Venkataraman
• Granted Patent: US 9,742,626 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/125 : based on throughput or bandwidth
• CPC Class Codes: H04L 45/22 : Alternate routing
• CPC Class Codes: H04L 45/28 : using route fault recovery
• CPC Class Codes: H04L 45/302 : Route determination based on requested QoS
• CPC Class Codes: H04L 45/306 : Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/38 : Flow based routing
• CPC Class Codes: H04L 47/125 : by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/22 : Traffic shaping
• CPC Class Codes: H04L 47/24 : Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/32 : by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 47/781 : Centralised allocation of resources
• CPC Class Codes: H04L 47/825 : Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 61/2503 : Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/4511 : using domain name system [DNS]
• CPC Class Codes: H04L 61/4523 : using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks

Abstract

A method includes executing at a controller a horizontally scalable service Identity Definitions Manager (IDM) Service, mapping active directory (AD) domains to WAN network elements DNS ROLE and LDAP ROLE, instructing a plurality of network elements associated with a tenant to discover a plurality of AD domains and AD servers in an enterprise using the DNS ROLE, receiving from the plurality of network elements running DNS ROLE information indicative of changes to network attributes selected from the group consisting of AD domains, additions and subtractions of AD servers and changes in an IP address of AD servers and transmitting the received AD domains and AD servers to a tenant administrator and requesting credentials to communicate with added AD servers using LDAP.

Claims

1. A method comprising:

executing at a controller a horizontally scalable service Identity Definitions Manager (IDM) Service;

mapping active directory (AD) domains to WAN network elements DNS ROLE and LDAP ROLE;

instructing a plurality of network elements associated with a tenant to discover a plurality of AD domains and AD servers in an enterprise using the DNS ROLE;

receiving from the plurality of network elements running DNS ROLE information indicative of changes to network attributes selected from the group consisting of AD domains, additions and subtractions of AD servers and changes in an IP address of AD servers;

transmitting the received AD domains and AD servers to a tenant administrator and requesting credentials to communicate with added AD servers using LDAP;

executing an algorithm to determine which element will contact specific AD instances to minimize lightweight directory access protocol (LDAP) traffic volume occurring on the WAN and to ensure AD instances can still be reached in case of failure of any one network element;

monitoring in Active Directory servers changes in at least one identity of a network user by using the LDAP ROLE on the network elements; and

updating a policy, based at least in part on the mapping of user identity in AD domains, at a multi-tenant controller, wherein the tracking of changing identity information is implemented as a horizontally scalable service the Identity Definitions Manager Service.

2. The method of claim 1 further employing a multi-tenant controller based mapping of a user or device identity to a network level identity.

3. The method of claim 1 further comprising performing application analysis on a per session basis.

4. The method of claim 1 further comprising routing traffic based, at least in part, on a dynamic and automated QoS definition.

5. The method of claim 4 further comprising employing on the traffic modeling and analytics selected from the group consisting of Pareto and Weibull.

6. The method of claim 1 further comprising employing QoS standardized controls selected from the group consisting of shaping, policing, random early discard, tail drop, low latency queues, fair queues, anomaly queues and buffers.

7. The method of claim 1 further comprising utilizing a network identity type.

9. The centrally controllable multi-tenant controller of claim 1 further configured to employ a multi-tenant controller based mapping of a user or device identity to a network level identity.

10. The centrally controllable multi-tenant controller of claim 1 further configured to perform application analysis on a per session basis.

11. The centrally controllable multi-tenant controller of claim 1 further configured to route traffic based, at least in part, on a dynamic and automated QoS definition.

12. The centrally controllable multi-tenant controller of claim 4 further configured to employ on the traffic modeling and analytics selected from the group consisting of Pareto and Weibull.

13. The centrally controllable multi-tenant controller of claim 1 further configured to employ QoS standardized controls selected from the group consisting of shaping, policing, random early discard, tail drop, low latency queues, fair queues, anomaly queues and buffers.

14. The centrally controllable multi-tenant controller of claim 1 further configured to utilize a network identity type.

8. A centrally controllable multi-tenant controller for controlling a plurality of assets across a plurality of distributed computing environments wherein the controller is configured to:

execute at a controller a horizontally scalable service Identity Definitions Manager (IDM) Service;

map active directory (AD) domains to WAN network elements DNS ROLE and LDAP ROLE;

instruct a plurality of network elements associated with a tenant to discover a plurality of AD domains and AD servers in an enterprise using the DNS ROLE;

receive from the plurality of network elements running DNS ROLE information indicative of changes to network attributes selected from the group consisting of AD domains, additions and subtractions of AD servers and changes in an IP address of AD servers;

transmit the received AD domains and AD servers to a tenant administrator and requesting credentials to communicate with added AD servers using LDAP;

execute an algorithm to determine which element will contact specific AD instances to minimize lightweight directory access protocol (LDAP) traffic volume occurring on the WAN and to ensure AD instances can still be reached in case of failure of any one network element;

receive from the LDAP ROLE of network element changes in Active Directory servers in at least one identity (user or group) of a network; and

update a policy, based at least in part on the mapping of user identity in AD domains, at a multi-tenant controller, wherein the tracking of changing identity information is implemented as a horizontally scalable service the Identity Definitions Manager Service.

15. A method comprising:

executing at a controller a horizontally scalable service IP to Site Mapping (ISM) Service;

instructing a plurality of network elements associated with a tenant to discover a plurality of AD domains and AD servers in an enterprise;

receiving from the plurality of network elements information indicative of changes to network attributes selected from the group consisting of AD domains, additions and subtractions of AD servers and changes in an IP address of AD servers;

transmitting the received AD domains and AD servers to a tenant administrator and requesting credentials to communicate with added AD servers using WMI;

executing an algorithm to determine which element will contact specific AD instances in order to contain WMI communication over LAN and minimize WMI communication over WAN;

monitoring, using the WMI role on the network elements, the AD servers security login events comprising an IP address, a user AD ID and a user name;

converting the login events to IP-to-user events and transmitting these to the ISM service in the controller;

using the ISM service to map these IP-to-user events to the right spoke site;

sending the events with enriched information comprising one or more group IDs for the user to the element in the spoke site; and

using the enriched IP to user event at the spoke site to enforce policy based on user and group IDs and to enrich flow and application statistics with user and group information.

16. The method of claim 15 further employing a multi-tenant controller based mapping of a user or device identity to a network level identity.

17. The method of claim 15 further comprising performing application analysis on a per session basis.

18. The method of claim 15 further comprising routing traffic based, at least in part, on a dynamic and automated QoS definition.

19. The method of claim 18 further comprising employing on the traffic modeling and analytics selected from the group consisting of Pareto and Weibull.

20. The method of claim 19 further comprising employing QoS standardized controls selected from the group consisting of shaping, policing, random early discard, tail drop, low latency queues, fair queues, anomaly queues and buffers.