Associating Service Tags with Remote Data Message Flows Based on Remote Device Management Attributes

• US 20170064749A1
• Filed: 11/01/2015
• Published: 03/02/2017
• Est. Priority Date: 08/28/2015
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban, Nimmagadda, Srinivas, Tiagi, Alok S., Kumar, Kausum
• Granted Patent: US 9,906,562 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2571 for identification, e.g. for authentication or billing charging arrangements H04L12/14
• CPC Class Codes: H04L 61/2585 through application level gateway [ALG]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 76/12 Setup of transport tunnels

Abstract

Some embodiments provide novel methods for processing remote-device data messages in a network based on data-message attributes from a remote device management (RDM) system. For instance, the method of some embodiments identifies a set of RDM attributes associated with a data message, and then performs one or more service operations based on identified RDM attribute set.

Claims

1. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:

receiving a data message sent by a remote device;

identifying a set of remote device management (RDM) attributes associated with the received data message;

based on the RDM attribute set, identifying a service tag to associate with the data message; and

forwarding the first data message to a network element within the network along a first tunnel, and inserting a tag in a header of the first tunnel, said tag for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

2. The non-transitory machine readable medium of claim 1, wherein the tag comprises a security descriptor that determines how at least one network element performs the service on the data message.

3. The non-transitory machine readable medium of claim 2, wherein the service is one of a firewall operation, a load balancing operation, a logical network segmentation operation, and a destination network address translation operation on the data message.

4. The non-transitory machine readable medium of claim 2, wherein the security descriptor specifies a trust level from a plurality of trust levels for the data message.

5. The non-transitory machine readable medium of claim 2, wherein the security descriptor specifies whether the remote device is a trustworthy device.

6. The non-transitory machine readable medium of claim 2, wherein the security descriptor specifies whether the remote device is a jail broken device.

7. The non-transitory machine readable medium of claim 1, wherein

the network is a network within a multi-tenant datacenter,

the first remote device is associated with a first tenant,

the tag associates the data message with a first set of users of the first tenant, which are different than a second set of users of the first tenant, and

the tag allows the data message to be processed according by a first set of policies defined for the first set of users and not a second set of policies defined for the second set of users.

8. The non-transitory machine readable medium of claim 7, wherein the first set of policies require the data message to be processed by a first set of compute nodes that are for the first set of users, and not a second set of compute nodes that are for the second set of users.

9. The non-transitory machine readable medium of claim 7, wherein the first and second sets of policies are different sets of service policies, the first set of service policies specifying a first group of services that should be performed on data messages from remote devices of the first set of users, while the second set of service policies specifying a second group of services that should be performed on data messages from remote devices of the second set of users.

10. The non-transitory machine readable medium of claim 9, wherein each group of services includes at one of a firewall service, a load balancing service, a logical network segmentation service, and a destination network address translation service on the data message.

11. The non-transitory machine readable medium of claim 1, wherein

the data message comprises a request for processing by a plurality of compute nodes comprising a first set of compute nodes and a second set of compute nodes, and

the tag directs the set of network elements to have a compute node in the first set of compute nodes process the data message'"'"'s request instead of a compute node in the second set of compute nodes.

12. The non-transitory machine readable medium of claim 1, wherein the service tag comprises a location descriptor that describes a location of the remote device and that determines how at least one network element performs at least one service on the data message.

13. The non-transitory machine readable medium of claim 1, wherein the tag is not a parameter in a header of the data message received from the remote device.

14. The non-transitory machine readable medium of claim 13, wherein the tag is also not an RDM attribute in the identified RDM attribute set.

15. The non-transitory machine readable medium of claim 1, wherein the set of instructions for receiving the data message comprises sets of instructions for:

receiving the data message sent by the remote device through a second tunnel that connects the remote device to the network;

removing a tunnel header for the second tunnel from the data message;

encapsulating the data message with a tunnel header for the first tunnel to forward the data message along the first tunnel to the network element.

16. The non-transitory machine readable medium of claim 15, wherein the remote device supplies at least a subset of the RDM attribute set in a header of the second tunnel.

17. The non-transitory machine readable medium of claim 15, wherein the set of instructions for identifying the RDM attribute set comprises a set of instructions for receiving at least a subset of the RDM attribute set from an RDM server that is used to authenticate a request from the remote device to establish a VPN session through the second tunnel.

18. The non-transitory machine readable medium of claim 17, wherein the set of instructions for identifying the RDM attribute set further comprises a set of instructions retrieving from a header of the second tunnel another subset of the RDM attribute set that is supplied by the remote device.

19. The non-transitory machine readable medium of claim 17, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset as part of an authentication approval from the RDM server.

20. The non-transitory machine readable medium of claim 17, wherein the program further comprises a set of instructions for receiving an authentication approval from the RDM server, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset in a communication from the RDM server that is separate from the authentication approval.

21. A method of processing remote-device data messages entering a network, the method comprising:

receiving a data message sent by a remote device;

identifying a set of remote device management (RDM) attributes associated with the received data message;

based on the RDM attribute set, identifying a service tag to associate with the data message; and

forwarding the data message with the associated service tag to a destination within the network, said service tag for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

22. The method of claim 21, wherein receiving the data message comprises:

at a virtual private network (VPN) gateway, receiving the data message sent by the remote device through a second tunnel that connects the remote device to the network.

23. The method of claim 22, wherein receiving the data message further comprises intercepting the data message from an egress path of the VPN gateway as the VPN gateway forwards the data message to a destination within the network.

24. The method of claim 23, wherein the data message is intercepted by an encapsulator executing on a device with the VPN gateway, said encapsulator associating the data message with service tag and forwarding the data message to the network element along the first tunnel.

25. The method of claim 23, wherein the data message is intercepted by an encapsulator that operates on a separate physical machine than the VPN gateway, said encapsulator associating the data message with a service tag and forwarding the data message to the network element along the first tunnel.