Performing logical segmentation based on remote device attributes

• US 9,906,561 B2
• Filed: 11/01/2015
• Issued: 02/27/2018
• Est. Priority Date: 08/28/2015
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban, Nimmagadda, Srinivas, Tiagi, Alok S., Kumar, Kausum
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/929,403
• Publication Number:
  US 20170063822A1
• Time in Patent Office: 849 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2571 for identification, e.g. for authentication or billing charging arrangements H04L12/14
• CPC Class Codes: H04L 61/2585 through application level gateway [ALG]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 76/12 Setup of transport tunnels

Abstract

Some embodiments provide novel methods for processing remote-device data messages in a network based on data-message attributes from a remote device management (RDM) system. For instance, the method of some embodiments identifies a set of RDM attributes associated with a data message, and then performs one or more service operations based on identified RDM attribute set.

Claims

1. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:

receiving a first data message sent by a first remote device through a first tunnel that connects the mobile-device to the network;

identifying a first set of remote device management (RDM) attributes associated with the first data message, wherein the mobile-device supplies at least a subset of the first remote device management (RDM) attribute set in a header of the first tunnel;

based on the first RDM attribute set, associating the first data message with a first logical network; and

forwarding the first data message to a destination within the network along a second tunnel, and inserting a first logical network identifier (LNI) for the first logical network in a header of the second tunnel.

2. The non-transitory machine readable medium of claim 1, wherein the LNI is a logical layer 2 network identifier.

3. The non-transitory machine readable medium of claim 1, wherein the LNI is a VXLAN network identifier.

4. The non-transitory machine readable medium of claim 1, wherein the LNI is a logical layer 3 network identifier.

5. The non-transitory machine readable medium of claim 1, wherein the first data message is part of a first data message flow, the program further comprising sets of instructions for:

receiving a second data message from the first remote device, said second data message part of a second data message flow from the first remote device;

identifying a second RDM attribute associated with the received second data message;

based on the second RDM attribute set, associating the second data message with a second logical network of the first tenant; and

forwarding the data message to the message'"'"'s destination within the network along a second tunnel, and inserting a second LNI for the second logical network in a header of the second tunnel.

6. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:

receiving a first data message sent by a first remote device through a first tunnel that connects the mobile-device to the network;

identifying a first set of remote device management (RDM) attributes associated with the first data message, said identifying comprising receiving at least a subset of the first RDM attribute set from an RDM server that is used to authenticate a request from the remote device to establish a VPN session through the first tunnel;

based on the first RDM attribute set, associating the first data message with a first logical network; and

forwarding the first data message to a destination within the network along a second tunnel, and inserting a first logical network identifier (LNI) for the first logical network in a header of the ssecond tunnel.

7. The non-transitory machine readable medium of claim 6, wherein the set of instructions for identifying the RDM attribute set further comprises a set of instructions for retrieving from a header of the first tunnel another subset of the RDM attribute set that is supplied by the remote device.

8. The non-transitory machine readable medium of claim 6, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset as part of an authentication approval from the RDM server.

9. The non-transitory machine readable medium of claim 6, wherein the program further comprises a set of instructions for receiving an authentication approval from the RDM server, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset in a communication from the RDM server that is separate from the authentication approval.

10. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:

receiving a first data message sent by a first remote device;

identifying a first set of remote device management (RDM) attributes associated with the first data message;

based on the first RDM attribute set, associating the first data message with a first logical network, said associating comprising using the identified first RDM attribute set to identify a first logical segmentation (LS) rule that identifies a first logical network identifier (LNI) for data messages associated with the identified first RDM set, the first LS rule stored in a rule storage that stores a plurality of logical segmentation rules, and at least two logical segmentation rules specifying two different LNIs for two different RDM attribute sets; and

forwarding the first data message to a destination within the network along a first tunnel, and inserting a second logical network identifier (LNI) for the first logical network in a header of the first tunnel.

11. The non-transitory machine readable medium of claim 10, wherein the LNI is a logical layer 2 network identifier, a VXLAN network identifier, or a logical layer 3 network identifier.

12. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network within a multi-tenant datacenter, the program comprising sets of instructions for:

receiving a first data message sent by a first remote device that is associated with a first tenant;

receiving a second data message sent by a second remote device that is associated with the first tenant;

identifying a first RDM (remote device management) attribute set and a second RDM attribute set associated with the received first and second data messages, respectively;

based on the first RDM attribute set, associating the first data message with a first logical network of the first tenant, and based on the second RDM attribute set, associating the second data message with a second logical network of the first tenant; and

forwarding (i) the first data message to a destination within the network along a first tunnel and inserting a first logical network identifier (LNI) for the first logical network in a header of the first tunnel and (ii) the second data message to a destination within the network along a second tunnel; and

inserting a second LNI for the second logical network in a header of the second tunnel.

13. The non-transitory machine readable medium of claim 12, wherein the first logical network is for a first set of users of the first tenant, and the second logical network is for a second set of users of the first tenant.

14. The non-transitory machine readable medium of claim 12, wherein the first logical network is for a first set of devices of the first tenant, and the second logical network is for a second set of devices of the first tenant.

15. The non-transitory machine readable medium of claim 12, wherein the first and second tunnels are the same tunnel.

16. The non-transitory machine readable medium of claim 12, wherein the first and second tunnels are different tunnels.

17. The non-transitory machine readable medium of claim 12, wherein the first or second LNI is a logical layer 2 network identifier, a VXLAN network identifier, or a logical layer 3 network identifier.

18. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network within a multi-tenant datacenter, the program comprising sets of instructions for:

receiving a first data message sent by a first remote device that is associated with a first tenant;

receiving a second data message sent by a second remote device that is associated with a second tenant;

identifying a first RDM attribute set and a second RDM attribute set associated with the received first and second data messages, respectively;

based on the first RDM attribute set, associating the first data message with a first logical network associated with the first tenant, and based on the second RDM attribute set, associating the second data message with a second logical network associated with the second tenant; and

forwarding (i) the first data message to a destination within the network along a first tunnel and inserting a first logical network identifier (LNI) for the first logical network in a header of the first tunnel and (ii) the second data message to a destination within the network along a second tunnel and inserting a second LNI for the second logical network in a header of the second tunnel.

19. The non-transitory machine readable medium of claim 18, wherein the first and second logical networks are overlay logical networks that are established by tunnels connecting a plurality of shared managed forwarding elements.

20. The non-transitory machine readable medium of claim 19, wherein the plurality of shared managed forwarding elements communicatively connect computation nodes that execute on a plurality of shared computers.

21. The non-transitory machine readable medium of claim 18, wherein the first or second LNI is a logical layer 2 network identifier, a VXLAN network identifier, or a logical layer 3 network identifier.