Associating service tags with remote data message flows based on remote device management attributes

• US 9,906,562 B2
• Filed: 11/01/2015
• Issued: 02/27/2018
• Est. Priority Date: 08/28/2015
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban, Nimmagadda, Srinivas, Tiagi, Alok S., Kumar, Kausum
• Primary Examiner(s): PHUNKULH, BOB A
• Application Number:
  US14/929,404
• Publication Number:
  US 20170064749A1
• Time in Patent Office: 849 Days
• Field of Search: None
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2571 for identification, e.g. for authentication or billing charging arrangements H04L12/14
• CPC Class Codes: H04L 61/2585 through application level gateway [ALG]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 76/12 Setup of transport tunnels

Abstract

Some embodiments provide novel methods for processing remote-device data messages in a network based on data-message attributes from a remote device management (RDM) system. For instance, the method of some embodiments identifies a set of RDM attributes associated with a data message, and then performs one or more service operations based on identified RDM attribute set.

Claims

1. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:

receiving a data message sent by a remote device through a first tunnel that connects the remote device to the network;

removing a first tunnel header of the first tunnel from the data message;

identifying a set of remote device management (RDM) attributes associated with the received data message;

based on the RDM attribute set, identifying a service tag to associate with the received data message;

encapsulating the data message with a second tunnel header of a second tunnel to forward the data message along the second tunnel to a network element within the network; and

inserting the identified service tag in the second tunnel header of the second tunnel, said service tag for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

2. The non-transitory machine readable medium of claim 1, wherein the service tag comprises a security descriptor that determines how at least one network element performs the service on the data message.

3. The non-transitory machine readable medium of claim 2, wherein the service is one of a firewall operation, a load balancing operation, a logical network segmentation operation, and a destination network address translation operation on the data message.

4. The non-transitory machine readable medium of claim 2, wherein the security descriptor specifies a trust level from a plurality of trust levels for the data message.

5. The non-transitory machine readable medium of claim 2, wherein the security descriptor specifies whether the remote device is a trustworthy device.

6. The non-transitory machine readable medium of claim 2, wherein the security descriptor specifies whether the remote device is a jail broken device.

7. The non-transitory machine readable medium of claim 1, wherein

the network is a network within a multi-tenant datacenter,

the remote device is associated with a first tenant,

the service tag associates the data message with a first set of users of the first tenant, which is different than a second set of users of the first tenant, and

the service tag allows the data message to be processed according to a first set of policies defined for the first set of users and not a second set of policies defined for the second set of users.

8. The non-transitory machine readable medium of claim 7, wherein the first set of policies require the data message to be processed by a first set of compute nodes that is for the first set of users, and not a second set of compute nodes that is for the second set of users.

9. The non-transitory machine readable medium of claim 7, wherein the first and second sets of policies are different sets of service policies, the first set of service policies specifying a first group of services that should be performed on data messages from remote devices of the first set of users, while the second set of service policies specifies a second group of services that should be performed on data messages from remote devices of the second set of users.

10. The non-transitory machine readable medium of claim 9, wherein each group of services includes at least one of a firewall service, a load balancing service, a logical network segmentation service, and a destination network address translation service on the data message.

11. The non-transitory machine readable medium of claim 1, wherein

the data message comprises a request for processing by a plurality of compute nodes comprising a first set of compute nodes and a second set of compute nodes, and

the service tag directs the set of network elements to have a compute node in the first set of compute nodes process the data message'"'"'s request instead of a compute node in the second set of compute nodes.

12. The non-transitory machine readable medium of claim 1, wherein the service tag comprises a location descriptor that describes a location of the remote device and that determines how at least one network element performs at least one service on the data message.

13. The non-transitory machine readable medium of claim 1, wherein the service tag is not a parameter in a header of the data message received from the remote device.

14. The non-transitory machine readable medium of claim 13, wherein the service tag is also not an RDM attribute in the identified RDM attribute set.

15. The non-transitory machine readable medium of claim 1, wherein the remote device supplies at least a subset of the RDM attribute set in a header of the first tunnel.

16. The non-transitory machine readable medium of claim 1, wherein the set of instructions for identifying the RDM attribute set comprises a set of instructions for receiving at least a subset of the RDM attribute set from an RDM server that is used to authenticate a request from the remote device to establish a VPN session through the first tunnel.

17. The non-transitory machine readable medium of claim 16, wherein the set of instructions for identifying the RDM attribute set further comprises a set of instructions for retrieving from a header of the first tunnel another subset of the RDM attribute set that is supplied by the remote device.

18. The non-transitory machine readable medium of claim 16, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset as part of an authentication approval from the RDM server.

19. The non-transitory machine readable medium of claim 16, wherein the program further comprises a set of instructions for receiving an authentication approval from the RDM server, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset in a communication from the RDM server that is separate from the authentication approval.

20. A method of processing remote-device data messages entering a network, the method comprising:

receiving a data message sent by a remote device through a first tunnel that connects the remote device to the network;

removing a first tunnel header of the first tunnel from the data message;

identifying a set of remote device management (RDM) attributes associated with the received data message;

based on the RDM attribute set, identifying a service tag to associate with the received data message;

encapsulating the data message with a second tunnel header of a second tunnel to forward the data message along the second tunnel to a network element; and

inserting the identified service tag in the second tunnel header of the second tunnel, said service tag for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

21. The method of claim 20, wherein the data message is received

at a virtual private network (VPN) gateway that connects to the remote device through the first tunnel.

22. The method of claim 20, wherein the service tag comprises a location descriptor that describes a location of the remote device and that determines how at least one network element performs at least one service on the data message.

23. The method of claim 20, wherein the service tag is not a parameter in a header of the data message received from the remote device.

24. The method of claim 20, wherein the service tag is also not an RDM attribute in the identified RDM attribute set.