Performing Logical Segmentation Based on Remote Device Attributes

• US 20170063822A1
• Filed: 11/01/2015
• Published: 03/02/2017
• Est. Priority Date: 08/28/2015
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Jain, Jayant, Sengupta, Anirban, Nimmagadda, Srinivas, Tiagi, Alok S., Kumar, Kausum
• Granted Patent: US 9,906,561 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2571 for identification, e.g. for authentication or billing charging arrangements H04L12/14
• CPC Class Codes: H04L 61/2585 through application level gateway [ALG]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 76/12 Setup of transport tunnels

Abstract

Some embodiments provide novel methods for processing remote-device data messages in a network based on data-message attributes from a remote device management (RDM) system. For instance, the method of some embodiments identifies a set of RDM attributes associated with a data message, and then performs one or more service operations based on identified RDM attribute set.

Claims

1. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:

receiving a first data message sent by a first remote device;

identifying a first set of remote device management (RDM) attributes associated with the first data message;

based on the first RDM attribute set, associating the first data message with a first logical network; and

forwarding the first data message to a destination within the network along a first tunnel, and inserting a first logical network identifier (LNI) for the first logical network in a header of the first tunnel.

2. The non-transitory machine readable medium of claim 1, wherein the set of instructions for receiving the remote device data message comprises a set of instructions for receiving the first data message through a second tunnel that connects the remote device to the network.

3. The non-transitory machine readable medium of claim 2, wherein the remote device supplies at least a subset of the RDM attribute set in a header of the second tunnel.

4. The non-transitory machine readable medium of claim 2, wherein the set of instructions for identifying the RDM attribute set comprises a set of instructions for receiving at least a subset of the RDM attribute set from an RDM server that is used to authenticate a request from the remote device to establish a VPN session through the second tunnel.

5. The non-transitory machine readable medium of claim 4, wherein the set of instructions for identifying the RDM attribute set further comprises a set of instructions retrieving from a header of the second tunnel another subset of the RDM attribute set that is supplied by the remote device.

6. The non-transitory machine readable medium of claim 4, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset as part of an authentication approval from the RDM server.

7. The non-transitory machine readable medium of claim 4, wherein the program further comprises a set of instructions for receiving an authentication approval from the RDM server, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset in a communication from the RDM server that is separate from the authentication approval.

8. The non-transitory machine readable medium of claim 1, wherein the LNI is logical layer 2 network identifier.

9. The non-transitory machine readable medium of claim 1, wherein the LNI is a VXLAN network identifier.

10. The non-transitory machine readable medium of claim 1, wherein the LNI is logical layer 3 network identifier.

11. The non-transitory machine readable medium of claim 1,

wherein the set of instructions for associating the first data message with the logical network comprises a set of instructions for using the identified first RDM attribute set to identify a first logical segmentation (LS) rule that identifies the first LNI for data messages associated with the identified first RDM set;

the first LS rule stored in a rule storage that stores a plurality of logical segmentation rules, and

at least two logical segmentation rules specifying two different LNIs for two different RDM attribute sets.

12. The non-transitory machine readable medium of claim 1, wherein the network is a network within a multi-tenant datacenter and the first remote device is associated with a first tenant, the program further comprising sets of instructions for:

receiving a second data message sent by a second remote device that is associated with the first tenant;

identifying a second RDM attribute associated with the received second data message;

based on the second RDM attribute set, associating the second data message with a second logical network of the first tenant; and

forwarding the data message to the message'"'"'s destination within the network along a second tunnel, and inserting a second LNI for the second logical network in a header of the second tunnel.

13. The non-transitory machine readable medium of claim 12, wherein the first logical network is for a first set of users of the first tenant, and the second logical network is for a second set of users of the first tenant.

14. The non-transitory machine readable medium of claim 12, wherein the first logical network is for a first set of devices of the first tenant, and the second logical network is for a second set of devices of the first tenant.

15. The non-transitory machine readable medium of claim 12, wherein the first and second tunnels are the same tunnel.

16. The non-transitory machine readable medium of claim 12, wherein the first and second tunnels are different tunnels.

17. The non-transitory machine readable medium of claim 1, wherein the network is a network within a multi-tenant datacenter and the first remote device is associated with a first tenant, the program further comprising sets of instructions for:

receiving a second data message sent by a second remote device that is associated with a second tenant;

identifying a second RDM attribute associated with the received second data message;

based on the second RDM attribute set, associating the second data message with a second logical network associated with the second tenant; and

forwarding the data message to the message'"'"'s destination within the network along a second tunnel, and inserting a second LNI for the second logical network in a header of the second tunnel.

18. The non-transitory machine readable medium of claim 17, wherein the first and second logical networks are overlay logical networks that are established by tunnels connecting a plurality of shared managed forwarding elements.

19. The non-transitory machine readable medium of claim 18, wherein the plurality of shared managed forwarding elements communicatively connect computation nodes that execute on a plurality of shared computers.

20. The non-transitory machine readable medium of claim 1, wherein the first data message is part of a first data message flow, the program further comprising sets of instructions for:

receiving a second data message from the first remote device, said second data message part of a second data message flow from the first remote device;

identifying a second RDM attribute associated with the received second data message;

based on the second RDM attribute set, associating the second data message with a second logical network of the first tenant; and

forwarding the data message to the message'"'"'s destination within the network along a second tunnel, and inserting a second LNI for the second logical network in a header of the second tunnel.

22. The method of claim 1, wherein receiving the remote device data message comprises receiving the first data message through a second tunnel that connects the remote device to the network.

23. The method of claim 1, wherein the LNI is one of a logical layer 2 network identifier and a logical layer 3 network identifier.

21. A method of processing mobile-device data messages entering a network, the method comprising:

receiving a first data message sent by a first remote device;

identifying a first set of remote device management (RDM) attributes associated with the first data message;

based on the first RDM attribute set, associating the first data message with a first logical network; and

forwarding the first data message to a destination within the network along a first tunnel, and inserting a first logical network identifier (LNI) for the first logical network in a header of the first tunnel.