Enforcing consent contracts to manage network traffic
Techniques for creating consent contracts for devices that indicate whether the devices consent to receiving network-based communications from other devices. Further, the techniques include enforcing the consent contracts such that network-based communications are either allowed or disallowed in the network-communications layer prior to the network communications reaching the devices. Rather than simply allowing a device to communicate with any other device over a network, the techniques described herein include building in consent for network-based communications where the consent is consulted at one or more points in a communication process to make informed decisions about network-based traffic.
1. A method for enforcing a consent contract for network communications, the method comprising:
receiving, at a control-plane component and from first devices, consent data that indicates that the first devices have granted permissions to second devices to send network communications to the first devices, the consent data indicating at least one of Layer 3 (L3) or Layer 4 (L4) identifiers associated with the second devices;
creating, by the control-plane component, consent contracts indicating the permissions granted to the second devices by the first devices to receive the network communications from the second devices;
sending, from control-plane component, the consent contracts to a network device located in a software-defined wide area network (SD-WAN);
receiving, at the network device, the consent contracts that indicate the at least one of the L3 or L4 identifiers associated with the second devices and first devices that provided the granted permissions;
receiving, at the network device, a packet that is to be sent over the network;
identifying, from the packet, a first L3 or L4 identifier indicating a first device to which the packet is being sent and a second L3 or L4 identifier indicating a second device from which the packet was sent; and
determining, using the first L3 or L4 identifier and the second L3 or L4 identifier, whether a consent contract of the consent contracts indicates that the first device has granted permissions to the second device to send the packet to the first device.
2. The method of claim 1 , further comprising:
determining that the consent contracts indicate that the first device has granted the permissions to the second device to send the packet; and
sending the packet to a next-hop network device in the network such that the packet is being transmitted to the first device.
3. The method of claim 1 , further comprising:
determining that the consent contracts indicate that the first device has not granted permissions to the second device to send the packet to the first device; and
dropping the packet.
4. The method of claim 1 , wherein the packet is a synchronize packet usable to establish a Transport Control Protocol (TCP) connection, and the network device is located in a Wide Area Network (WAN).
5. The method of claim 1 , wherein the network device comprises at least one of:
a network router;
a network switch;
a network modem;
a network hub;
a network gateway; or
a network access point.
6. The method of claim 1 , wherein individual ones of the consent contracts indicate mappings between a plurality of first addresses associated with the first devices to a plurality of second addresses associated with the second device from which the first devices have consented to receive network communications.
7. The method of claim 1 , further comprising:
determining that a threshold period of time associated with expiration of the consent contract has elapsed; and
invaliding the consent contract based at least in part on the threshold period of time elapsing.
8. The method of claim 1 , wherein the control-plane component is associated with at least one of:
a Domain Name System (DNS) provider configured to create the consent contracts; or
a Certificate Authority (CA) systems configured to create the consent contracts.
9. The method of claim 1 , further comprising:
determining that the consent contracts do not include the consent contract;
sending a request to the control-plane component for consent contracts associated with the first device; and
receiving the consent contract from the control-plane component.
10. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, at a control-plane component and from first devices, consent data that indicates that the first devices have granted permissions to second devices to send network communications to the first devices, the consent data indicating at least one of Layer 3 (L3) or Layer 4 (L4) identifiers associated with the second devices;
creating, by the control-plane component, consent contracts indicating the permissions granted to the second devices by the first devices to receive the network communications from the second devices;
sending, from control-plane component, the consent contracts to a network device located in a software-defined wide area network (SD-WAN);
receiving, at the network device, the consent contracts that indicate the at least one of the L3 or L4 identifiers associated with the second devices and first devices that provided the granted permissions;
receiving, at the network device, a packet that is to be sent over the network;
identifying, from the packet, a first L3 or L4 identifier indicating a first device to which the packet is being sent and a second L3 or L4 identifier indicating a second device from which the packet was sent; and
determining, using the first L3 or L4 identifier and the second L3 or L4 identifier, whether a consent contract of the consent contracts indicates that the first device has granted permissions to the second device to send the packet to the first device.
11. The system of claim 10 , the operations further comprising:
determining that the consent contracts indicate that the first device has granted the permissions to the second device to send the packet; and
sending the packet to a next-hop network device in the network such that the packet is being transmitted to the first device.
12. The system of claim 10 , the operations further comprising:
determining that the consent contracts indicate that the first device has not granted permissions to the second device to send the packet to the first device; and
dropping the packet.
13. The system of claim 10 , wherein the packet is a synchronize packet usable to establish a Transport Control Protocol (TCP) connection, and the network device is located in a Wide Area Network (WAN).
14. The system of claim 10 , wherein the network device comprises at least one of:
a network router;
a network switch;
a network modem;
a network hub;
a network gateway; or
a network access point.
15. The system of claim 10 , wherein individual ones of the consent contracts indicate mappings between a plurality of first addresses associated with the first devices to a plurality of second addresses associated with the second device from which the first devices have consented to receive network communications.
16. The system of claim 10 , the operations further comprising:
determining that a threshold period of time associated with expiration of the consent contract has elapsed; and
invaliding the consent contract based at least in part on the threshold period of time elapsing.
17. The system of claim 10 , wherein the control-plane component is associated with at least one of:
a Domain Name System (DNS) provider configured to create the consent contracts; or
a Certificate Authority (CA) systems configured to create the consent contracts.
18. The system of claim 10 , the operations further comprising:
determining that the consent contracts do not include the consent contract;
sending a request to the control-plane component for consent contracts associated with the first device; and
receiving the consent contract from the control-plane component.
19. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, at a control-plane component and from first devices, consent data that indicates that the first devices have granted permissions to second devices to send network communications to the first devices, the consent data indicating at least one of Layer 3 (L3) or Layer 4 (L4) identifiers associated with the second devices;
creating, by the control-plane component, consent contracts indicating the permissions granted to the second devices by the first devices to receive the network communications from the second devices;
sending, from control-plane component, the consent contracts to a network device located in a software-defined wide area network (SD-WAN);
receiving, at the network device, the consent contract that indicate the at least one of the L3 or L4 identifiers associated with the second devices and first devices that provided the granted permissions;
receiving, at the network device, a packet that is to be sent over the network;
identifying, from the packet, a first L3 or L4 identifier indicating a first device to which the packet is being sent and a second L3 or L4 identifier indicating a second device from which the packet was sent; and
determining, using the first L3 or L4 identifier and the second L3 or L4 identifier, whether a consent contract of the consent contracts indicates that the first device has granted permissions to the second device to send the packet to the first device.
20. The one or more non-transitory computer-readable media of claim 19 , the operations further comprising:
determining that the consent contracts do not include the consent contract;
sending a request to the control-plane component for consent contracts associated with the first device; and
receiving the consent contract from the control-plane component.