Scalable federated policy for network-provided flow-based performance metrics
The present disclosure describes methods and systems for providing and enforcing scalable federated policies for network-provided flow-based performance metrics. Due to different security concerns related to different domains, varying group policies can be applied to different domains to ensure proper sharing and receipt of flow-based performance metrics. Some policies can limit the type of performance metric being shared among the nodes in the domain. Some policies allow less information to be exposed by specifying aggregated performance metrics to be shared among the nodes in the domain. A group key management infrastructure can be provided to enforce these group policies in the network in a scalable manner.
1. A method for providing flow-based performance metrics according to a group policy, the method comprising:
receiving, at a first sending node, a request for performance metrics;
verifying, at the first sending node, the request using a first cryptographic key associated with the group policy; and
in response to verifying that the request is associated with the group policy:
determining one or more first performance metrics based on the group policy; and
transmitting the one or more first performance metrics according to the group policy.
2. The method of claim 1 , further comprising:
transmitting an adding request from the first sending node to a group controller requesting to be added to the group policy.
3. The method of claim 1 , further comprising:
in response to the first sending node being added to the group policy, receiving the first cryptographic key associated with the group policy.
4. The method of claim 1 , further comprising:
in response to membership to the group policy being updated, receiving a second cryptographic key associated with the group policy, said second cryptographic key different from the first cryptographic key usable for verifying a further request associated with the group policy, said further request not verifiable using the first cryptographic key.
5. The method of claim 1 , wherein:
verifying the request using the first cryptographic key comprises decrypting the request using the first cryptographic key.
6. The method of claim 1 , wherein the first cryptographic key is distributed to the first sending node and other nodes associated with the group policy through a group key management protocol.
7. The method of claim 1 , wherein further comprising:
generating a group policy token in response to verifying that the request is associated with the group policy; and
forwarding the group policy token and the request to a second node in the same domain as the first sending node, said second node configured to transmit one or more second performance metrics towards the first sending node based on the group policy in response to verifying the request forwarded to the second node using the group policy token.
8. The method of claim 1 , wherein the group policy specifies one or more types of performance metrics to be shared among a group of nodes.
9. The method of claim 1 , wherein the group policy is among a plurality of group policies specifying different levels of authorizations to send or receive performance metrics.
10. A first sending node for providing flow-based performance metrics according to a group policy comprising:
at least one memory element storing instructions for a performance metrics module and instructions for a security module; and
at least one processor coupled to the at least one memory element for executing the instructions;
wherein the performance metrics module, when the instructions for the performance metrics module are executed by the at least one processor, receives a request for performance metrics;
wherein the security module, when the instructions for the security module are executed by the at least one processor, verifies the request using a first cryptographic key associated with the group policy; and
wherein the performance metrics module, when the instructions for the performance metrics module are executed by the at least one processor, determines one or more first performance metrics based on the group policy, and transmits the one or more first performance metrics according to the group policy.
11. The first sending node of claim 10 , wherein the at least one memory element stores the first cryptographic key and the security module receives the first cryptographic key through a group key management protocol.
12. The first sending node of claim 10 , wherein:
the security module, when the instructions for the security module are executed by the at least one processor, generates a group policy token in response to verifying that the request is associated with the group policy; and
the performance metrics module, when the instructions for the performance metrics module are executed by the at least one processor, forwards the group policy token and the request to a second node in the same domain as the first sending node, said second node transmits one or more second performance metrics towards the first sending node based on the group policy in response to verifying the request forwarded to the second node using the group policy token.
13. A computer-readable non-transitory medium comprising one or more instructions providing flow-based performance metrics according to a group policy, when the one or more instructions are executed by one or more processors, the following operations are performed:
receiving, at a first sending node, a request for performance metrics;
verifying, at the first sending node, the request using a first cryptographic key associated with the group policy; and
in response to verifying that the request is associated with the group policy:
determining one or more first performance metrics based on group policy; and
transmitting the one or more first performance metrics according to the group policy.
14. The computer-readable non-transitory medium of claim 13 , wherein the operations being performed when the one or more instructions in the computer-readable non-transitory medium are executed by the one or more processors further comprises:
transmitting an adding request from the first sending node to a group controller requesting to be added to the group policy.
15. The computer-readable non-transitory medium of claim 13 , wherein the operations being performed when the one or more instructions in the computer-readable non-transitory medium are executed by the one or more processors further comprises:
in response to the first sending node being added to the group policy, receiving the first cryptographic key associated with the group policy.
16. The computer-readable non-transitory medium of claim 13 , wherein the operations being performed when the one or more instructions in the computer-readable non-transitory medium are executed by the one or more processors further comprises:
in response to membership to the group policy being updated, receiving a second cryptographic key associated with the group policy, said second cryptographic key different from the first cryptographic key usable for verifying a further request associated with the group policy, said further request not verifiable using the first cryptographic key.
17. The computer-readable non-transitory medium of claim 13 , wherein the operations being performed when the one or more instructions in the computer-readable non-transitory medium are executed by the one or more processors further comprises receiving, by the first sending node, through a group key management protocol.
18. The computer-readable non-transitory medium of claim 13 , wherein the operations being performed when the one or more instructions in the computer-readable non-transitory medium are executed by the one or more processors further comprises:
generating a group policy token in response to verifying that the request is associated with the group policy; and
forwarding the group policy token and the request to a second node in the same domain as the first sending node, said second node configured to transmit one or more second performance metrics towards the first sending node based on the group policy in response to verifying the request forwarded to the second node using the group policy token.
19. The computer-readable non-transitory medium of claim 13 , wherein the computer-readable non-transitory medium further stores the group policy, and the group policy specifies one or more types of performance metrics to be shared among a group of nodes.
20. The computer-readable non-transitory medium of claim 13 , wherein the computer-readable non-transitory medium further stores the group policy, and the group policy is among a plurality of group policies specifying different levels of authorizations to send or receive performance metrics.