In-data-plane network policy enforcement using IP addresses
The present disclosure provides a method of embedding finer grained information such as user identity and application identity in IPv6 addresses used for end-to-end communications within a network. The finer grained information can be used for improved policy enforcement within the network. In one aspect, generating an address for an end-to-end communication within a network, the address including a user identifier and an application identifier for network policy enforcement; assigning the address to an application used in the end-to-end communication; and performing network segmentation and the network policy enforcement within the network using the address.
1. A method comprising:
generating an address that is an IPv6 address and is application specific and device independent by embedding a user identifier and an application identifier into the IPv6 address for network policy enforcement in an end-to-end communication within a network;
assigning the address to an application used in the end-to-end communication independent from a specific terminal either requesting access to the application or accessing the application; and
performing network segmentation and the network policy enforcement within the network using the address encoded in either or both source and destination fields of corresponding IPv6 headers in one or more data packets transmitted in the end-to-end communication.
2. The method of claim 1 , wherein the address further includes a group identifier for the network policy enforcement.
3. The method of claim 2 , wherein the group identifier includes same VXLAN Network Identifier (VNI) size and Scalable Group Tags (SGT).
4. The method of claim 2 , wherein the user identifier, the application identifier and the group identifier are included in a prefix of the address.
5. The method of claim 1 , further comprising:
detecting an execution instance of the application at an edge router of the network.
6. The method of claim 1 , wherein the address is generated using an identity service engine associated with the network.
7. The method of claim 1 , further comprising:
routing data packets within the network using the address and a network mobility protocol for mapping the address to one or more network locations.
8. A network controller comprising:
memory having computer-readable instructions stored therein; and
one or more processors configured to execute the computer-readable instructions to:
generate an address that is an IPv6 address and is application specific and device independent by embedding a user identifier and an application identifier into the IPv6 address for network policy enforcement in an end-to-end communication within a network;
assign the address to an application used in the end-to-end communication independent from a specific terminal either requesting access to the application or accessing the application; and
perform network segmentation and the network policy enforcement within the network using the address encoded in either or both source and destination fields of corresponding IPv6 headers in one or more data packets transmitted in the end-to-end communication.
9. The network controller of claim 8 , wherein the address further includes a group identifier for the network policy enforcement.
10. The network controller of claim 9 , wherein the group identifier includes same VXLAN Network Identifier (VNI) size and Scalable Group Tags (SGT).
11. The network controller of claim 9 , wherein the user identifier, the application identifier and the group identifier are included in a prefix of the address.
12. The network controller of claim 8 , wherein the one or more processors are further configured to execute the computer-readable instructions to detect an execution instance of the application at an edge router of the network.
13. The network controller of claim 8 , wherein the address is generated using an identity service engine associated with the network.
14. The network controller of claim 8 , wherein the one or more processors are further configured to execute the computer-readable instructions to route data packets within the network using the address and a network mobility protocol for mapping the address to one or more network locations.
15. One or more non-transitory computer-readable media comprising computer-readable instructions, which when executed by one or more processors, cause the one or more processors to:
generate an address that is and IPv6 address and is application specific and device independent by embedding a user identifier and an application identifier into the IPv6 address for network policy enforcement in an end-to-end communication within a network;
assign the address to an application used in the end-to-end communication independent from a specific terminal either requesting access to the application or accessing the application; and
perform network segmentation and the network policy enforcement within the network using the address encoded in either or both source and destination fields of corresponding IPv6 headers in one or more data packets transmitted in the end-to-end communication.
16. The one or more non-transitory computer-readable media of claim 15 , wherein the address further includes a group identifier for the network policy enforcement, the group identifier includes same VXLAN Network Identifier (VNI) size and Scalable Group Tags (SGT).
17. The one or more non-transitory computer-readable media of claim 15 , wherein the one or more processors are further configured to execute the computer-readable instructions to detect an execution instance of the application at an edge router of the network.
18. The one or more non-transitory computer-readable media of claim 15 , wherein the user identifier and the application identifier are included in a prefix of the address.
19. The one or more non-transitory computer-readable media of claim 18 , wherein the address includes a group identifier for the network policy enforcement that is included in the prefix of the address.
20. The one or more non-transitory computer-readable media of claim 15 , wherein the address is generated using an identity service engine associated with the network.