Method and apparatus for ingress filtering using security group information

1. A method comprising:

receiving a packet at a network node of a network, after said packet has been received by an ingress node of said network, wherein

said packet comprises access control information,

said network comprises a plurality of nodes,

said ingress node is the first node of said plurality of nodes to receive said packet, and

said network node is a network node of said plurality of nodes other than said ingress node;

performing access control processing on said packet at said network node, after said packet has been received at said network node,

wherein

said access control processing identifies said access control information of said packet,

said access control information comprises

security group information, and

an address of a destination node,

said security group information identifies a security group,

said destination node is a member of said security group, and

said destination node is a destination of said packet; and

sending another packet from said network node to said ingress node, in response to said access control processing, wherein

said another packet comprises said access control information.

2. The method of claim 1 , further comprising:

receiving said packet at an egress node of said packet; and

performing said sending, if said packet is denied.

3. The method of claim 2 , further comprising:

associating said address and said security group information with one another.

4. The method of claim 3 , further comprising:

receiving a subsequent packet at said ingress node, wherein

said subsequent packet comprises

a destination address; and

determining destination security group information using said destination address.

5. The method of claim 4 , wherein

if said destination address is said address, said destination security group information is said security group information.

6. The method of claim 4 , further comprising:

performing subsequent access control processing using said destination security group information.

7. The method of claim 6 , further comprising:

if said subsequent access control processing results in said subsequent packet being denied, dropping said subsequent packet at said ingress node.

8. The method of claim 6 , further comprising:

determining source security group information, wherein

said source security group information identifies a security group of a source network node,

said source network node is a source of said subsequent packet, and

said access control processing uses said source security group information.

9. The method of claim 8 , wherein

said subsequent packet further comprises

said source security group information.

10. The method of claim 2 , wherein said another packet is a control packet.

11. The method of claim 10 , further comprising:

associating said address and said security group information with one another.

12. The method of claim 11 , further comprising:

receiving subsequent packet at said ingress node, wherein

said subsequent packet comprises

a destination address;

determining destination security group information using said destination address;

determining source security group information, wherein

said source security group information identifies a security group of a source network node, and

said source network node is a source of said subsequent packet; and

performing subsequent access control processing using said source security group information and said destination security group information.

13. The method of claim 12 , wherein

if said destination address is said address, said destination security group information is said security group information.

14. A computer program product comprising:

a first set of instructions, executable on a computer system, configured to cause a network node of a network to receive a packet, after said packet has been received by an ingress node of said network, wherein

said packet comprises access control information,

said network comprises a plurality of nodes,

said ingress node is the first node of said plurality of nodes to receive said packet, and

said network node is a network node of said plurality of nodes other than said ingress node;

a second set of instructions, executable on said computer system, configured to cause said network node to perform access control processing on said packet, wherein

said first set of instructions are further configured to perform said access control processing after said packet has been received by said network node,

said access control processing identifies said access control information of said packet,

said access control information comprises

security group information, and

an address of a destination node,

said security group information identifies a security group,

said destination node is a member of said security group, and

said destination node is a destination of said packet;

a third set of instructions, executable on said computer system, configured to cause said network node to send another packet from said network node to said ingress node, in response to said second set of instructions, wherein

said another packet comprises said access control information; and

a computer readable storage medium, wherein said computer program product is encoded in said computer readable medium.

15. The computer program product of claim 14 , further comprising:

a fourth set of instructions, executable on said computer system, configured to receive said packet at an egress node of said packet; and

a fifth set of instructions, executable on said computer system, configured to perform said sending, if said packet is denied.

16. The computer program product of claim 15 , further comprising:

a sixth set of instructions, executable on said computer system, configured to associate said address and said security group information with one another.

17. The computer program product of claim 16 , further comprising:

a seventh set of instructions, executable on said computer system, configured to receive a subsequent packet at said ingress node, wherein

said subsequent packet comprises

a destination address; and

an eighth set of instructions, executable on said computer system, configured to determine destination security group information using said destination address.

18. The computer program product of claim 17 , wherein if said destination address is said address, said destination security group information is said security group information.

19. The computer program product of claim 17 , further comprising:

a ninth set of instructions, executable on said computer system, configured to perform subsequent access control processing using said destination security group information.

20. The computer program product of claim 19 , further comprising:

a tenth set of instructions, executable on said computer system, configured to drop said subsequent packet at said ingress node, if said subsequent access control processing results in said subsequent packet being denied.

21. The computer program product of claim 19 , further comprising:

a tenth set of instructions, executable on said computer system, configured to determining source security group information, wherein

said source security group information identifies a security group of a source network node,

said source network node is a source of said subsequent packet, and

said access control processing uses said source security group information.

22. The computer program product of claim 21 , wherein said

said subsequent packet further comprises

said source security group information.

23. The computer program product of claim 15 , wherein

said another packet is a control packet.

24. The computer program product of claim 23 , further comprising:

a sixth set of instructions, executable on said computer system, configured to associate said address and said security group information with one another.

25. The computer program product of claim 24 , further comprising:

a seventh set of instructions, executable on said computer system, configured to receive a subsequent packet at said ingress node, wherein

said subsequent packet comprises

a destination address;

an eighth set of instructions, executable on said computer system, configured to determine destination security group information using said destination address;

a ninth set of instructions, executable on said computer system, configured to determine source security group information, wherein

said source security group information identifies a security group of a source network node, and

said source network node is a source of said subsequent packet; and

a tenth set of instructions, executable on said computer system, configured to perform subsequent access control processing using said source security group information and said destination security group information.

26. An apparatus comprising:

a network node of a network, comprising

a processor,

means for receiving a packet at a network node of a network, after said packet has been received by an ingress node of said network, wherein

said means for receiving is coupled to said processor,

said packet comprises access control information,

said network comprises a plurality of nodes,

said ingress node is the first node of said plurality of nodes to receive said packet, and

said network node is a network node of said plurality of nodes other than said ingress node,

means for performing access control processing on said packet at said network node, wherein

said means for performing is coupled to said processor and said means for receiving,

said means for performing is configured to perform said access control processing after said packet has been received at said network node,

said means for performing is configured to identify said access control information of said packet,

said access control information comprises

security group information, and

an address of a destination node,

said security group information identifies a security group,

said destination node is a member of said security group, and

said destination node is a destination of said packet, and

means for sending another packet from said network node to said ingress node responsive to said means for performing, wherein

said another packet comprises said access control information, and

said means for sending is coupled to said processor and said means for performing.

27. The apparatus of claim 26 , further comprising:

means for receiving said packet at an egress node of said packet, wherein

said means for sending said another packet is configured to send said another packet if said packet is denied.

28. The apparatus of claim 27 , further comprising:

means for associating said address and said security group information with one another.

29. The apparatus of claim 28 , further comprising:

means for receiving a subsequent packet at said ingress node, wherein

said subsequent packet comprises

a destination address; and

means for determining destination security group information using said destination address.

30. The apparatus of claim 29 , wherein

if said destination address is said address, said destination security group information is said security group information.

31. The apparatus of claim 29 , further comprising:

means for performing subsequent access control processing, wherein

said means for performing subsequent access control processing is configured to use said destination security group information.

32. The apparatus of claim 31 , further comprising:

means for dropping said subsequent packet at said ingress node, if said subsequent access control processing results in said subsequent packet being denied.

33. The apparatus of claim 31 , further comprising:

means for determining source security group information, wherein

said source security group information identifies a security group of a source network node,

said source network node is a source of said subsequent packet, and

said access control processing uses said source security group information.

34. The apparatus of claim 33 , wherein

said subsequent packet further comprises

said source security group information.

35. The apparatus of claim 27 , wherein

said another packet is a control packet.

36. The apparatus of claim 35 , further comprising:

means for associating said address and said security group information with one another.

37. The apparatus of claim 36 , further comprising:

means for receiving a subsequent packet at said ingress node, wherein

said subsequent packet comprises

a destination address;

means for determining destination security group information using said destination address;

means for determining source security group information, wherein

said source security group information identifies a security group of a source network node, and

said source network node is a source of said subsequent packet; and

means for performing subsequent access control processing using said source security group information and said destination security group information.

38. A method comprising:

propagating a packet from a network node of a network to an ingress node of said network, wherein

said network comprises a plurality of nodes,

said ingress node is the first node of said plurality of nodes to receive another packet,

said network node is a network node of said plurality of nodes other than said ingress node,

said packet comprises access control information,

said another packet comprises said access control information,

said propagating is performed in response to access control processing performed on said another packet at said network node after said another packet has been received by said ingress node,

said access control information comprises

security group information, and

an address of a destination node,

said security group information identifies a security group, and

said destination node is a member of said security group.

39. The method of claim 38 , wherein

said packet is propagated from an egress node to said ingress node.

40. The method of claim 38 , further comprising:

determining said security group information using said address.

41. The method of claim 40 , wherein

said performing said access control processing comprises using said security group information.

42. The method of claim 41 , wherein

said packet is propagated from an egress node to said ingress node.

43. The method of claim 42 , further comprising:

receiving said another packet at said ingress node;

forwarding said another packet to said egress node, wherein

said determining and said performing said access control are performed at said egress node;

receiving said another packet at said egress node; and

performing said determining and said performing said access control at said egress node.

44. The method of claim 42 , further comprising:

receiving said another packet at said egress node, wherein

said performing said access control processing comprises

determining if said another packet should be denied.

45. The method of claim 44 , further comprising:

if said another packet is denied, initiating said propagating.

46. The method of claim 41 , further comprising:

determining source security group information, wherein

said source security group information identifies a group of a source network node, and

said performing said access control processing uses said source security group information.

47. The method of claim 46 , wherein

said source network node is a source of said another packet, and

said another packet comprises

said source security group information, and

said address.

48. The method of claim 47 , wherein said performing said access control processing comprises:

determining if said another packet should be denied.

49. The method of claim 48 , further comprising:

if said another packet is denied, initiating said propagating.

50. The method of claim 42 , wherein

said packet is a control packet.

51. The method of claim 50 , further comprising:

receiving said another packet at said ingress node; and

determining source security group information, wherein

a source network node is a source of said another packet, and

said another packet comprises

source security group information, and

a destination address,

said source security group information identifies a group of said source network node, and

said performing said access control processing uses said source security group information.

52. The method of claim 51 , wherein

said performing said access control processing comprises

determining if said another packet should be denied.

53. The method of claim 52 , further comprising:

if said another packet is denied, performing said propagating.

54. The method of claim 53 , further comprising:

creating a binding between said address and said security group information at said ingress node.

55. The method of claim 54 , further comprising:

receiving a first packet at said ingress node; and

filtering said first packet using said binding.

56. The method of claim 55 , further comprising:

sending said first packet to an egress node;

filtering said first packet at said egress node; and

if said first packet is denied as a result of said filtering at said egress node, sending said control packet to said ingress node.

57. The method of claim 56 , further comprising:

filtering said another packet using said security group information.

58. A method comprising:

receiving, from a network node of a network, security group information and an address of a destination node at an ingress node of said network as a result of a first packet being filtered by said network node after said first packet has been received by said ingress node, wherein

said first packet comprises said security group information and said address,

said network comprises a plurality of nodes,

said ingress node is the first node of said plurality of nodes to receive said first packet,

said network node is a network node of said plurality of nodes other than said ingress node,

said receiving comprises receiving another packet, and

said another packet comprises said security group information and said address; and

associating said security group information with said address, wherein

said security group information identifies a security group, and

said destination node is a member of said security group.

59. The method of claim 58 , wherein

said another packet is a control packet.

60. The method of claim 58 , wherein

said another packet is a control packet, and

said another packet is received at said ingress node.

61. The method of claim 60 , wherein said associating comprises:

creating a binding between said address and said security group information at said ingress node.

62. The method of claim 61 , further comprising:

deleting said binding in response to a criteria being met.

63. The method of claim 61 , further comprising: filtering a second packet using said binding, wherein

said second packet is received at said ingress node.

64. The method of claim 63 , further comprising:

receiving a third packet at said ingress node;

sending said third packet to an egress node;

filtering said third packet at said egress node; and

as a result of said filtering at said egress node, sending a second control packet to said ingress node.

65. The method of claim 64 , wherein said filtering said third packet at said egress node comprises:

determining a destination address from said third packet, wherein

said destination address is an address of a destination network node of said third packet;

determining destination security group information using said destination address; and

comparing said destination security group information and source security group information, wherein

said source security group information identifies a source network node of said third packet.

66. The method of claim 65 , wherein

said destination address is said address, and

said destination security group information is said security group information.

67. The method of claim 58 , further comprising: filtering a second packet using said security group information, wherein said second packet is received at said ingress node.

68. The method of claim 67 , wherein

said second packet comprises source security group information,

said source security group information identifies a security group of a source network node of said second packet, and

said source network node is a member of said security group.

69. The method of claim 68 , wherein

said filtering uses said source security group information and said security group information.

70. The method of claim 69 , wherein

said second packet further comprises a destination address.

71. The method of claim 70 , further comprising:

determining said security group information using said destination address.

72. The method of claim 67 , wherein

said filtering comprises performing access control.

73. The method of claim 72 , wherein

said second packet comprises source security group information,

said source security group information identifies a security group of a source network node of said second packet, and

said source network node is a member of said security group.

74. The method of claim 73 , wherein

said performing said access control uses said source security group information and said security group information.

75. The method of claim 72 , wherein

said second packet is denied a result of said performing said access control.

76. The method of claim 64 , wherein said filtering said third packet at said egress node comprises:

determining a destination address from said third packet, wherein

said destination address is an address of a destination network node of said third packet;

determining destination security group information using said destination address; and

comparing said destination security group information and source security group information, wherein

said source security group information identifies a source network node of said first packet.