Group-based network segmentation using dynamic groups

Abstract

A network is partitioned into multiple domains and managed by a network controller. The network controller stores segmentation policies defined in terms of user groups, wherein members in a user group are identified by IP addresses or IP prefixes. An administrator controls which user groups communicate with each other and in which domains by associating segmentation policies with domains. Classification sources external to the network controller inform the network controller of changes to the membership of the user groups. The network controller uses the group membership information and segmentation policy/domain assignments to generate traffic policies. Each traffic policy is specific to a domain; the traffic policy is generated only from the segmentation policies of the domain, and consists of segmentation policy rules associated with the domain and members in the group's associated with those policy rules.