Network security using primary and secondary security group tags

Abstract

Techniques and architecture are described that provide secondary identifiers or group tags, e.g., security group tags (SGTs). Control security policies may then be provided for entities within a networking arrangement and separate policies per entity may be provided. This results in assigning a primary SGT per entity and secondary SGTs per entity, wherein the secondary SGT categories are the same at each entity. For example, the secondary SGTs may represent a location, a person, an organization, a partner of the organization, a service, a database, a type of record, etc. Generally, the primary SGTs may represent a location, an entity, an organization, a partner of the organization, a person, etc. Utilizing the 'hierarchal' SGT arrangement described herein, security may be efficiently enforced once at an ingress network node using primary SGTs and again at the egress network node using secondary SGTs.