# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
###### Abstract  
As information technology continues to evolve, cloud data centres have become increasingly prominent as the preferred infrastructure for data storage and processing. However, this shift has introduced a new array of security challenges, necessitating innovative approaches distinct from traditional network security architectures. In response, the Zero Trust Architecture (ZTA) has emerged as a promising solution, with micro-segmentation identified as a crucial component for enabling continuous auditing and stringent security controls. VxLAN technology is widely utilized in data centres for tenant isolation and virtual machine interconnection within tenant environments. Despite its prevalent use, limited research has focused on its application in micro-segmentation scenarios. To address this gap, we propose a method that leverages VLAN and VxLAN many-to-one mapping, requiring that all internal data centre traffic routes through the VxLAN gateway. This method can be implemented cost-effectively, without necessitating business modifications or causing service disruptions, thereby overcoming the challenges associated with micro-segmentation deployment. Importantly, this approach is based on standard public protocols, making it independent of specific product brands and enabling a network-centric framework that avoids software compatibility issues. To assess the effectiveness of our micro-segmentation approach, we provide a comprehensive evaluation that includes network aggregation and traffic visualization. Building on the implementation of micro-segmentation, we also introduce an enhanced asset behaviour algorithm. This algorithm constructs behavioural profiles based on the historical traffic of internal network assets, enabling the rapid identification of abnormal behaviours and facilitating timely defensive actions. Empirical results demonstrate that our algorithm is highly effective in detecting anomalous behaviour in intranet assets, making it a powerful tool for enhancing security in cloud data centres. In summary, the proposed approach offers a robust and efficient solution to the challenges of micro-segmentation in cloud data centres, contributing to the advancement of secure and reliable cloud infrastructure. zero-trust; micro-segmentation; VxLAN +
Footnote †: journal:  
002  
has reached USD 586.4 billion and is expected to exceed USD 1 trillion by 2027 due to the advantages of flexibility, scalability, and high return on investment in cloud computing construction. However, the widespread use of cloud computing technology has resulted in new security challenges that need to be addressed, including:  
* The efficiency and convenience offered by cloud computing have blurred traditional security boundaries, thereby presenting a significant challenge. * The ability of cloud computing to seamlessly transition between various hosts to achieve high availability or dynamic resource balancing has rendered conventional security policies ineffective and obsolete. * While the scalability of cloud computing facilitates the creation of on-demand resources, the batch-wise construction of cloud infrastructure introduces a challenge pertaining to device brand compatibility. Consequently, this incompatibility impedes the enforcement of security policies across cloud hosts. * The inherent invisibility of in-cloud traffic represents a substantial obstacle for ensuring robust in-cloud security measures. Addressing this challenge requires innovative approaches and solutions that can effectively monitor and safeguard the flow of traffic within cloud environments. Zero trust first appeared in 2004, when the Jericho Forum ([[https://www.opengroup.org/forum/security](https://www.opengroup.org/forum/security)]([https://www.opengroup.org/forum/security](https://www.opengroup.org/forum/security))) began seeking security architecture and solutions to address the trend of blurred boundaries. They proposed that de-perimeterization has happened, is happening, and is inevitable [5].