Context aware microsegmentation

• US 9,467,476 B1
• Filed: 08/28/2015
• Issued: 10/11/2016
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: vArmour Networks Inc
• Original Assignee: vArmour Networks Inc
• Inventors: Shieh, Choung-Yaw, Lian, Jia-Jyi, Sun, Yi, Xu, Meng
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/839,649
• Time in Patent Office: 410 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Context aware microservice networks and contextual security policies for microservice networks are provided herein. In some embodiments, a system includes a plurality of microservices, each of the plurality of microservices having a plurality of distributed microservice components. At least a portion of the distributed microservice components execute on different physical or virtual servers in a data center or a cloud. The system also includes a plurality of logical security boundaries, with each of the plurality of logical security boundaries being created by a plurality of enforcement points positioned in association with the plurality of distributed microservice components. Each of plurality of microservices is bounded by one of the plurality of logical security boundaries.

Claims

1. A method for context aware security policy enforcement, the method comprising:

receiving, by a first enforcement point, network traffic sent to and from a first virtual machine, the first virtual machine providing a first microservice component;

selecting, by the first enforcement point, a first contextual security policy using attributes of the first virtual machine;

receiving, by a second enforcement point, network traffic sent to and from a second virtual machine, the second virtual machine providing a second microservice component;

selecting, by the second enforcement point, a second contextual security policy using attributes of the second virtual machine;

receiving, by a third enforcement point, network traffic sent to and from a third virtual machine, the third virtual machine providing a third microservice component, the first, the second, and the third virtual machines collectively providing a microservice, the microservice comprising the first, the second, and the third microservice components;

selecting, by the third enforcement point, a third contextual security policy using attributes of the third virtual machine; and

controlling, by the first, the second, and the third enforcement points, network traffic to and from the respective first, the second, and the third virtual machines using the respective first, the second, and the third contextual security policies, such that the first, the second, and the third virtual machines are logically partitioned together into one logical subnetwork, the controlling including;

applying a first set of security rules to the network traffic into and out of the logical subnetwork, the first set of security rules determined using at least one of the first, the second, and the third contextual security policies; and

applying a second set of security rules to the network traffic within the logical subnetwork, the second set of security rules determined using one or more of the first, the second, and the third contextual security policies.

2. The method according to claim 1, further comprising comparing the attributes of the first, the second, and the third virtual machines to security policies stored in a security policy database of a data center.

3. The method according to claim 1, wherein the attributes of the first, the second, and the third virtual machines comprise a location of a data center where the first, the second, and the third virtual machines reside.

4. The method according to claim 1, further comprising rejecting network traffic that violates at least one of the first and the second sets of security rules.

5. The method according to claim 1, wherein the first virtual machine within the logical subnetwork is subject to different local security requirements, the different local security requirements manifesting in the first contextual security policy.

6. The method according to claim 5, wherein the first virtual machine is located in a first country and the second and the third virtual machines are located in a second country, the first country being subject to a first set of security requirements and the second country being subject to a second set of security requirements, the first set of security requirements manifesting in the first contextual security policy, and the second set of security requirements manifesting in the second and the third contextual security policies.

7. The method of claim 1, wherein at least two of the first, the second, and the third virtual machines are physically collocated in a data center.

8. The method of claim 1, wherein at least one of the first, the second, and the third enforcement points is a virtual machine.

9. The method of claim 1 further comprising:

inspecting the received network traffic for malicious behavior.

10. The method of claim 9, wherein the inspecting comprises:

performing stateful inspection of the received network traffic.

11. The method of claim 1 further comprising:

measuring network traffic associated with one of the first, the second, and the third virtual machines; and

determining that the measured network traffic is indicative of malicious behavior.

12. The method of claim 11, wherein the determining includes:

comparing the measured network traffic to traffic rules, the traffic rules being included in at least one of the first, the second, and the third contextual security policies.

13. The method of claim 11 further comprising:

providing a warning about the malicious behavior when the malicious behavior is determined.

14. The method of claim 1 further comprising:

quarantining at least one of the first, the second, and the third virtual machines when network traffic associated with a respective one of the at least one of the first, the second, and the third virtual machines violates one or more of the first and the second sets of security rules.