Policy enforcement based on dynamically attribute-based matched network objects

• US 9,537,891 B1
• Filed: 12/20/2013
• Issued: 01/03/2017
• Est. Priority Date: 09/27/2011
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Fitz-Gerald, Jeffrey, Walter, Martin
• Primary Examiner(s): Nguyen, Dustin
• Application Number:
  US14/137,718
• Time in Patent Office: 1,110 Days
• Field of Search: 709/229, 709/236, 709/225, 709/249, 726/1, 726/11, 726/3, 726/9, 726/25, 707/102, 705/36, 705/6.36
• US Class Current: 1/1
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A policy that includes an address group is received. The policy is compiled into a set of one or more rules. The compiling is performed at least in part by determining members of the address group. The compiling can further include substituting one or more IP addresses of the members for the address group. At least one rule included in the set of rules is enforced.

Claims

1. A system, comprising:

a processor configured to;

receive a policy that includes an address group object, wherein the address group object abstracts a set of computing assets;

compile the policy into a set of one or more rules, at least in part by substituting, for the address group object, a set of one or more IP addresses of computing assets determined to be members of an address group corresponding to the address group object, wherein determining the members of the address group includes querying a set of one or more repositories of computing asset information using a set of match criteria, wherein at least one criterion in the set of match criteria pertains to a characteristic of a computing asset;

determine, based at least in part on a detected change to the address group, that at least one rule included in the set of rules should be recompiled;

in response to the determination, perform a recompilation, including by substituting a first IP address in an out-of-date rule for a second IP address to create an updated rule; and

enforce the updated rule at least one rule; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein at least one match criterion included in the set of match criteria comprises a tag associated with an asset included in the set of computing assets.

3. The system of claim 2 wherein the tag is associated with a color.

4. The system of claim 1 wherein at least one computing asset included in the address group is manually enumerated.

5. The system of claim 1 wherein the determination is made in response to a provisioning event, in which an additional computing asset is included in the address group.

6. The system of claim 1 wherein the determination is made in response to a migration event, in which an IP address of an existing member of the address group is changed.

7. A method, comprising:

receiving a policy that includes an address group object, wherein the address group object abstracts a set of computing assets;

compiling the policy into a set of one or more rules, at least in part by substituting, for the address group object, a set of one or more IP addresses of computing assets determined to be members of an address group corresponding to the address group object, wherein determining the members of the address group includes querying a set of one or more repositories of computing asset information using a set of match criteria, wherein at least one criterion in the set of match criteria pertains to a characteristic of a computing asset;

determining, based at least in part on a detected change to the address group, that at least one rule included in the set of rules should be recompiled;

in response to the determination, performing a recompilation, including by substituting a first IP address in an out-of-date rule for a second IP address to create an updated rule; and

enforcing the updated rule.

8. The method of claim 7 wherein the determination is made in response to a provisioning event, in which an additional computing asset is included in the address group.

9. The method of claim 7 wherein the determination is made in response to a migration event, in which an IP address of an existing member of the address group is changed.

11. The method of claim 7 wherein at least one match criterion included in the set of match criteria comprises a tag associated with an asset included in the set of computing assets.

12. The method of claim 11 wherein the tag is associated with a color.

13. The method of claim 11 wherein at least one computing asset included in the address group is manually enumerated.

10. A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for:

receiving a policy that includes an address group object, wherein the address group object abstracts a set of computing assets;

compiling the policy into a set of one or more rules, at least in part by substituting, for the address group object, a set of one or more IP addresses of computing assets determined to be members of an address group corresponding to the address group object, wherein determining the members of the address group includes querying a set of one or more repositories of computing asset information using a set of match criteria, wherein at least one criterion in the set of match criteria pertains to a characteristic of a computing asset;

determining, based at least in part on a detected change to the address group, that at least one rule included in the set of rules should be recompiled;

in response to the determination, performing a recompilation, including by substituting a first IP address in an out-of-date rule for a second IP address to create an updated rule; and

enforcing the updated rule.

14. The computer program product of claim 10 wherein at least one match criterion included in the set of match criteria comprises a tag associated with an asset included in the set of computing assets.

15. The computer program product of claim 14 wherein the tag is associated with a color.

16. The computer program product of claim 10 wherein at least one computing asset included in the address group is manually enumerated.

17. The computer program product of claim 10 wherein the determination is made in response to a provisioning event, in which an additional computing asset is included in the address group.

18. The computer program product of claim 10 wherein the determination is made in response to a migration event, in which an IP address of an existing member of the address group is changed.