Network Agent For Generating Platform Specific Network Policies

• US 20180278478A1
• Filed: 03/24/2017
• Published: 09/27/2018
• Est. Priority Date: 03/24/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Prasad, Rohit, Vu, Hai, Chang, Shih-Chun, Nguyen, Hoang, Gandham, Shashi, Yadav, Navindra, Vallem, Praneeth, Gupta, Sunil, Prasad, Ravi, Malhotra, Varun
• Granted Patent: US 10,523,512 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The disclosed technology relates to a network agent for generating platform specific network policies. A network agent is configured to receive a platform independent network policy from a network policy system, determine implementation characteristics of the network entity, generate platform specific policies from the platform independent network policy based on the implementation characteristics of the network entity, and implement the platform specific policies on the network entity.

Claims

1. A system comprising:

a processor; and

a non-transitory computer-readable medium storing instructions that, when executed by the system, cause the system to perform operations including;

receiving, by an agent controller, a platform independent network policy from a network policy system;

transmitting, via an interprocess communication channel, the platform independent network policy to an agent enforcer on the system, wherein the agent enforcer is associated with a privileged status on the system;

determining, by the agent enforcer, implementation characteristics of the system;

generating, by the agent enforcer, one or more platform specific policies from the platform independent network policy based on the implementation characteristics of the system; and

implementing, by the agent enforcer, the one or more platform specific policies on the system.

2. The system of claim 1, wherein the system is one network entity of a plurality of network entities associated with the network policy system.

3. The system of claim 1, wherein the agent controller is associated with an unprivileged status on the system.

4. The system of claim 1, wherein the operations further include:

identifying, by the agent enforcer, that a policy in the platform specific policies has been altered;

reverting the policy to an original state;

generating a report for the policy;

transmitting, via the interprocess communication channel, the report to the agent controller; and

transmitting, by the agent controller, the report to the network policy system.

5. The system of claim 1, wherein the platform independent network policy is generated by the network policy system based on a user intent statement.

6. The system of claim 1, wherein the implementation characteristics include at least one of an operating system or entity interface information.

7. The system of claim 1, wherein the operations further include:

accessing, by the agent enforcer, policy enforcement data associated with the implementation of the one or more platform specific on the system;

transmitting, via the interprocess communication channel, the policy enforcement data to the agent controller on the system,

generating, by the agent controller, a report including the policy enforcement data; and

transmitting, by the agent controller, the report to the network policy system.

8. A computer-implemented method comprising:

receiving, by an agent running on a network entity, a platform independent network policy from a network policy system;

determining implementation characteristics of the network entity;

generating platform specific policies from the platform independent network policy based on the implementation characteristics of the network entity; and

implementing the platform specific policies on the network entity.

9. The computer-implemented method of claim 8, wherein the agent running on the network entity comprises an agent controller and an agent enforcer;

and wherein the platform independent network policy is received by the agent controller.

10. The computer-implemented method of claim 9, further comprising:

transmitting, via an interprocess communication, the platform independent network policy to the agent enforcer; and

wherein the determining of the implementation characteristics of the network entity, the generating of the platform specific policies, and the implementing of the platform specific policies is performed by the agent enforcer.

11. The computer-implemented method of claim 9, wherein the agent controller is associated with an unprivileged status on the network entity.

12. The computer-implemented method of claim 9, wherein the agent enforcer is associated with a privileged status on the network entity.

13. The computer-implemented method of claim 8, wherein the network entity is one of a host machine, a virtual machine, a container, or an application.

14. The computer-implemented method of claim 8, further comprising

accessing policy enforcement data associated with the implementation of the platform specific policies on the network entity;

generating a report including the policy enforcement data; and

transmitting the report to the network policy system.

15. A non-transitory computer-readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:

receive, by an agent controller, a platform independent network policy from a network policy system;

transmit, via an interprocess communication channel, the platform independent network policy to an agent enforcer on the computing system, wherein the agent enforcer is associated with a privileged status on the computing system;

generate, by the agent enforcer, one or more platform specific policies from the platform independent network policy based on an operating system of the computing system; and

implement, by the agent enforcer, the one or more platform specific policies on the system.

16. The non-transitory computer-readable medium of claim 15, wherein the computing system is one network entity of a plurality of network entities associated with the network policy system.

17. The non-transitory computer-readable medium of claim 15, wherein the agent controller is associated with an unprivileged status on the computing system.

18. The non-transitory computer-readable medium of claim 15, wherein the instructions further cause the computing system to:

identify that a policy in the platform specific policies has been altered;

revert the policy to an original state;

generate a report for the policy; and

transmit the report to the network policy system.

19. The non-transitory computer-readable medium of claim 15, wherein the platform independent network policy is generated by the network policy system based on a user intent statement.

20. The non-transitory computer-readable medium of claim 15, wherein the instructions further cause the computing system to:

access policy enforcement data associated with an implementation of the one or more platform specific policies on the computing system;

generate a report including the policy enforcement data; and

transmit the report to the network policy system.