Data network microsegmentation

• US 9,560,081 B1
• Filed: 06/24/2016
• Issued: 01/31/2017
• Est. Priority Date: 06/24/2016
• Status: Active Grant

• Current Assignee: vArmour Networks Inc
• Original Assignee: vArmour Networks Inc
• Inventors: Woolward, Marc
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US15/192,967
• Time in Patent Office: 221 Days
• Field of Search: 726/11
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for microsegmentation of data networks are provided herein. Exemplary methods include: receiving a high-level declarative policy; getting metadata associated with a plurality of containers from an orchestration layer; determining a low-level firewall rule set using the high-level declarative policy and the metadata; and configuring by a plurality of enforcement points a respective virtual switch of a plurality of virtual switches to process packets in accordance with the low-level firewall ruleset, the virtual switches being collectively communicatively coupled to the plurality of containers, such that network communications between a first group of containers and a second group of containers of the plurality of containers are not permitted, and communications between containers of the first group of containers are permitted.

Claims

1. A computer-implemented method for microsegmentation of data networks comprising:

receiving a high-level declarative policy;

getting metadata associated with a plurality of containers from an orchestration layer;

determining a low-level firewall rule set using the high-level declarative policy and the metadata; and

configuring by a plurality of enforcement points a respective virtual switch of a plurality of virtual switches to process packets in accordance with the low-level firewall ruleset, the virtual switches being collectively communicatively coupled to the plurality of containers, such that network communications between a first group of containers and a second group of containers of the plurality of containers are not permitted, and communications between containers of the first group of containers are permitted.

2. The computer-implemented method of claim 1, further comprising:

provisioning a new enforcement point, the new enforcement point being communicatively coupled with a virtual switch of the plurality of virtual switches, the virtual switch being coupled to at least one container of the plurality of containers; and

programming the virtual switch of the plurality of virtual switches to forward received network packets to the new enforcement point, the virtual switch being communicatively coupled to the at least one container.

3. The computer-implemented method of claim 2, further comprising:

receiving from the virtual switch a network packet;

detecting malicious behavior in the received network packet;

and logging the detection.

4. The computer-implemented method of claim 3, wherein the detection includes at least one of stateful, stateless, and application-aware packet inspection.

5. The computer-implemented method of claim 1, wherein the enforcement point can run on at least one of a bare-metal server, a virtual machine, and a container.

6. The computer-implemented method of claim 1, wherein the orchestration layer is at least one of Kubernetes, Diego, Docker Swarm, and Mesos.

7. The computer-implemented method of claim 1, wherein the high-level declarative policy comprises an intent-driven model, the intent-driven model specifying groups of containers and describing permitted connectivity, security, and network services between the groups.

8. The computer-implemented method of claim 1, wherein the low-level firewall ruleset comprises individual workload addresses to and/or from which network communications are at least one of forwarded, blocked, redirected, and logged.

9. The computer-implemented method of claim 1, wherein programming the virtual switch includes at least one of providing overflow rules and deploying a Linux bridge topology.

10. The computer-implemented method of claim 1, wherein at least some of the plurality of containers run on a virtual machine.

11. A system for microsegmentation of data networks comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions which are executable by the processor to perform a method comprising;

receiving a high-level declarative policy;

getting metadata associated with a plurality of containers from an orchestration layer;

determining a low-level firewall rule set using the high-level declarative policy and the metadata; and

configuring by a plurality of enforcement points a respective virtual switch of a plurality of virtual switches to process packets in accordance with the low-level firewall ruleset, the virtual switches being collectively communicatively coupled to the plurality of containers, such that network communications between a first group of containers and a second group of containers of the plurality of containers are not permitted, and communications between containers of the first group of containers are permitted.

12. The system of claim 11, further comprising:

provisioning a new enforcement point, the new enforcement point being communicatively coupled with a virtual switch of the plurality of virtual switches, the virtual switch being coupled to at least one container of the plurality of containers; and

programming the virtual switch of the plurality of virtual switches to forward received network packets to the new enforcement point, the virtual switch being communicatively coupled to the at least one container.

13. The system of claim 12, further comprising:

receiving from the virtual switch a network packet;

detecting malicious behavior in the received network packet;

and logging the detection.

14. The system of claim 13, wherein the detection includes at least one of stateful, stateless, and application-aware packet inspection.

15. The system of claim 11, wherein the enforcement point can run on at least one of a bare-metal server, a virtual machine, and a container.

16. The system of claim 11, wherein the orchestration layer is at least one of Kubernetes, Diego, Docker Swarm, and Mesos.

17. The system of claim 11, wherein the high-level declarative policy comprises an intent-driven model, the intent-driven model specifying groups of containers and describing permitted connectivity, security, and network services between the groups.

18. The system of claim 11, wherein the low-level firewall ruleset comprises individual workload addresses to and/or from which network communications are at least one of forwarded, blocked, redirected, and logged.

19. The system of claim 11, wherein programming the virtual switch includes at least one of providing overflow rules and deploying a Linux bridge topology.

20. The system of claim 11, wherein at least some of the plurality of containers run on a virtual machine.