US 10,348,767 B1Granted

Cloud over IP session layer network

AssigneeZentera Systems, Inc.

InventorsJaushin Lee, Wei-Chin Chu, Quan Li, Hung Chuen Jason Lee

Life of this patent

Estimating the term…

Loading patent…

Abstract

Cloud endpoints are secured using agents and a controller connected to the agents. A whitelist identifies components and processes of an authorized multi-tiered application for the cloud. An application profile for the application specifies valid computing flows between components of a tier and components of another tier, where components of the tier are executed at an endpoint and the other components of the other tier are executed at another endpoint. Endpoints are provisioned with static routing tables identifying at least one subnet destination. A request is received at a first endpoint to connect to a second endpoint. If the second endpoint falls within the at least one subnet destination, the controller performs one or more further security checks including checking the application profile flow, whitelist, and endpoint quarantine list. A network kernel table at an endpoint that includes the static routing table may be periodically checked to detect tampering.

Claims15

Dependent claims

A method for securing, through a virtual network, a public cloud provided by a cloud services provider for an enterprise comprising:

providing a plurality of agents for a plurality of endpoints, the plurality of endpoints to be hosted by a plurality of server machines in the public cloud provided by the cloud services provider for the enterprise;
providing a controller that connects to the plurality of agents;
storing, at the controller, a whitelist identifying components of a multi-tiered application authorized by the enterprise to use the virtual network;
defining an application profile for the multi-tiered application, the application profile specifying valid computing flows between components of a tier of the multi-tiered application and components of another tier of the multi-tiered application, the components of the tier to be executed at an endpoint, and the other components of the other tier to be executed at another different endpoint;
provisioning the plurality of endpoints according to the application profile, the provisioning comprising generating a plurality of static routing tables for the plurality of endpoints, a static routing table for an endpoint comprising at least one Internet Protocol (IP) subnet;
distributing a first static routing table, and a first agent to a first endpoint, wherein when a request is received at the first endpoint to connect to a second endpoint, the first agent determines whether an IP address of the second endpoint falls within the at least one IP subnet;
when the IP address of the second endpoint falls within the at least one IP subnet, receiving, at the controller from the first agent, a request to perform a security check;
in response to the security check request, checking the whitelist to determine whether a requestor of the request to connect to the second endpoint is listed as a component of the multi-tiered application authorized to use the virtual network;
and
when the requestor of the request to connect to the second endpoint is not listed in the whitelist as a component of the multi-tiered application authorized to use the virtual network, denying the connection to the second endpoint.

7 more elements

A method for pre-defining a secure virtual network to connect endpoints in a public cloud provided by a cloud services provider for an enterprise and, after the pre-defining, enforcing security to allow only connections that were pre-defined, the pre-defining comprising:

storing, at a controller, a whitelist comprising plurality of authorized signatures corresponding to applications and processes authorized by the enterprise to use the secure virtual network;
defining application profiles for the applications, the application profiles specifying valid subnetworks and computing flows between groups of endpoints for the applications;
generating static routing tables based on the valid subnetworks for endpoints that are to be provisioned;
provisioning the plurality of endpoints into the valid subnetworks according to the application profiles, the provisioning comprising distributing the static routing tables to the endpoints;
and
the enforcing security comprising:
receiving, at a first endpoint, a request to connect to a second endpoint;
determining, at the first endpoint, whether an IP address of the second endpoint is within a valid subnetwork specified by a static routing table at the first endpoint;
after determining that the IP address of the second endpoint is within the valid subnetwork, issuing, from the first endpoint to the controller, a request to perform a security check;
receiving, at the controller, the request to perform the security check;
and
allowing, in response to the security check, the first endpoint to connect to the second endpoint when a plurality of conditions are satisfied,
wherein a first condition is satisfied when an IP address of the first endpoint is in a first group of endpoints, the IP address of the second endpoint is in a second group of endpoints, and a computing flow according to an application profile indicates the first group is allowed to connect to the second group,
a second condition is satisfied when a signature of a requestor of the request to connect, and a signature of a process triggered by the requestor matches authorized signatures specified in the whitelist, and
a third condition is satisfied when the IP address of the second endpoint is not found in a list of quarantined endpoints.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/442,469Filed 24 Feb 2017 · continuation in part
Priority: 26 Feb 2013
Granted: 9 Jul 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 67/10
Protocols: in which an application is distributed across nodes in the network
H04L 45/54
Routing or path finding of packets in data switching networks: organization of routing tables
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/029
For separating internal from external traffic, e.g. firewalls: firewall traversal, e.g. tunnelling or, creating pinholes

Family

Application61/769,713Us provisional application · filed 26 Feb 2013
Application61/769,691Us provisional application · filed 26 Feb 2013
Application61/770,320Us provisional application · filed 28 Feb 2013
Application14/187,091Parent of this continuation · filed 21 Feb 2014
Application14/190,019Parent of this continuation · filed 25 Feb 2014
Application14/817,874Parent of this continuation-in-part · filed 4 Aug 2015
Application62/274,287Us provisional application · filed 2 Jan 2016
Application62/299,124Us provisional application · filed 24 Feb 2016
Application15/347,414Parent of this continuation-in-part · filed 9 Nov 2016
Application15/396,227Parent of this continuation-in-part · filed 30 Dec 2016
US 9,712,624 B2Parent of this continuation-in-part
US 9,525,564 B2Parent of this continuation
Application15/347,414Parent of this continuation
US 9,634,990 B2Parent of this continuation-in-part
US 9,130,901 B2Parent of this continuation
Application14/817,874Parent of this continuation
US 10,382,401 B1Related patent
US 2014/0244851 A1Published application
US 2014/0245423 A1Published application
US 2015/0341318 A1Published application
US 2017/0064005 A1Published application
US 10,348,767 B1This patent

From the US filing history. Foreign family members aren’t listed.