US 10,375,103 B1Granted

Dynamic detection of firewall misconfigurations

AssigneeAmazon Technologies, Inc.

InventorEric Jason Brandwine

Life of this patent

Estimating the term…

Loading patent…

Abstract

An automated scanning service can be configured to dynamically determine potential firewall misconfigurations in a shared resource environment. The scanning service can interrogate one or more application programming interfaces (APIs) to determine the state of the relevant firewall ports. For each firewall port in a permitted state, a test or trace can be run to determine whether the corresponding host port is open. Similarly, information can be obtained indicating which host ports for the allocation are open, and a determination can be made as to whether the corresponding firewall ports are permitted. Once the determinations are made, any mismatch in port state can be reported as a potential misconfiguration.

Claims19

Dependent claims

A computer-implemented method, comprising:

receiving a request to verify a configuration of a plurality of firewall ports associated with a customer allocation of resources in a resource provider environment, the customer allocation including at least one virtual host machine and a plurality of host ports, each host port associated with a corresponding firewall port of the plurality of firewall ports;
obtaining, via at least one application programming interface (API) for the customer allocation, firewall state information for the plurality of firewall ports, the firewall state information indicating either a permitted state or a denied state for each of the plurality of firewall ports;
sending a test packet to the corresponding host port, through the firewall port, for each firewall port having the permitted state;
storing whether an acknowledgement response was received for each packet to indicate that a corresponding host port has the open state;
determining host state information, exposed by the customer allocation, indicating at least the host ports of the customer allocation having the open state;
determining, based at least in part upon the host state information and the firewall state information, whether the corresponding firewall port for a respective host port with the open state has the permitted state;
and
providing a notification regarding at least any firewall port of the plurality of firewall ports, having a determined state, of the permitted state or the denied state, being different from the determined state of the corresponding host port for the customer allocation, the different determined state being indicative of a potential misconfiguration.

5 more elements

A computer-implemented method, comprising:

determining a set of firewall ports associated with a set of resource ports in a programmatically-controllable resource environment, the resource environment including an allocation of the firewall ports and the set of resource ports, with at least one virtual resource executed using one or more physical resources of the resource environment;
obtaining, via at least one application programming interface (API) for the programmatically-controllable resource environment, firewall state information for the set of firewall ports, the firewall state information indicating either a permitted state or a denied state for each firewall port of the set of firewall ports;
determining, for each firewall port having the permitted state, whether a corresponding resource port of the set of resource ports, reachable through the respective firewall port having the permitted state, has the open state or the closed state;
and
generating a notification in response to any firewall port of the set of firewall ports having a different state, of the permitted or denied state, than the corresponding resource port of the set of resource ports.

2 more elements

A configuration scanning system, comprising:

at least one processor;
and
memory including instructions that, when executed by the at least one processor, cause the system to:
determine a set of firewall ports associated with a set of resource ports in a programmatically-controllable resource environment, the resource environment including an allocation of the firewall ports and the set of resource ports, with at least one virtual resource executed using one or more physical resources of the resource environment;
obtain, via at least one application programming interface (API) for the programmatically-controllable resource environment, firewall state information for the set of firewall ports, the firewall state information indicating either a permitted state or a denied state for each of the set of firewall ports;
determine, for each firewall port having the permitted state, whether a corresponding resource port of the set of resource ports, reachable through the respective firewall port having the permitted state, has the open state or the closed state;
and
perform a specified action in response to any firewall port of the set of firewall ports having a different state, of the permitted or the denied state, than the corresponding resource port of the set of resource ports.

5 more elements

Dependencies are inferred from the claim text.