# US 10,375,121 B2 · Micro-segmentation in virtualized computing environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,121 B2 - Document ID: US10375121B2 - Status: Granted - Kind: B2 - Application number: 15/629,741 - Filed: 2017-06-22 - Published: 2017-12-28 - Granted: 2019-08-06 - Earliest claimed: 2016-06-23 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Claude Hamou; Roman Brouk; Steven McAllister - Web page: https://patentgrep.com/patent/US10375121B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 41/0803: Configuration setting - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/0897: by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities - H04L 63/0263: {Rule management} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Example methods are provided for an entity to perform micro-segmentation in a virtualized computing environment that includes multiple hosts. The method may comprise obtaining application implementation information associated with one or more applications implemented by multiple virtualized computing instances, each of the multiple virtualized computing instances being supported by one of the multiple hosts. The method may further comprise detecting micro-segments by clustering the multiple virtualized computing instances based on the application implementation information, and determining security policies for respective detected micro-segments. Each of the detected micro-segments may include one or more of the multiple virtualized computing instances that have more similarity compared to those in a different detected micro-segment. ## Claims ### Claim 1 A method for an entity to perform micro-segmentation in a virtualized computing environment that includes multiple hosts, the method comprising: obtaining application implementation information associated with one or more applications implemented by multiple virtualized computing instances, wherein each of the multiple virtualized computing instances is supported by one of the multiple hosts; detecting micro-segments by clustering the multiple virtualized computing instances based on the application implementation information, wherein each of the detected micro-segments includes one or more of the multiple virtualized computing instances that have more similarity compared to those in a different detected micro-segment; and based on the application implementation information, determining security policies for respective detected micro-segments. ### Claim 2 (depends on 1) The method of claim 1, wherein detecting the micro-segments comprises: detecting the micro-segments based on application implementation information that includes one or more of the following: network flow information associated with network flows between multiple components of a particular application; and ownership information associated with a particular virtualized computing instance's ownership of one of the multiple components of the particular application. ### Claim 3 (depends on 2) The method of claim 2, wherein determining the security policies comprises: based on network flow information associated with a source and a destination, determining a distributed firewall rule to allow or deny communication between the source and destination, wherein the source is a first virtualized computing instance in a first micro-segment, and the destination is a second virtualized computing instance in the first micro-segment or a second micro-segment, or an external server. ### Claim 4 (depends on 1) The method of claim 1, wherein the method further comprises: configuring the multiple hosts to implement the detected micro-segments and/or the one or more security policies. ### Claim 5 (depends on 1) The method of claim 1, wherein applying the clustering algorithm comprises: determining a transition probability matrix based on the application implementation information; and iteratively transforming the transition probability matrix until convergence is reached to detect the micro-segments. ### Claim 6 (depends on 1) The method of claim 1, wherein the method further comprises: monitoring the detected micro-segments to identify a performance issue that affects at least one of the detected micro-segments; and in response to identifying the performance issue, generating an alert or determining a performance enhancement action. ### Claim 7 (depends on 6) The method of claim 6, wherein monitoring the detected micro-segments to identify the performance issue comprises one or more of the following: identifying a sub-optimal placement of a particular virtualized computing instance in a particular micro-segment; identifying a security threat associated with a particular micro-segment; identifying a misconfiguration associated with a particular security policy; and identifying an infrastructure issue associated with a particular micro-segment. ### Claim 8 A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of micro-segmentation in a virtualized computing environment that includes multiple hosts, the method comprising: obtaining application implementation information associated with one or more applications implemented by multiple virtualized computing instances, wherein each of the multiple virtualized computing instances is supported by one of the multiple hosts; detecting micro-segments by clustering the multiple virtualized computing instances based on the application implementation information, wherein each of the detected micro-segments includes one or more of the multiple virtualized computing instances that have more similarity compared to those in a different detected micro-segment; and based on the application implementation information, determining security policies for respective detected micro-segments. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein detecting the micro-segments comprises: detecting the micro-segments based on application implementation information that includes one or more of the following: network flow information associated with network flows between multiple components of a particular application; and ownership information associated with a particular virtualized computing instance's ownership of one of the multiple components of the particular application. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein determining the security policies comprises: based on network flow information associated with a source and a destination, determining a distributed firewall rule to allow or deny communication between the source and destination, wherein the source is a first virtualized computing instance in a first micro-segment, and the destination is a second virtualized computing instance in the first micro-segment or a second micro-segment, or an external server. ### Claim 11 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the method further comprises: configuring the multiple hosts to implement the detected micro-segments and/or the one or more security policies. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein applying the clustering algorithm comprises: determining a transition probability matrix based on the application implementation information; and iteratively transforming the transition probability matrix until convergence is reached to detect the micro-segments. ### Claim 13 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the method further comprises: monitoring the detected micro-segments to identify a performance issue that affects at least one of the detected micro-segments; and in response to identifying the performance issue, generating an alert or determining a performance enhancement action. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein monitoring the detected micro-segments to identify the performance issue comprises one or more of the following: identifying a sub-optimal placement of a particular virtualized computing instance in a particular micro-segment; identifying a security threat associated with a particular micro-segment; identifying a misconfiguration associated with a particular security policy; and identifying an infrastructure issue associated with a particular micro-segment. ### Claim 15 A computer system configured to micro-segmentation in a virtualized computing environment that includes multiple hosts, the computer system comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to: obtain application implementation information associated with one or more applications implemented by multiple virtualized computing instances, wherein each of the multiple virtualized computing instances is supported by one of the multiple hosts; detect micro-segments by clustering the multiple virtualized computing instances based on the application implementation information, wherein each of the detected micro-segments includes one or more of the multiple virtualized computing instances that have more similarity compared to those in a different detected micro-segment; and based on the application implementation information, determine security policies for respective detected micro-segments. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the instructions for detecting the micro-segments cause the processor to: detect the micro-segments based on application implementation information that includes one or more of the following: network flow information associated with network flows between multiple components of a particular application; and ownership information associated with a particular virtualized computing instance's ownership of one of the multiple components of the particular application. ### Claim 17 (depends on 16) The computer system of claim 16, wherein the instructions for determining the security policies cause the processor to: based on network flow information associated with a source and a destination, determine a distributed firewall rule to allow or deny communication between the source and destination, wherein the source is a first virtualized computing instance in a first micro-segment, and the destination is a second virtualized computing instance in the first micro-segment or a second micro-segment, or an external server. ### Claim 18 (depends on 15) The computer system of claim 15, wherein the instructions further cause the processor to: configure the multiple hosts to implement the detected micro-segments and/or the one or more security policies. ### Claim 19 (depends on 15) The computer system of claim 15, wherein the instructions for applying the clustering algorithm cause the processor to: determine a transition probability matrix based on the application implementation information; and iteratively transform the transition probability matrix until convergence is reached to detect the micro-segments. ### Claim 20 (depends on 15) The computer system of claim 15, wherein the instructions further cause the processor to: monitor the detected micro-segments to identify a performance issue that affects at least one of the detected micro-segments; and in response to identifying the performance issue, generate an alert or determine a performance enhancement action. ### Claim 21 (depends on 20) The computer system of claim 20, wherein the instructions for monitoring the detected micro-segments to identify the performance issue cause the processor to perform one or more of the following: identify a sub-optimal placement of a particular virtualized computing instance in a particular micro-segment; identify a security threat associated with a particular micro-segment; identify a misconfiguration associated with a particular security policy; and identify an infrastructure issue associated with a particular micro-segment.