Back to results
US 11,381,603 B2Granted
User-based visibility and control of a segmentation policy
AssigneeIllumio, Inc.
InventorsPaul J. Kirner, Dhanalakshmi Balasubramaniam, Seth Bruce Ford, Mukesh Gupta, Matthew K. Glenn
Life of this patent
Estimating the term…
Abstract
A segmentation server enables user-based management of a segmentation policy. Administrators belonging to different user groups may have different limited visibility into traffic flows controlled by the segmentation policy and may be assigned different privileges with respect to viewing, creating, and modifying rules of the segmentation policy. Thus, the burden of administering the segmentation policy may be distributed between administrators associated with different user groups that each may have responsibility for a different segment.
Claims20
A method for facilitating creation of a segmentation policy controlling communications between a plurality of workloads, the method comprising:
- identifying a user group associated with an administrator logged into an administrative client accessing a segmentation server;
- identifying, from a user group database, a group of label sets associated with the user group;
- identifying, from a workload database, a subset of workloads of the plurality of workloads relevant to the user group, the subset of workloads having at least one of the group of label sets associated with the user group;
- determining whether the user group has limited ruleset creation privileges or expanded ruleset creation privileges;
- responsive to determining that the user group has limited ruleset creation privileges, configuring a user interface of the administrative client with a first configuration in which the administrator can only control rules of the segmentation policy that permit connections between pairs of workloads that are both in the subset of workloads relevant to the user group;
- responsive to determining that the user group has expanded ruleset creation privileges, configuring the user interface of the administrative client with a second configuration in which the administrator can only control rules of the segmentation policy that permit connections between pairs of workloads in which a provider workload providing a service is within the subset of workloads relevant to the user group;
- receiving the configuration from the administrative client;
- generating management instructions for enforcing the set of rules;
- and
- sending the management instructions to respective enforcement modules associated with the subset of workloads, wherein the respective enforcement modules configure traffic filter to enforce the set of rules based on the management instructions.
7 more elements
A non-transitory computer-readable storage medium storing instructions executable by one or more processors for facilitating creation of a segmentation policy, the instructions when executed causing the one or more processors to perform steps including:
- identifying a user group associated with an administrator logged into an administrative client accessing a segmentation server;
- identifying, from a user group database, a group of label sets associated with the user group;
- identifying, from a workload database, a subset of workloads of the plurality of workloads relevant to the user group, the subset of workloads having at least one of the group of label sets associated with the user group;
- determining whether the user group has limited ruleset creation privileges or expanded ruleset creation privileges;
- responsive to determining that the user group has limited ruleset creation privileges, configuring a user interface of the administrative client with a first configuration in which the administrator can only control rules of the segmentation policy that permit connections between pairs of workloads that are both in the subset of workloads relevant to the user group;
- responsive to determining that the user group has expanded ruleset creation privileges, configuring the user interface of the administrative client with a second configuration in which the administrator can only control rules of the segmentation policy that permit connections between pairs of workloads in which a provider workload providing a service is within the subset of workloads relevant to the user group;
- receiving the configuration from the administrative client;
- generating management instructions for enforcing the set of rules;
- and
- sending the management instructions to respective enforcement modules associated with the subset of workloads, wherein the respective enforcement modules configure traffic filter to enforce the set of rules based on the management instructions.
7 more elements
A system for facilitating creation of a segmentation policy, the system comprising:
- one or more processors;
- and
- a non-transitory computer-readable storage medium storing instructions executable by the one or more processors, the instructions when executed causing the one or more processor to perform steps including:
- identifying a user group associated with an administrator logged into an administrative client accessing a segmentation server;
- identifying, from a user group database, a group of label sets associated with the user group;
- identifying, from a workload database, a subset of workloads of the plurality of workloads relevant to the user group, the subset of workloads having at least one of the group of label sets associated with the user group;
- determining whether the user group has limited ruleset creation privileges or expanded ruleset creation privileges;
- responsive to determining that the user group has limited ruleset creation privileges, configuring a user interface of the administrative client with a first configuration in which the administrator can only control rules of the segmentation policy that permit connections between pairs of workloads that are both in the subset of workloads relevant to the user group;
- responsive to determining that the user group has expanded ruleset creation privileges, configuring the user interface of the administrative client with a second configuration in which the administrator can only control rules of the segmentation policy that permit connections between pairs of workloads in which a provider workload providing a service is within the subset of workloads relevant to the user group;
- receiving the configuration from the administrative client;
- generating management instructions for enforcing the set of rules;
- and
- sending the management instructions to respective enforcement modules associated with the subset of workloads, wherein the respective enforcement modules configure traffic filter to enforce the set of rules based on the management instructions.
10 more elements
Dependencies are inferred from the claim text.