US 11,451,514 B2Granted

Optimizing rules for configuring a firewall in a segmented computer network

AssigneeIllumio, Inc.

InventorsDaniel Richard Cook, Anish Vinodkumar Desai

Life of this patent

Estimating the term…

Loading patent…

Abstract

An enforcement module receives management instructions from a segmentation server for enforcing a segmentation policy. The management instructions include one or more rules specifying one or more groups of workloads that a workload executing on the operating system instance is permitted to communicate with according to certain communication constraints, and membership information specifying workload identifiers for workloads in each of the groups. An optimization module processes the management instructions to reduce the number of rules and the number of workload groups to which the rules apply, thereby simplifying the firewall configuration. The enforcement module then configures a firewall according to the optimized rules to enforce the segmentation policy. The optimization process beneficially improves performance of the firewall and thereby enables more efficient enforcement of the segmentation policy utilizing fewer computing resources.

Claims20

Dependent claims

A method for reducing a number of firewall rules for enforcing a segmentation policy, the method comprising:

obtaining, at an enforcement module of a distributed firewall system, initial management instructions for controlling communications of a target workload executing on an operating system instance of a computing device, the initial management instructions comprising:
(a) an initial set of rules, wherein each rule specifies:
(i) at least one group of workloads permitted to communicate with the target workload under the rule, and
(ii) a constraint on the communications between the target workload and the at least one group of workloads associated with the rule, and
(b) initial membership information providing, for respective groups of workloads in the initial set of rules, a set of workload identifiers having membership in each of the respective groups of workloads;
identifying, in the initial set of rules, unique constraints on communications of the target workload with the respective groups of workloads;
collapsing the initial set of rules into a reduced set of rules that combines groups of workloads referenced in rules having common constraints into combined groups of workloads each associated with only one of the unique constraints;
generating, from the initial membership information and the combined groups, a reduced set of group identifiers that each represent a unique group of workloads;
re-mapping the reduced set of rules to the reduced set of group identifiers;
and
configuring, by the enforcement module, a firewall executing on the operating system instance according to the re-mapped rules to enforce the segmentation policy with respect to traffic to and from the target workload.

8 more elements

A method for optimizing management instructions for enforcing a segmentation policy, the method comprising:

receiving, by an enforcement agent executing on an operating system instance of a computing device, an initial rule set for enforcing the segmentation policy with respect to a target workload by a local firewall of a distributed firewall, the initial rule set including:
a first initial rule permitting communications between a first group of workloads with the target workload executing on the operating system instance in accordance with a first connection constraint, and
a second initial rule permitting communications between a second group of workloads with the target workload executing on the operating system instance in accordance with a second connection constraint;
receiving, by the enforcement agent, first membership information specifying a first set of workload identifiers having membership in the first group of workloads, second membership information specifying a second set of workload identifiers having membership in the second group of workloads;
processing the first membership information and the second membership information to determine that the first set of workload identifiers and the second set of workload identifiers are a matching set of workload identifiers;
assigning a unique group identifier to the matching set of workload identifiers;
generating from the initial rule set, a simplified first rule and a simplified second rule each referencing the unique group identifier for the matching set of workload identifiers;
and
configuring, by the enforcement module, the local firewall executing on the operating system instance to enforce the reduced rule set with respect to traffic to and from the target workload.

6 more elements

A method for simplifying a firewall rule set for enforcing a segmentation policy, the method comprising:

receiving, by an enforcement agent executing on an operating system instance of a computing device, an initial rule set for enforcing the segmentation policy with respect to a target workload by a local firewall of a distributed firewall, the initial rule set including:
a first initial rule permitting communications between a first group of workloads with the target workload executing on the operating system instance in accordance with a first connection constraint, and
a second initial rule permitting communications between a second group of workloads permitted to communicate with the target workload in accordance with a second connection constraint;
receiving, by the enforcement agent, first membership information specifying a first set of workload identifiers having membership in the first group of workloads and second membership information specifying a second set of workload identifiers having membership in the second group of workloads;
determining that the first connection constraint and the second connection constraint are a matching connection constraint;
collapsing the first initial rule and the second initial rule into a collapsed rule specifying the matching connection constraint and specifying that a union of the first group of workloads and the second group of workloads are permitted to communicate with the target workload in accordance with the matching connection constraint;
generating from the initial rule set, a reduced rule set that replaces the first initial rule and the second initial rule with the collapsed rule;
and
configuring, by the enforcement module, the local firewall executing on the operating system instance to enforce the reduced rule set with respect to traffic to and from the target workload.

6 more elements

A non-transitory computer-readable storage medium storing instructions for reducing a number of firewall rules for enforcing a segmentation policy, the instructions when executed by a processor causing the processor to perform steps including:

obtaining, at an enforcement module of a distributed firewall system, initial management instructions for controlling communications of a target workload executing on an operating system instance of a computing device, the initial management instructions comprising:
(a) an initial set of rules, wherein each rule specifies:
(i) at least one group of workloads permitted to communicate with the target workload under the rule, and
(ii) a constraint on the communications between the target workload and the at least one group of workloads associated with the rule, and
(b) initial membership information providing, for respective groups of workloads in the initial set of rules, a set of workload identifiers having membership in each of the respective groups of workloads;
identifying, in the initial set of rules, unique constraints on communications of the target workload with the respective groups of workloads;
collapsing the initial set of rule into, a reduced set of rules that combines groups of workloads referenced in rules having common constraints into combined groups of workloads each associated with only one of the unique constraints;
generating, from the initial membership information, a reduced set of group identifiers that each represent a unique group of workloads;
re-mapping the reduced set of rules to the reduced set of group identifiers;
and
configuring, by the enforcement module, a firewall executing on the operating system instance according to the re-mapped rules to enforce the segmentation policy with respect to traffic to and from the target workload.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/239,492Filed 3 Jan 2019
Published: US 2020/0220845 A19 Jul 2020
Granted: 20 Sep 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

G06F 9/5033
The resource being a machine, e.g. CPUs, Servers, Terminals: considering data affinity
G06F 9/5061
Allocation of resources, e.g. of the central processing unit [CPU]: partitioning or combining of resources
G06F 9/5077
Partitioning or combining of resources: logical partitioning of resources; Management or configuration of virtualized resources
H04L 41/0823
Configuration setting: characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability

Family

US 2020/0220845 A1Pre-grant publication · published 9 Jul 2020
US 11,451,514 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key