Dynamic hyper context-driven microsegmentation
AssigneeNetskope, Inc.
InventorsSrinivas Akella, Arun Kumar Dheena
Life of this patent
Estimating the term…
Abstract
Systems and methods for dynamic, hyper context-based microsegmentation are described. In one aspect, span traffic associated with a computing device on a network is processed. Meta data associated with the span traffic is transmitted to a hyper context cloud server. It is determined whether the span traffic meta data matches a policy condition. Responsive to the span traffic meta data matching a policy condition, a policy is triggered. It is determined whether an action associated with the triggered policy is segment. Responsive to determining that the action is segment, a MAC address of the computing device is added to a segment name provided in the policy. The segment name is pushed to one or more enforcement points associated with the network.
Claims19
A method for dynamic hyper context-driven segmentation comprising:
- processing span traffic associated with a computing device on a network:
- monitoring span traffic and collecting computer network hyper context associated with the computing device;
- transmitting span traffic meta data to a hyper context cloud server:
- determining by the hyper context cloud server whether the span traffic meta data matches a policy condition corresponding to a set of computer network hyper context comprising a list of network connectivity properties and computing device properties;
- responsive to the span traffic meta data matching a policy condition by identifying the collected computer network hyper context from within the hyper context set, triggering a policy;
- determining whether an action associated with the triggered policy is segment in conjunction with the collected network hyper context;
- responsive to determining that the action is segment, adding a MAC address of the computing device to a segment name provided in the policy;
- and
- pushing, by a cloud controller collaborated with the hyper context cloud server, the provided segment name to one or more network enforcement points associated with the network.
An apparatus for dynamic hyper context-driven segmentation comprising:
- one or more processor devices;
- a hyper context network sensor associated with a network, the hyper context network sensor being configured to process span traffic and collect computer network hyper context associated with a computing device on the network and generate span traffic meta data;
- a hyper context cloud server configured to receive the span traffic meta data, determine whether the span traffic meta data matches a policy condition corresponding to a set of computer network hyper context comprising a list of network connectivity properties and computing device properties,
- responsive to the span traffic meta data matching a policy condition by identifying the collected computer network hyper context from within the hyper context set, trigger a policy,
- determine whether an action associated with the trigger policy is segment in conjuction with the collected network hyper context, and
- responsive to determining that the action is segment, add a MAC address of the computing device to a segment name provided in the policy;
- and
- a cloud controller, collaborated with the hyper context cloud server, configured to push the segment name to one or more network enforcement points associated with the network.
Dependencies are inferred from the claim text.