Managing a segmentation policy for workloads in a secure enclave

A non-transitory computer-readable storage medium storing instructions for managing a segmentation policy, the instructions, when executed by a computing system, causing the computing system to perform operations comprising:

• obtaining a segmentation policy comprising a set of rules for controlling traffic between workloads;
• detecting a plurality of protected workloads that are members of a secure enclave protected by an enclave protection device such that traffic between the protected workloads and external workloads outside the secure enclave pass through the enclave protection device;
• determining, from the segmentation policy, a set of cross-boundary rules pertaining to traffic between at least one of the protected workloads and at least one of the external workloads, wherein determining the set of cross-boundary rules comprises:
• identifying a source label set and a destination label set specified by a segmentation rule of the segmentation policy;
• identifying a first workload having the source label set and a second workload having the destination label set;
• determining whether the first and second workloads are protected workloads or external workloads;
• and
• responsive to either the first workload being a protected workload and the second workload being an external workload or the first workload being an external workload and the second workload being a protected workload, including the segmentation rule in the set of cross-boundary rules;
• generating, from the set of cross-boundary rules, a configuration for the enclave protection device that causes the enclave protection device to permit the traffic meeting the set of cross-boundary rules, wherein generating the configuration for the enclave protection device comprises:
• identifying, in the cross-boundary rules, a set of duplicate rules;
• combining the duplicate rules into a combined rule;
• and
• replacing the duplicate rules with the combined rule in the cross-boundary rules, the configuration for the enclave protection device being based on the combined rule;
• and
• distributing the configuration to the enclave protection device to enable enforcement of the cross-boundary rules.

A computer system comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium storing instructions for managing a segmentation policy, the instructions when executed by the one or more processors causing the one or more processors to perform steps including:
• obtaining a segmentation policy comprising a set of rules for controlling traffic between workloads;
• detecting a plurality of protected workloads that are members of a secure enclave protected by an enclave protection device such that traffic between the protected workloads and external workloads outside the secure enclave pass through the enclave protection device;
• determining, from the segmentation policy, a set of cross-boundary rules pertaining to traffic between at least one of the protected workloads and at least one of the external workloads, wherein determining the set of cross-boundary rules comprises:
• identifying a source label set and a destination label set specified by a segmentation rule of the segmentation policy;
• identifying a first workload having the source label set and a second workload having the destination label set;
• determining whether the first and second workloads are protected workloads or external workloads;
• and
• responsive to either the first workload being a protected workload and the second workload being an external workload or the first workload being an external workload and the second workload being a protected workload, including the segmentation rule in the set of cross-boundary rules;
• generating, from the set of cross-boundary rules, a configuration for the enclave protection device that causes the enclave protection device to permit the traffic meeting the set of cross-boundary rules, wherein generating the configuration for the enclave protection device comprises:
• identifying, in the cross-boundary rules, a set of duplicate rules;
• combining the duplicate rules into a combined rule;
• and
• replacing the duplicate rules with the combined rule in the cross-boundary rules, the configuration for the enclave protection device being based on the combined rule;
• and
• distributing the configuration to the enclave protection device to enable enforcement of the cross-boundary rules.