Automated enforcement of security policies in cloud and hybrid infrastructure environments
AssigneeFireEye Security Holdings US LLC
InventorsLisun Joao Kung, Jose Renato Goncalves Santos, Sarowar Golam Sikder
Life of this patent
Estimating the term…
Abstract
To prevent un-authorized accesses to data and resources available in workloads on an organization's or enterprise's computer network, various improvements to automated computer network security processes to enable them to enforce network security policies using native network security mechanisms to control communications to and/or from workload units of applications running on different nodes within hybrid computer network infrastructures having both traditional hardware resources and virtual resources provided by private and public cloud infrastructure services.
Claims18
At least one non-transitory machine-readable medium comprising instructions that, when executed, cause at least one processor to at least:
- assign a first attribute to respective ones of a plurality of infrastructure resources of an infrastructure service provider in response to a determination that the infrastructure resource satisfies a resource property, the satisfaction of the resource property determined based on whether the infrastructure resource is constrained by a constraint rule, the first attribute being mapped to a property of the infrastructure service provider, the first attribute including a key and value pair;
- and
- generate a configuration for an infrastructure resource based on a plurality of security policies and the assignment of the first attribute to the infrastructure resource.
An apparatus comprising:
- memory;
- machine-readable instructions;
- logic circuitry to execute the machine-readable instructions that cause the logic circuitry to at least:
- assign a first attribute to respective ones of a plurality of infrastructure resources of an infrastructure service provider in response to a determination that the infrastructure resource satisfies a resource property, the satisfaction of the resource property determined based on whether the infrastructure resource is constrained by a constraint rule, the first attribute being mapped to a property of the infrastructure service provider, the first attribute including a key and value pair;
- and
- generate a configuration for an infrastructure resource based on a plurality of security policies and the assignment of the first attribute to the infrastructure resource.
A method comprising:
- assigning a first attribute to respective ones of a plurality of infrastructure resources of an infrastructure service provider in response to a determination that the infrastructure resource satisfies a resource property, the satisfaction of the resource property determined based on whether the infrastructure resource is constrained by a constraint rule, the first attribute being mapped to a property of the infrastructure service provider, the first attribute including a key and value pair;
- and
- generating, by executing an instruction with at least one processor, a configuration for an infrastructure resource based on a plurality of security policies and the assignment of the first attribute to the infrastructure resource.
Dependencies are inferred from the claim text.