# US 12,015,591 B2 · Reuse of groups in security policy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,591 B2 - Document ID: US12015591B2 - Status: Granted - Kind: B2 - Application number: 17/543,254 - Filed: 2021-12-06 - Published: 2023-06-08 - Granted: 2024-06-18 - Earliest claimed: 2021-12-06 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Kavya Kambi Ravi; Radha Popuri; Sunitha Krishna; Margaret Petrus; Yiwei Zhang - Web page: https://patentgrep.com/patent/US12015591B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/104: {Grouping of entities} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments provide a method for modifying a firewall rule of a security policy implemented in a network. The method identifies a set of compute machines to be added to a match condition for the firewall rule. The match condition is expressed using one or more groups of compute machines. The method selects a set of groups for the identified set of compute machines from a plurality of existing groups of compute machines based on a user-specified threshold indicating tolerance for inclusion of compute machines that are not in the identified set of compute machines in the selected groups. The method uses the selected set of groups for the match condition of the firewall rule. ## Claims ### Claim 1 A method for modifying a firewall rule of a security policy implemented in a network, the method comprising: identifying a set of compute machines to be added to a match condition for the firewall rule, wherein the match condition is expressed using one or more groups of compute machines; selecting a set of groups for the identified set of compute machines from a plurality of existing groups of compute machines based on a user-specified threshold indicating tolerance for inclusion of compute machines that are not in the identified set of compute machines in the selected groups; and using the selected set of groups for the match condition of the firewall rule; wherein the user-specified threshold balances use of existing groups against inclusion in the match condition of compute machines that are not in the identified set of compute machines. ### Claim 2 (depends on 1) The method of claim 1, wherein the identified set of compute machines are based on observed flows in a network that do not match the firewall rule. ### Claim 3 (depends on 1) The method of claim 1, wherein a higher threshold excludes groups with fewer compute machines that are not in the identified set of compute machines. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of compute machines is a set of network addresses and each group is a different collection of network addresses. ### Claim 5 (depends on 1) The method of claim 1, wherein using the selected set of groups comprises presenting the selected set of groups as a recommendation to a user for modifications to the match condition for the firewall rule. ### Claim 6 (depends on 1) The method of claim 1, wherein the match condition is one of source addresses of flows and destination addresses of flows. ### Claim 7 (depends on 1) The method of claim 1, wherein the user-specified threshold specifies a minimum percentage of the compute machines in a group that are required to be in the identified set of compute machines for the group to be included in the selected set of groups. ### Claim 8 (depends on 7) The method of claim 7, wherein the selected set of groups comprises, for each compute machine in the identified set of compute machines, at least one group that includes the compute machine unless there are no groups in the plurality of existing groups that include the compute machine. ### Claim 9 (depends on 8) The method of claim 8, wherein selecting the set of groups comprises creating a new group for any compute machines that are not included in any of the existing groups. ### Claim 10 A non-transitory machine readable medium storing a program which when executed by at least one processing unit modifies a firewall rule of a security policy implemented in a network, the program comprising sets of instructions for: identifying a set of compute machines to be added to a match condition for the firewall rule, wherein the match condition is expressed using one or more groups of compute machines; selecting a set of groups for the identified set of compute machines from a plurality of existing groups of compute machines based on a user-specified threshold indicating tolerance for inclusion of compute machines that are not in the identified set of compute machines in the selected groups; and using the selected set of groups for the match condition of the firewall rule; wherein the user-specified threshold balances use of existing groups against inclusion in the match condition of compute machines that are not in the identified set of compute machines. ### Claim 11 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the identified set of compute machines are based on observed flows in a network that do not match the firewall rule. ### Claim 12 (depends on 1) The non-transitory machine readable medium of claim 1, wherein a higher threshold excludes groups with fewer compute machines that are not in the identified set of compute machines. ### Claim 13 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of compute machines is a set of network addresses and each group is a different collection of network addresses. ### Claim 14 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the set of instructions for using the selected set of groups comprises a set of instructions for presenting the selected set of groups as a recommendation to a user for modifications to the match condition for the firewall rule. ### Claim 15 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the match condition is one of source addresses of flows and destination addresses of flows. ### Claim 16 (depends on 10) The non-transitory machine readable medium of claim 10, wherein the user-specified threshold specifies a minimum percentage of the compute machines in a group that are required to be in the identified set of compute machines for the group to be included in the selected set of groups. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, wherein the selected set of groups comprises, for each compute machine in the identified set of compute machines, at least one group that includes the compute machine unless there are no groups in the plurality of existing groups that include the compute machine. ### Claim 18 (depends on 17) The non-transitory machine readable medium of claim 17, wherein the set of instructions for selecting the set of groups comprises a set of instructions for creating a new group for any compute machines that are not included in any of the existing groups.