# US 12,184,515 B2 · Segmentation using infrastructure policy feedback > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,515 B2 - Document ID: US12184515B2 - Status: Granted - Kind: B2 - Application number: 18/222,033 - Filed: 2023-07-14 - Published: 2023-11-09 - Granted: 2024-12-31 - Earliest claimed: 2021-12-20 - Assignees: Illumio, Inc. - Applicants: Illumio, Inc. - Inventors: Rushabh Sanghvi; George Jeffrey Francis; Rupesh Kumar Mishra - Web page: https://patentgrep.com/patent/US12184515B2 ## CPC - H04L 41/5019: Ensuring fulfilment of SLA - H04L 41/5041: characterised by the time relationship between creation and deployment of a service - H04L 47/20: Traffic policing - H04L 67/53: using third party service providers - H04L 41/0894: Policy-based network configuration management - H04L 43/026: using flow identification - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computing device (e.g., a policy management server) obtains a segmentation policy that includes a set of rules for controlling network traffic between workloads. The computing device also receives infrastructure feedback regarding configuration of third-party network infrastructure. The computing device uses the infrastructure feedback to identify a discrepancy between the segmentation policy and the configuration of the third-party network infrastructure and triggers a corrective action in response. The corrective action may include providing a notification or suggestive remedy for the discrepancy to the user or automatically remedying the discrepancy. ## Claims ### Claim 1 A method for managing a segmentation policy, the method comprising: obtaining a segmentation policy comprising a first set of allow-only rules for controlling network traffic between workloads; receiving a third-party infrastructure policy comprising a set of allow/deny rules for controlling network traffic between the workloads associated with a third-party network infrastructure; converting the third-party infrastructure policy into a second set of allow-only rules for controlling network traffic between the workloads, wherein converting the third-party infrastructure policy into a second set of allow-only rules comprising converting an initial allow rule in the set of allow/deny rules into one or more new allow rules that cover a range allowed by the initial allow rule subtracting a range denied by a deny rule in the set of allow/deny rules; comparing the first set of allow-only rules to the second set of allow-only rules to identify a discrepancy between the segmentation policy and the third-party infrastructure policy; and triggering a corrective action in response to identifying the discrepancy. ### Claim 2 (depends on 1) The method of claim 1, wherein the third-party infrastructure policy is enforced by third-party network infrastructure. ### Claim 3 (depends on 1) The method of claim 1, wherein the corrective action comprises providing a notification of the discrepancy for display at an administrative client. ### Claim 4 (depends on 3) The method of claim 3, wherein the corrective action further comprises: causing the administrative client to display one or more controls for updating the segmentation policy; receiving, from the administrative client, an instruction to update the segmentation policy, wherein the instruction was generated in response to user input via the one or more controls; and updating the segmentation policy in accordance with the instruction. ### Claim 5 (depends on 1) The method of claim 1, wherein the corrective action comprises automatically updating the segmentation policy to remove the discrepancy relative to a configuration of the third-party network infrastructure. ### Claim 6 (depends on 1) The method of claim 1, wherein the corrective action comprises sending a request to modify a configuration of the third-party network infrastructure to remove the discrepancy relative to the segmentation policy. ### Claim 7 (depends on 1) The method of claim 1, wherein converting the third-party infrastructure policy into the second set of allow-only rules comprises: reading a first rule of the third-party infrastructure policy; and responsive to the first rule being a deny rule, adding the first rule to a deny list. ### Claim 8 (depends on 7) The method of claim 7, wherein converting the third-party infrastructure policy into the second set of allow-only rules further comprises: reading a second rule of the third-party infrastructure policy; and responsive to the second rule being an allow rule: subtracting rules in the deny list from the second rule to generate a remainder; and adding the remainder to an allow list. ### Claim 9 (depends on 8) The method of claim 8, wherein converting the third-party infrastructure policy into the second set of allow-only rules further comprises: consolidating the allow list by combining two overlapping rules in the allow list into a single rule. ### Claim 10 A non-transitory computer-readable medium comprising instructions for managing a segmentation policy, the instructions, when executed by a computing system, causing the computing system to perform operations including: obtaining a segmentation policy comprising a first set of allow-only rules for controlling network traffic between workloads; receiving a third-party infrastructure policy comprising a set of allow/deny rules for controlling network traffic between the workloads associated with a third-party network infrastructure; converting the third-party infrastructure policy into a second set of allow-only rules for controlling network traffic between the workloads, wherein converting the third-party infrastructure policy into a second set of allow-only rules comprising converting an initial allow rule in the set of allow/deny rules into one or more new allow rules that cover a range allowed by the initial allow rule subtracting a range denied by a deny rule in the set of allow/deny rules; comparing the first set of allow-only rules to the second set of allow-only rules to identify a discrepancy between the segmentation policy and the third-party infrastructure policy; and triggering a corrective action in response to identifying the discrepancy. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the corrective action comprises providing a notification of the discrepancy for display at an administrative client. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the corrective action further comprises: causing the administrative client to display one or more controls for updating the segmentation policy; receiving, from the administrative client, an instruction to update the segmentation policy, wherein the instruction was generated in response to user input via the one or more controls; and updating the segmentation policy in accordance with the instruction. ### Claim 13 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the corrective action comprises automatically updating the segmentation policy to remove the discrepancy relative to a configuration of the third-party network infrastructure. ### Claim 14 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the corrective action comprises sending a request to modify a configuration of the third-party network infrastructure to remove the discrepancy relative to the segmentation policy. ### Claim 15 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein converting the third-party infrastructure policy into the second set of allow-only rules comprises: reading a first rule of the third-party infrastructure policy; and responsive to the first rule being a deny rule, adding the first rule to a deny list. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein converting the third-party infrastructure policy into the second set of allow-only rules further comprises: reading a second rule of the third-party infrastructure policy; and responsive to the second rule being an allow rule: subtracting rules in the deny list from the second rule to generate a remainder; and adding the remainder to an allow list. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16 wherein converting the third-party infrastructure policy into the second set of allow-only rules further comprises: consolidating the allow list by combining overlapping rules in the allow list into a single rule. ### Claim 18 A computer system comprising: one or more processors; and a non-transitory computer-readable medium comprising instructions for managing a segmentation policy, the instructions when executed by one or more processors causing the computer system to perform operations including: obtaining a segmentation policy comprising a first set of allow-only rules for controlling network traffic between workloads; receiving a third-party infrastructure policy comprising a set of allow/deny rules for controlling network traffic between the workloads associated with a third-party network infrastructure; converting the third-party infrastructure policy into a second set of allow-only rules for controlling network traffic between the workloads, wherein converting the third-party infrastructure policy into a second set of allow-only rules comprising converting an initial allow rule in the set of allow/deny rules into one or more new allow rules that cover a range allowed by the initial allow rule subtracting a range denied by a deny rule in the set of allow/deny rules; comparing the first set of allow-only rules to the second set of allow-only rules to identify a discrepancy between the segmentation policy and the third-party infrastructure policy; and triggering a corrective action in response to identifying the discrepancy. ### Claim 19 (depends on 18) The computer system of claim 18, wherein converting the third-party infrastructure policy into the second set of allow-only rules comprises: reading a first rule of the third-party infrastructure policy; responsive to the first rule being a deny rule, adding the first rule to a deny list; reading a second rule of the third-party infrastructure policy; responsive to the second rule being an allow rule: subtracting rules in the deny list from the second rule to generate a remainder; and adding the remainder to an allow list; and consolidating the allow list by combining overlapping rules in the allow list into a single rule.