Distributed identity-based firewall policy evaluation

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions executable by a processor to cause the processor to:

• intercept a first packet destined for a first entity;
• based on a determination that metadata of the first packet comprise an extension header, determine whether the first packet can be verified, wherein the instructions to determine whether the first packet can be verified comprise instructions to determine whether the extension header comprises a signature that includes an encoded identifier of a sender of the first packet;
• in response to a determination that the first packet can be verified based on a determination that the extension header comprises the signature that includes the encoded identifier of the sender of the first packet, determine based on a firewall policy whether the sender of the first packet is permitted to communicate with the first entity, wherein the instructions to determine whether the sender of the first packet is permitted to communicate with the first entity comprise instructions to:
• decode the encoded identifier to obtain an identifier of the sender of the first packet, wherein the identifier of the sender was determined for the sender of the first packet based on the firewall policy and differs from an Internet Protocol (IP) address of the sender;
• and
• evaluate the first packet for compliance with the firewall policy based on the identifier of the sender, wherein the firewall policy comprises rules for communications of a plurality of entities based on a plurality of identifiers of a corresponding plurality of entities, wherein the plurality of identifiers differs from IP addresses of the plurality of entities and are unique to corresponding ones of the plurality of entities, and wherein the plurality of identifiers includes the identifier of the sender;
• and
• in response to a determination that the first packet cannot be verified based on a determination that the extension header does not comprise the signature that includes the encoded identifier of the sender of the first packet or that the metadata of the first packet do not comprise an extension header, perform one or more mitigation actions.

An apparatus comprising:

• a processor;
• and
• a non-transitory machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to:
• intercept a first packet destined for a first entity, wherein the first packet comprises metadata;
• based on a determination that the metadata of the first packet comprise an extension header, determine whether the first packet can be verified, wherein the instructions to determine if the first packet can be verified comprise instructions to determine whether the extension header comprises a signature that includes an encoded identifier of a sender entity of the first packet;
• in response to a determination that the first packet can be verified based on a determination that the extension header comprises the signature that includes the encoded identifier of the sender entity of the first packet, determine whether the sender entity is permitted to communicate with the first entity based on a firewall policy, wherein the instructions to determine if the sender entity is permitted to communicate with the first entity comprise instructions to:
• decode the encoded identifier to obtain an identifier of the sender entity that was determined for the sender entity based on the firewall policy and differs from an Internet Protocol (IP) address of the sender entity;
• and
• evaluate the first packet for compliance with the firewall policy based on the identifier of the sender entity, wherein the firewall policy comprises rules for communications among a plurality of entities based on a plurality of identifiers unique to corresponding ones of a plurality of entities, wherein the plurality of identifiers differs from IP addresses of the plurality of entities, and wherein the plurality of entities includes the sender entity and the plurality of identifiers includes the identifier of the sender entity;
• and
• in response to a determination that the first packet cannot be verified based on a determination that the extension header does not comprise the signature that includes the encoded identifier of the sender entity of the first packet or that the metadata of the first packet does not comprise an extension header, perform one or more mitigation actions.