# US 12,225,057 B2 · Resolving access policies between intent-based network architectures and cloud native architectures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,057 B2 - Document ID: US12225057B2 - Status: Granted - Kind: B2 - Application number: 18/244,048 - Filed: 2023-09-08 - Published: 2023-12-28 - Granted: 2025-02-11 - Earliest claimed: 2021-09-13 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Thomas Szigeti; David John Zacks; Walter Hulick; Shannon McFarland - Web page: https://patentgrep.com/patent/US12225057B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for expressing, communicating, de-conflicting, and enforcing consistent access policies between an IBN architecture and a Cloud-Native architecture. Generally, network administrators and/or users of a Cloud-Native architecture and an IBN architecture express access policies independently for the two different domains or architectures. According to the techniques described herein, a Network Service Endpoint (NSE) of the Cloud-Native architecture may exchange access policies with a network device of the IBN architecture. After exchanging access policies, conflicts between the sets of access policies may be identified, such as differences between allowing or denying communications between microservices and/or applications. The conflicts may be de-conflicted using various types of heuristics or rules, such as always selecting an access policy of the IBN architecture when conflicts arise. After the access policies have been de-conflicted, the IBN architecture and Cloud-Native architecture may then apply consistent access policies for traffic and communications in their respective network architectures. ## Claims ### Claim 1 A system comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: receiving, at a containerized-application network, a first set of access policies that define whether first applications are allowed or restricted from communicating in the containerized-application network with second applications; receiving, at the containerized-application network and from a network architecture, a second set of access policies that define whether the first applications are allowed or restricted from communicating in the network architecture with the second applications; identifying a conflict between the first set of access policies and the second set of access policies; obtaining data indicating a resolution for the conflict between the first set of access policies and the second set of access policies; determining, based at least in part on the resolution, a third set of access policies that defines whether the first applications are allowed or restricted from communicating with the second applications in the containerized-application network and the network architecture; and applying the third set of access policies to communications in the containerized-application network. ### Claim 2 (depends on 1) The system of claim 1, further comprising: a network service endpoint (NSE) associated with the containerized-application network; and a network device associated with the network architecture, the operations further comprising: establishing an encrypted tunnel between the NSE and a network device associated with the network architecture, wherein obtaining the second set of access policies includes receiving, at the NSE, the second set of access policies from the network device and over the encrypted tunnel. ### Claim 3 (depends on 1) The system of claim 1, wherein: obtaining the first set of access policies and obtaining the second set of access policies are performed at the containerized-application network; and determining the resolution for the conflict includes receiving input from a network administrator associated with the containerized-application network, the input indicating the resolution. ### Claim 4 (depends on 1) The system of claim 1, wherein: obtaining the first set of access policies and obtaining the second set of access policies are performed at the network architecture; and determining the resolution for the conflict includes receiving input from a network administrator associated with the network architecture, the input indicating the resolution. ### Claim 5 (depends on 1) The system of claim 1, further comprising: identifying a conflict rule indicating that conflicts between the second set of access policies of the containerized-application network and the first set of access policies of the network architecture are resolved by adopting the second set of access policies of the containerized-application network, wherein the determining the resolution for the conflict includes selecting a first access policy of the first set of access policies over a second access policy of the second set of access policies that conflicts with the first access policy. ### Claim 6 (depends on 1) The system of claim 1, further comprising: identifying a conflict rule indicating that conflicts between access policies of the containerized-application network and access policies of the network architecture are resolved by adopting the access policies of the network architecture, wherein the determining the resolution for the conflict includes selecting a second access policy of the second set of access policies over a first access policy of the first set of access policies that conflicts with the second access policy. ### Claim 7 (depends on 1) The system of claim 1, further comprising: detecting a change in at least one of the first set of access policies or the second set of access policies; and determining whether the change resulted in a subsequent conflict between the first set of access policies and the second set of access policies. ### Claim 8 A computer-implemented method comprising: receiving, at a containerized-application network, a first set of access policies that define whether first applications are allowed or restricted from communicating in the containerized-application network with second applications; receiving, at the containerized-application network and from a network architecture, a second set of access policies that define whether the first applications are allowed or restricted from communicating in the network architecture with the second applications; identifying a conflict between the first set of access policies and the second set of access policies; obtaining data indicating a resolution for the conflict between the first set of access policies and the second set of access policies; determining, based at least in part on the resolution, a third set of access policies that defines whether the first applications are allowed or restricted from communicating with the second applications in the containerized-application network and the network architecture; and applying the third set of access policies to communications in the containerized-application network. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising: establishing, by a network service endpoint (NSE) of the containerized-application network, an encrypted tunnel with a network device associated with the network architecture; and sending the first set of access policies to the network device using the encrypted tunnel. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, further comprising: detecting a change in the first set of access policies; and determining whether the change in the first set of access policies caused another conflict between the first set of access policies and the second set of access policies. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, further comprising: converting at least one of the first set of access policies or the second set of access policies such the first set of access policies and the second set of access policies are in a common format, wherein identifying the conflict is performed by comparing the first set of access policies and the second set of access policies once in the common format. ### Claim 12 (depends on 8) The computer-implemented method of claim 8, wherein obtaining the data indicating the resolution includes receiving input that indicates the resolution from a network administrator associated with the containerized-application network. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, further comprising: identifying a conflict rule indicating that conflicts between the second set of access policies of the containerized-application network and the first set of access policies of the network architecture are resolved by adopting the second set of access policies of the containerized-application network, wherein the obtaining the data indicating the resolution for the conflict includes selecting a first access policy of the first set of access policies over a second access policy of the second set of access policies that conflicts with the first access policy. ### Claim 14 (depends on 8) The computer-implemented method of claim 8, further comprising: identifying a conflict rule indicating that conflicts between access policies of the containerized-application network and access policies of the network architecture are resolved by adopting the access policies of the network architecture, wherein the obtaining the data indicating the resolution for the conflict selecting a second access policy of the second set of access policies. ### Claim 15 A computer-implemented method comprising: receiving, at a network architecture, a first set of access policies that define whether first applications are allowed or restricted from communicating in the network architecture with second applications; receiving, at the network architecture and from a containerized-application network, a second set of access policies that define whether the first applications are allowed or restricted from communicating in the containerized-application network with the second applications; identifying a conflict between the first set of access policies and the second set of access policies; obtaining data indicating a resolution for the conflict between the first set of access policies and the second set of access policies; determining, based at least in part on the resolution, a third set of access policies that defines whether the first applications are allowed or restricted from communicating with the second applications in the containerized-application network and the network architecture; and applying the third set of access policies to communications in the network architecture. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, further comprising: establishing an encrypted tunnel between a network device of the network architecture and a network service endpoint (NSE) of the containerized-application network; and sending the first set of access policies to the NSE using the encrypted tunnel. ### Claim 17 (depends on 15) The computer-implemented method of claim 15, further comprising: detecting a change in the first set of access policies; and determining whether the change in the first set of access policies caused another conflict between the first set of access policies and the second set of access policies. ### Claim 18 (depends on 15) The computer-implemented method of claim 15, further comprising: converting at least one of the first set of access policies or the second set of access policies such the first set of access policies and the second set of access policies are in a common format, wherein identifying the conflict is performed by comparing the first set of access policies and the second set of access policies once in the common format. ### Claim 19 (depends on 15) The computer-implemented method of claim 15, wherein obtaining the data indicating the resolution includes receiving input that indicates the resolution from a network administrator associated with the containerized-application network. ### Claim 20 (depends on 15) The computer-implemented method of claim 15, further comprising: identifying a conflict rule indicating that conflicts between the second set of access policies of the containerized-application network and the first set of access policies of the network architecture are resolved by adopting the second set of access policies of the containerized-application network, wherein the obtaining the data indicating the resolution for the conflict includes selecting a first access policy of the first set of access policies over a second access policy of the second set of access policies that conflicts with the first access policy.