# US 2016/0366186 A1 · Data socket descriptor based policies for application and data behavior and security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366186 A1 - Document ID: US20160366186A1 - Status: Published application - Kind: A1 - Application number: 15/182,505 - Filed: 2016-06-14 - Published: 2016-12-15 - Earliest claimed: 2015-06-14 - Assignees: Avocado Systems Inc. - Applicants: Avocado Systems Inc. - Inventors: Keshav Govind Kamble - Web page: https://patentgrep.com/patent/US20160366186A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic is configured to cause the processing circuit to maintain application and data security policies at a data socket descriptor level. The logic is also configured to cause the processing circuit to manage behavior and security of data socket descriptors used by application instances executed on virtual and/or physical compute platforms. According to another embodiment, a method includes maintaining application and data security policies at a data socket descriptor level and managing behavior and security of data socket descriptors used by application instances executed on virtual and/or physical compute platforms. ## Claims ### Claim 1 A system, comprising: a processing circuit and logic integrated with and/or executable by the processing circuit, the logic being configured to cause the processing circuit to: maintain application and data security policies at a data socket descriptor level; and manage behavior and security of data socket descriptors used by application instances executed on virtual and/or physical compute platforms. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the logic further causes the processing circuit to: allocate new attributes to data socket descriptors in a data socket descriptor record stored in a data socket descriptor database; and group data socket descriptors of one or more application instances into a single server group in response to a determination that the data socket descriptors are related based on various attributes of the data socket descriptors, the data socket descriptors comprising a secure base signature per data socket descriptor and a secure runtime signature per data socket descriptor. ### Claim 3 (depends on 2) The system as recited in claim 2, wherein the logic further causes the processing circuit to: prevent a requesting application instance and/or data socket descriptor from connecting to and/or communicating with any of the data socket descriptors in the single server group unless the requesting application instance and/or data socket descriptor is classified as part of the single server group; and collect statistics from the requesting application instance and/or data socket descriptor. ### Claim 4 (depends on 2) The system as recited in claim 2, wherein the attributes of the data socket descriptors further comprise: a server and/or source internet protocol (IP) interface; a server port number; a number of waiting connections allowed; and an application packet buffer size for transmitting and receiving packets. ### Claim 5 (depends on 1) The system as recited in claim 1, wherein the application and data security policies are applied to an individual data socket descriptor or a group of data socket descriptors grouped together based upon common attributes thereof. ### Claim 6 (depends on 1) The system as recited in claim 1, wherein the security policies dictate an action to perform based on a security profile received for each individual data socket descriptor, the action being selected from a group comprising: allow, allow-and-analyze, drop, and drop-and-analyze. ### Claim 7 (depends on 6) The system as recited in claim 6, wherein the security policies dictate a sub-action to perform based on the action and the security profile received for each individual data socket descriptor, the sub-action being selected from a group comprising: mirror ingress and egress payloads, apply a redaction policy, log an event, generate a trap, flush a cache data, lock processor memory, lock an in-memory database, and lock rows and/or columns of the in-memory database. ### Claim 8 (depends on 1) The system as recited in claim 1, wherein the logic further causes the processing circuit to: attach a unique secure key generator module to each data socket descriptor; insert a uniquely generated secure key to each individual payload sent via an associated data socket descriptor; and verify authenticity of incoming payloads based on inclusion of a secure key. ### Claim 9 A method, comprising: maintaining application and security policies at data a socket descriptor level; and managing behavior and security of data socket descriptors used by application instances executed on virtual and/or physical compute platforms. ### Claim 10 (depends on 9) The method as recited in claim 9, further comprising: allocating new attributes to data socket descriptors in a data socket descriptor record stored in a data socket descriptor database; and grouping data socket descriptors of one or more application instances into a single server group in response to a determination that the data socket descriptors are related based on various attributes of the data socket descriptors, the data socket descriptors comprising a secure base signature per data socket descriptor and a secure runtime signature per data socket descriptor. ### Claim 11 (depends on 10) The method as recited in claim 10, further comprising: preventing a requesting application instance and/or data socket descriptor from connecting to and/or communicating with any of the data socket descriptors in the single server group unless the requesting application instance and/or data socket descriptor is classified as part of the single server group; and collecting statistics from the requesting application instance and/or data socket descriptor, wherein the attributes of the data socket descriptors further comprise: a server and/or source internet protocol (IP) interface; a server port number; a number of waiting connections allowed; and an application packet buffer size for transmitting and receiving packets. ### Claim 12 (depends on 9) The method as recited in claim 9, wherein the application and data security policies are applied to an individual data socket descriptor or a group of data socket descriptors grouped together based upon common attributes thereof. ### Claim 13 (depends on 9) The method as recited in claim 9, wherein the security policies dictate an action to perform based on a security profile received for each individual data socket descriptor, the action being selected from a group comprising: allow, allow-and-analyze, drop, and drop-and-analyze. ### Claim 14 (depends on 13) The method as recited in claim 13, wherein the security policies dictate a sub-action to perform based on the action and the security profile received for each individual data socket descriptor, the sub-action being selected from a group comprising: mirror ingress and egress payloads, apply a redaction policy, log an event, generate a trap, flush a cache data, lock processor memory, lock an in-memory database, and lock rows and/or columns of the in-memory database. ### Claim 15 (depends on 9) The method as recited in claim 9, further comprising: attaching a unique secure key generator module to each data socket descriptor; inserting a uniquely generated secure key to each individual payload sent via an associated data socket descriptor; and verifying authenticity of incoming payloads based on inclusion of a secure key. ### Claim 16 A computer program product, comprising a computer readable storage medium having program instructions stored thereon, the program instructions being executable by a processing circuit to cause the processing circuit to: maintain application and data security policies at a data socket descriptor level; and manage behavior and security of data socket descriptors used by application instances executed on virtual and/or physical compute platforms. ### Claim 17 (depends on 16) The computer program product as recited in claim 16, wherein the program instructions further cause the processing circuit to: allocate new attributes to data socket descriptors in a data socket descriptor record stored in a data socket descriptor database; group data socket descriptors of one or more application instances into a single server group in response to a determination that the data socket descriptors are related based on various attributes of the data socket descriptors, the data socket descriptors comprising a secure base signature per data socket descriptor and a secure runtime signature per data socket descriptor; prevent a requesting application instance and/or data socket descriptor from connecting to and/or communicating with any of the data socket descriptors in the single server group unless the requesting application instance and/or data socket descriptor is classified as part of the single server group; and collect statistics from the requesting application instance and/or data socket descriptor, wherein the attributes of the data socket descriptors comprise: a secure base signature per data socket descriptor; a secure runtime signature per data socket descriptor; a server and/or source internet protocol (IP) interface; a server port number; a number of waiting connections allowed; and an application packet buffer size for transmitting and receiving packets. ### Claim 18 (depends on 16) The computer program product as recited in claim 16, wherein the application and data security policies are applied to an individual data socket descriptor or a group of data socket descriptors grouped together based upon common attributes thereof, and wherein the security policies dictate an action to perform based on a security profile received for each individual data socket descriptor, the action being selected from a group comprising: allow, allow-and-analyze, drop, and drop-and-analyze. ### Claim 19 (depends on 18) The computer program product as recited in claim 18, wherein the security policies dictate a sub-action to perform based on the action and the security profile received for each individual data socket descriptor, the sub-action being selected from a group comprising: mirror ingress and egress payloads, apply a redaction policy, log an event, generate a trap, flush a cache data, lock processor memory, lock an in-memory database, and lock rows and/or columns of the in-memory database. ### Claim 20 (depends on 15) The computer program product as recited in claim 15, wherein the program instructions further cause the processing circuit to: attach a unique secure key generator module to each data socket descriptor; insert a uniquely generated secure key to each individual payload sent via an associated data socket descriptor; and verify authenticity of incoming payloads based on inclusion of a secure key.