Automatic whitelisting using provisioning information
AssigneeNicira, Inc.
InventorsAmit CHOPRA, Daniel G. WING, Vijay GANTI, Christopher CORDE, Amit PATIL, Peixiao LIN
Life of this patent
Estimating the term…
Abstract
A security system for a distributed application obtains and, in effect, preserves provisioning information for the purpose of auto-populating whitelists used to protect the distributed application from intrusions. The provisioning information identifies allowable connections on a software-package level. Entries mapping processes to connection destinations are added to a whitelist if a process requesting a connection results from execution of an executable file installed as part of a software package for which the connection was allowed according to the provisioning information.
Claims11
A security process comprising:
- obtaining from a provisioning system provisioning information used to deploy or modify a distributed application by installing software packages on respective hosts of a target system, the provisioning information specifying software packages installed on each host of the target system;
- auto-populating allowed-connection whitelists of respective hosts of the target system with entries mapping processes to connections determined to be allowable based, at least in part, on the provisioning information;
- and
- determining whether to allow or disallow a connection request based, at least in part, one the presence or absence of a matching entry in a respective one of the allowed-connection whitelists.
A security system comprising non-transitory media encoded with code that, when executed by a processor, implements a process including:
- obtaining from a provisioning system provisioning information used to deploy or modify a distributed application by installing software packages on respective hosts of a target system, the provisioning information specifying software packages installed on each host of the target system;
- auto-populating allowed-connection whitelists of respective hosts of the target system with entries mapping processes to connections determined to be allowable based, at least in part, on the provisioning information;
- and
- determining whether to allow or disallow a connection request based, at least in part, one the presence or absence of a matching entry in a respective one of the allowed-connection whitelists.
Dependencies are inferred from the claim text.