US 2020/0007583 A1 · ASSURANCE OF SECURITY RULES IN A NETWORK

Abstract

Systems, methods, and computer-readable media for assurance of rules in a network. An example method can include creating a compliance requirement including a first endpoint group (EPG) selector, a second EPG selector, a traffic selector, and a communication operator, the first and second EPG selectors representing sets of EPGs and the communication operator defining a communication condition for traffic associated with the first and second EPG selectors and the traffic selector. The method can include creating, for each distinct pair of EPGs, a first respective data structure representing the distinct pair of EPGs, the communication operator, and the traffic selector; creating a second respective data structure representing a logical model of the network; determining whether the first respective data structure is contained in the second respective data structure to yield a containment check; and determining whether policies on the network comply with the compliance requirement based on the containment check.

Claims20

Dependent claims

A method comprising:

creating a compliance requirement for a network, the compliance requirement comprising a first endpoint group (EPG) selector, a second EPG selector, a traffic selector, and a communication operator, wherein the first and second EPG selectors represent sets of EPGs, wherein the traffic selector comprises traffic parameters identifying traffic corresponding to the traffic selector and the communication operator defines a communication condition for traffic associated with the first and second EPG selectors and the traffic selector;
creating, for each distinct pair of EPGs from the sets of EPGs, a first respective data structure representing the distinct pair of EPGs, the communication operator, and the traffic selector, wherein the distinct pair of EPGs comprises a respective EPG from each of the first EPG selector and the second EPG selector;
creating a second respective data structure representing a logical model of the network;
determining whether the first respective data structure is contained in the second respective data structure to yield a containment check;
and
determining whether policies configured on the network comply with the compliance requirement based on the containment check.

3 more elements

A system comprising:

one or more processors;
and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to:
create a compliance requirement for a network, the compliance requirement comprising a first endpoint group (EPG) selector, a second EPG selector, a traffic selector, and a communication operator, wherein the first and second EPG selectors represent sets of EPGs, wherein the traffic selector comprises traffic parameters identifying traffic corresponding to the traffic selector and the communication operator defines a communication condition for traffic associated with the first and second EPG selectors and the traffic selector;
create, for each distinct pair of EPGs from the sets of EPGs, a first respective data structure representing the distinct pair of EPGs, the communication operator, and the traffic selector, wherein the distinct pair of EPGs comprises a respective EPG from each of the first EPG selector and the second EPG selector;
create a second respective data structure representing a logical model of the network;
determine whether the first respective data structure is contained in the second respective data structure to yield a containment check;
and
determine whether policies configured on the network comply with the compliance requirement based on the containment check.

6 more elements

A non-transitory computer-readable storage medium comprising:

instructions stored therein instructions which, when executed by one or more processors, cause the one or more processors to:
create a compliance requirement for a network, the compliance requirement comprising a first endpoint group (EPG) selector, a second EPG selector, a traffic selector, and a communication operator, wherein the first and second EPG selectors represent sets of EPGs, wherein the traffic selector comprises traffic parameters identifying traffic corresponding to the traffic selector and the communication operator defines a communication condition for traffic associated with the first and second EPG selectors and the traffic selector;
create, for each distinct pair of EPGs from the sets of EPGs, a first respective data structure representing the distinct pair of EPGs, the communication operator, and the traffic selector, wherein the distinct pair of EPGs comprises a respective EPG from each of the first EPG selector and the second EPG selector;
create a second respective data structure representing a logical model of the network;
determine whether the first respective data structure is contained in the second respective data structure to yield a containment check;
and
determine whether policies configured on the network comply with the compliance requirement based on the containment check.

4 more elements

Dependencies are inferred from the claim text.

Assurance of security rules in a network

Life of this patent

Assurance of security rules in a network

Life of this patent

Abstract

Claims20