US 2020/0396207 A1 · PERMITTING FIREWALL TRAFFIC AS EXCEPTIONS IN DEFAULT TRAFFIC DENIAL ENVIRONMENTS

Abstract

A solution for firewall auto-learning in in zero trust environments, such as cloud environments, includes: based at least on a first trigger event, determining a first set of restricted dependencies for a cloud service firewall to learn for a first application; during a first learning phase, learning a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules; and operating the firewall with the first set of verified rules for the first application. Some examples include receiving a set of constraints, such as a selection from a set of preset constraints and/or a custom constraint. Some examples include retraining based at least on a second trigger event and/or learning rules for a second application.

Claims20

Dependent claims

A system for permitting firewall traffic as exceptions in default traffic denial environments, the system comprising:

a processor;
and
a computer-readable medium storing instructions that are operative when executed by the processor to:
based at least on a first trigger event, determine a first set of restricted dependencies for a cloud service firewall to analyze for a first application, the first set of restricted dependencies for traffic associated with the cloud service firewall;
during a first analysis phase, analyze a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies for traffic that includes a preset constraint on permitted traffic;
receive an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules;
and
operate the cloud service firewall with the first set of verified rules for the first application.

5 more elements

A method of permitting firewall traffic as exceptions in default traffic denial environments, the method comprising:

based at least on a first trigger event, determining a first set of restricted dependencies for a cloud service firewall to analyze for a first application;
during a first analysis phase, analyzing a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies that includes a preset constraint on permitted traffic;
receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules;
and
operating the cloud service firewall with the first set of verified rules for the first application.

2 more elements

One or more computer storage devices having computer-executable instructions stored thereon for permitting firewall traffic as exceptions in default traffic denial environments, which, on execution by a computer, cause the computer to perform operations comprising:

receiving a set of constraints for a first set of restricted dependencies, wherein receiving a set of constraints for the first set of restricted dependencies comprises receiving at least one input selected from the list consisting of:
a selection from a set of preset constraints and a custom constraint;
based at least on a first trigger event, determining the first set of restricted dependencies for a cloud service firewall to analyze for a first application, wherein the first trigger event comprises an event selected from the list consisting of:
a user input and an update to the first application, and
wherein the first set of restricted dependencies comprises at least one dependency selected from the list consisting of:
an application dependency and a network dependency;
during a first analysis phase, analyzing a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies;
during the first analysis phase, generating logs from analyzing the first set of candidate rules;
and
determining whether, from among the first set of restricted dependencies, a dependency was not exercised;
based at least on determining that a dependency was not exercised, generating an alert identifying that a dependency was not exercised;
presenting the logs for evaluation;
receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules;
operating the cloud service firewall with the first set of verified rules for the first application;
based at least on a second trigger event, determining a second set of restricted dependencies for the cloud service firewall to analyze for the first application, wherein the second trigger event comprises an event selected from the list consisting of:
a user input and an update to the first application;
during a second analysis phase, analyzing a second set of candidate rules corresponding to at least a portion of the second set of restricted dependencies;
receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the second set of candidate rules, to generate a second set of verified rules, the second set of verified rules different from the first set of verified rules;
operating the cloud service firewall with the second set of verified rules for the first application;
based at least on a third trigger event, determining a third set of restricted dependencies for the cloud service firewall to analyze for a second application;
during a third analysis phase, analyzing a third set of candidate rules corresponding to at least a portion of the third set of restricted dependencies;
receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the third set of candidate rules, to generate a third set of verified rules;
and
operating the cloud service firewall with the third set of verified rules for the second application.

21 more elements

Dependencies are inferred from the claim text.

Permitting firewall traffic as exceptions in default traffic denial environments

Life of this patent

Permitting firewall traffic as exceptions in default traffic denial environments

Life of this patent

Abstract

Claims20