# US 2021/0243158 A1 · Selective enforcement of a segmentation policy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243158 A1 - Document ID: US20210243158A1 - Status: Published application - Kind: A1 - Application number: 16/776,505 - Filed: 2020-01-30 - Published: 2021-08-05 - Earliest claimed: 2020-01-30 - Assignees: Illumio, Inc. - Applicants: Illumio, Inc. - Inventors: Juraj George Fandli; Yair Harel; Ronald Isaacson; Russell Stuart Goodwin; Roy Nobuo Nakashima; Nathanael John Iversen - Web page: https://patentgrep.com/patent/US20210243158A1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A policy management server enables selective enforcement of a segmentation policy. The policy management server manages a segmentation policy that specifies a set of segmentation rules specifying permitted communications between workloads. The policy management server separately manages an enforcement policy that controls whether or not the segmentation policy is enforced for different services provided by the workloads. For services that are enforced, the policy management server distributes instructions to distributed enforcement modules that configure traffic filters to block traffic pertaining to enforced services that does not meet the segmentation rules. For non-enforced services, the policy management server obtains traffic data from the distributed enforcement modules without enforcing the segmentation policy to enable an administrator to build and/or test the segmentation policy. ## Claims ### Claim 1 A method for managing enforcement of a segmentation policy, comprising: storing, at a policy management server, a segmentation policy comprising a set of segmentation rules that specify a white list of permissible connections between workloads providing or consuming network-based services; storing, at the policy management server, an enforcement policy that specifies at least a first group of services for operating in a test state and at least a second group of services for operating in an enforced state; generating, based on the segmentation policy, segmentation policy instructions for causing an enforcement module to configure one or more traffic filters with a first set of filtering rules that allow traffic associated with the first or second group of services meeting the segmentation rules of the segmentation policy; generating, based on the enforcement policy, enforcement policy instructions for causing the enforcement module to configure the one or more traffic filter with a default filtering rule to allow traffic associated with the first group of services that fails to meet any of the first set of filtering rules, and to block traffic associated with the second group of services that fails to meet any of the first set of filtering rules; and distributing the segmentation policy instructions and the enforcement policy instructions to the enforcement module. ### Claim 2 (depends on 1) The method of claim 1, wherein the enforcement policy further specifies at least a third group of services for operating in a build state, and wherein generating the segmentation policy instructions comprises: determining a set of the segmentation rules associated with the first group of services operating in the test state and the second group of services operating in the enforce state; and generating the segmentation policy instructions only for the determined set of segmentation rules. ### Claim 3 (depends on 1) The method of claim 1, wherein the enforcement policy identifies the first group of services by one or more label sets identifying a group of workloads and service-identifying information associated with traffic relating to the first group of services. ### Claim 4 (depends on 3) The method of claim 3, wherein the service-identifying information comprises at least one of: a port, a protocol, and a service identifier. ### Claim 5 (depends on 1) The method of claim 1, wherein at least one service of the first group of services operating in the test state and at least one service of the second group of services operating in the enforce state are provided by or consumed by a same workload. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving from the enforcement modules, traffic data indicative of traffic meeting one of the filtering rules; and generating a traffic flow graph indicative of the traffic data. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving a state change instruction to change a service from a test state to an enforce state; updating the enforcement policy instructions in response to the state change instruction; and distributing updated enforcement policy instructions to the enforcement module. ### Claim 8 A non-transitory computer-readable storage medium storing instructions for managing enforcement of a segmentation policy, the instructions when executed causing one or more processors to perform steps including: storing, at a policy management server, a segmentation policy comprising a set of segmentation rules that specify a white list of permissible connections between workloads providing or consuming network-based services; storing, at the policy management server, an enforcement policy that specifies at least a first group of services for operating in a test state and at least a second group of services for operating in an enforced state; generating, based on the segmentation policy, segmentation policy instructions for causing an enforcement module to configure one or more traffic filters with a first set of filtering rules that allow traffic associated with the first or second group of services meeting the segmentation rules of the segmentation policy; generating, based on the enforcement policy, enforcement policy instructions for causing the enforcement module to configure the one or more traffic filter with a default filtering rule to allow traffic associated with the first group of services that fails to meet any of the first set of filtering rules, and to block traffic associated with the second group of services that fails to meet any of the first set of filtering rules; and distributing the segmentation policy instructions and the enforcement policy instructions to the enforcement module. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the enforcement policy further specifies at least a third group of services for operating in a build state, and wherein generating the segmentation policy instructions comprises: determining a set of the segmentation rules associated with the first group of services operating in the test state and the second group of services operating in the enforce state; and generating the segmentation policy instructions only for the determined set of segmentation rules. ### Claim 10 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the enforcement policy identifies the first group of services by one or more label sets identifying a group of workloads and service-identifying information associated with traffic relating to the first group of services. ### Claim 11 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein the service-identifying information comprises at least one of: a port, a protocol, and a service identifier. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein at least one service of the first group of services operating in the test state and at least one service of the second group of services operating in the enforce state are provided by or consumed by a same workload. ### Claim 13 (depends on 8) The non-transitory computer-readable storage medium of claim 8, the instructions when executed further causing the one or more processors to perform steps including: receiving from the enforcement modules, traffic data indicative of traffic meeting one of the filtering rules; and generating a traffic flow graph indicative of the traffic data. ### Claim 14 (depends on 8) The non-transitory computer-readable storage medium of claim 8, the instructions when executed further causing the one or more processors to perform steps including: receiving a state change instruction to change a service from a test state to an enforce state; updating the enforcement policy instructions in response to the state change instruction; and distributing updated enforcement policy instructions to the enforcement module. ### Claim 15 A computer system comprising: one or more processors; and a non-transitory computer-readable storage medium storing instructions for managing enforcement of a segmentation policy, the instructions when executed causing the one or more processors to perform steps including: storing, at a policy management server, a segmentation policy comprising a set of segmentation rules that specify a white list of permissible connections between workloads providing or consuming network-based services; storing, at the policy management server, an enforcement policy that specifies at least a first group of services for operating in a test state and at least a second group of services for operating in an enforced state; generating, based on the segmentation policy, segmentation policy instructions for causing an enforcement module to configure one or more traffic filters with a first set of filtering rules that allow traffic associated with the first or second group of services meeting the segmentation rules of the segmentation policy; generating, based on the enforcement policy, enforcement policy instructions for causing the enforcement module to configure the one or more traffic filter with a default filtering rule to allow traffic associated with the first group of services that fails to meet any of the first set of filtering rules, and to block traffic associated with the second group of services that fails to meet any of the first set of filtering rules; and distributing the segmentation policy instructions and the enforcement policy instructions to the enforcement module. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the enforcement policy further specifies at least a third group of services for operating in a build state, and wherein generating the segmentation policy instructions comprises: determining a set of the segmentation rules associated with the first group of services operating in the test state and the second group of services operating in the enforce state; and generating the segmentation policy instructions only for the determined set of segmentation rules. ### Claim 17 (depends on 15) The computer system of claim 15, wherein the enforcement policy identifies the first group of services by one or more label sets identifying a group of workloads and service-identifying information associated with traffic relating to the first group of services. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the service-identifying information comprises at least one of: a port, a protocol, and a service identifier. ### Claim 19 (depends on 15) The computer system of claim 15, wherein at least one service of the first group of services operating in the test state and at least one service of the second group of services operating in the enforce state are provided by or consumed by a same workload. ### Claim 20 (depends on 15) The computer system of claim 15, the instructions when executed further causing the one or more processors to perform steps including: receiving from the enforcement modules, traffic data indicative of traffic meeting one of the filtering rules; and generating a traffic flow graph indicative of the traffic data.