Distributed identity-based firewall policy evaluation

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• intercepting a packet directed to a recipient entity, wherein the packet is sent by a sender entity;
• determining whether the sender entity is permitted to communicate with the recipient entity according to a firewall policy, wherein the firewall policy indicates a plurality of entity identifiers and rules for communications among a plurality of entities including the recipient entity, each entity identifier corresponding to a respective entity of the plurality of entities, wherein each entity identifier is unique among the plurality of entity identifiers, wherein the rules for communications among the plurality of entities include a list of pairs of entities which are permitted to communicate with each other;
• forwarding the packet to the recipient entity when it is determined that the sender entity is permitted to communicate with the recipient entity;
• and
• performing at least one mitigation action when it is determined that the recipient entity is not permitted to communicate with the sender entity.

A system for identity-based firewall policy evaluation, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• intercepting a packet directed to a recipient entity, wherein the packet is sent by a sender entity;
• determining whether the sender entity is permitted to communicate with the recipient entity according to a firewall policy, wherein the firewall policy indicates a plurality of entity identifiers and rules for communications among a plurality of entities including the recipient entity, each entity identifier corresponding to a respective entity of the plurality of entities, wherein each entity identifier is unique among the plurality of entity identifiers, wherein the rules for communications among the plurality of entities include a list of pairs of entities which are permitted to communicate with each other;
• forwarding the packet to the recipient entity when it is determined that the sender entity is permitted to communicate with the recipient entity;
• and
• performing at least one mitigation action when it is determined that the recipient entity is not permitted to communicate with the sender entity.

A method for encoding entity identifiers for use in identity-based firewall policy evaluation, comprising:

• intercepting a packet sent by a sender entity to a recipient entity, the packet including a header, wherein the sender entity and the recipient entity are subject to a firewall policy, wherein the firewall policy indicates a plurality of entity identifiers and rules for communications among a plurality of entities including the sender entity and the recipient entity, each entity identifier corresponding to a respective entity of the plurality of entities, wherein each entity identifier is unique among the plurality of entity identifiers, wherein the rules for communications among the plurality of entities include a list of pairs of entities which are permitted to communicate with each other;
• computing a signature based on the entity identifier of the sender entity;
• and
• adding the signature to the header of the packet.

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• intercepting a packet sent by a sender entity to a recipient entity, the packet including a header, wherein the sender entity and the recipient entity are subject to a firewall policy, wherein the firewall policy indicates a plurality of entity identifiers and rules for communications among a plurality of entities including the sender entity and the recipient entity, each entity identifier corresponding to a respective entity of the plurality of entities, wherein each entity identifier is unique among the plurality of entity identifiers, wherein the rules for communications among the plurality of entities include a list of pairs of entities which are permitted to communicate with each other;
• computing a signature based on the entity identifier of the sender entity;
• and
• adding the signature to the header of the packet.

A system for encoding entity identifiers for use in identity-based firewall policy evaluation, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• intercept a packet sent by a sender entity to a recipient entity, the packet including a header, wherein the sender entity and the recipient entity are subject to a firewall policy, wherein the firewall policy indicates a plurality of entity identifiers and rules for communications among a plurality of entities including the sender entity and the recipient entity, each entity identifier corresponding to a respective entity of the plurality of entities, wherein each entity identifier is unique among the plurality of entity identifiers, wherein the rules for communications among the plurality of entities include a list of pairs of entities which are permitted to communicate with each other;
• compute a signature based on the entity identifier of the sender entity;
• and
• add the signature to the header of the packet.