Infrastructural edge security as a service
AssigneeDell Products L.P.
InventorsVictor Fong, Sarah Evans
Life of this patent
Estimating the term…
Abstract
Edge security is disclosed. Hosts included in a distributed infrastructure are equipped with data processing units that may be centrally managed using a control plane. Security policies can be selectively distributed to the hosts and localized at the hosts. Reactions to security violations can be initiated at the hosts in substantially real-time. The security policies may take various forms, including rule-based security policies and inference mode-based security policies.
Claims20
A method comprising:
- distributing a security policy to hosts in a distributed infrastructure, wherein each of the hosts include a data processing unit, wherein the hosts that receive the security policy are identified using a matching policy, wherein the security policy is received at a data processing unit in each of the hosts;
- localizing the security policy at each of the hosts, by an agent in the data processing unit;
- executing the security policy at each of the hosts;
- and
- performing a reaction defined in the security policy when a security violation is identified.
A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
- distributing a security policy to hosts in a distributed infrastructure, wherein each of the hosts include a data processing unit, wherein the hosts are identified using a matching policy, wherein the security policy is received at a data processing unit in each of the hosts;
- localizing the security policy at each of the hosts, by an agent in the data processing unit;
- executing the security policy at each of the hosts;
- and
- performing a reaction defined in the security policy when a security violation is identified.
A data processing unit comprising:
- a smart network interface card that is installed on a host;
- an agent configured to receive and implement a security policy received from a control plane in the smart network interface card installed on the host, wherein the security policy includes at least one of a deterministic security policy and a machine learning model configured to generate an inference regarding whether network traffic violates the security policy;
- and
- a localizer configured to adapt the security policy to the host.
Dependencies are inferred from the claim text.