# US 2024/0205191 A1 · Security policy enforcement for additional instances of an application

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205191 A1
- Document ID: US20240205191A1
- Status: Published application
- Kind: A1
- Application number: 18/106,526
- Filed: 2023-02-07
- Published: 2024-06-20
- Earliest claimed: 2022-12-19
- Assignees: VMware, Inc.
- Applicants: Vmware, Inc.
- Inventors: SHIRISH VIJAYVARGIYA; VASANTHA KUMAR DHANASEKAR; SRIRAM GOPALAKRISHNAN
- Web page: https://patentgrep.com/patent/US20240205191A1

## CPC

- H04L 63/0263: {Rule management}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The disclosure provides an approach for firewall policy management. Embodiments include receiving, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI. Embodiments include determining, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall. Embodiments include applying, at the firewall, based on the first identifier included in the registration request, the network policy associated with the second VCI to the first VCI. Additionally, embodiments include allowing or disallowing network activity for the first VCI based on the applied network security policy.

## Claims

### Claim 1

A method for firewall policy enforcement, the method comprising:
receiving, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI;
determining, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall;
applying, at the firewall, based on the first identifier included in the registration request, the network security policy associated with the second VCI to the first VCI; and
allowing or disallowing network activity for the first VCI based on the applied network security policy.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first VCI is a clone of the second VCI.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first identifier comprises a first BIOS ID of the first VCI and the second identifier comprises a second BIOS ID of the second VCI.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving, at the firewall from a third VCI, a second registration request comprising a third identifier of the third VCI;
determining, at the firewall, the third identifier is not associated with any of the network security policy at the firewall;
sending, from the firewall to a policy manager, a security policy request for the third VCI, the security policy request comprising the third identifier; and
receiving, from the policy manager, a second network policy to apply to the third VCI.

### Claim 5 (depends on 1)

The method of claim 1, wherein applying the network security policy associated with the second VCI to the first VCI further comprises creating an association between the first identifier of the first VCI and the second identifier of the second VCI.

### Claim 6 (depends on 1)

The method of claim 1, wherein the second identifier comprises a registration identifier associated with the second VCI.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
instantiating the first VCI by cloning the second VCI; and
in response to the first VCI being instantiated, storing, by an agent operating on the first VCI, the first identifier as being associated with the first VCI and the second identifier as being associated with the second VCI.

### Claim 8

A system for firewall policy enforcement, the system comprising:
at least one memory; and
at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:
receive, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI;
determine, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall;
apply, at the firewall, based on the first identifier included in the registration request, the network security policy associated with the second VCI to the first VCI; and
allow or disallow network activity for the first VCI based on the applied network security policy.

### Claim 9 (depends on 8)

The system of claim 8, wherein the first VCI is a clone of the second VCI.

### Claim 10 (depends on 8)

The system of claim 8, wherein the first identifier comprises a first BIOS ID of the first VCI and the second identifier comprises a second BIOS ID of the second VCI.

### Claim 11 (depends on 8)

The system of claim 8, wherein the at least one processor and the at least one memory are further configured to:
receive, at the firewall from a third VCI, a second registration request comprising a third identifier of the third VCI;
determine, at the firewall, the third identifier is not associated with any of the network security policy at the firewall;
send, from the firewall to a policy manager, a security policy request for the third VCI, the security policy request comprising the third identifier; and
receive, from the policy manager, a second network policy to apply to the third VCI.

### Claim 12 (depends on 8)

The system of claim 8, wherein to apply the network security policy associated with the second VCI to the first VCI, the at least one processor and the at least one memory are further configured to create an association between the first identifier of the first VCI and the second identifier of the second VCI.

### Claim 13 (depends on 8)

The system of claim 8, wherein the second identifier comprises a registration identifier associated with the second VCI.

### Claim 14

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
receive, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI;
determine, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall;
apply, at the firewall, based on the first identifier included in the registration request, the network security policy associated with the second VCI to the first VCI; and
allowing or disallowing network activity for the first VCI based on the applied network security policy.

### Claim 15 (depends on 14)

The computer-readable medium of claim 14, wherein the first VCI is a clone of the second VCI.

### Claim 16 (depends on 14)

The computer-readable medium of claim 14, wherein the first identifier comprises a first BIOS ID of the first VCI and the second identifier comprises a second BIOS ID of the second VCI.

### Claim 17 (depends on 14)

The computer-readable medium of claim 14, wherein the instructions that, when executed by the one or more processors, further cause the one or more processors to:
receive, at the firewall from a third VCI, a second registration request comprising a third identifier of the third VCI;
determine, at the firewall, the third identifier is not associated with any network security policy at the firewall;
send, from the firewall to a policy manager, a security policy request for the third VCI, the security policy request comprising the third identifier; and
receive, from the policy manager, a second network policy to apply to the third VCI.

### Claim 18 (depends on 14)

The computer-readable medium of claim 14, wherein to apply the network security policy associated with the second VCI to the first VCI, the instructions cause the one or more processors to create an association between the first identifier of the first VCI and the second identifier of the second VCI.

### Claim 19 (depends on 14)

The computer-readable medium of claim 14, wherein the second identifier comprises a registration identifier associated with the second VCI.

### Claim 20 (depends on 14)

The computer-readable medium of claim 14, wherein the instructions that, when executed by the one or more processors, further cause the one or more processors to:
instantiate the first VCI as a clone of the second VCI; and
in response to the first VCI being instantiated, store the first identifier as being associated with the first VCI and the second identifier as being associated with the second VCI.