US 2026/0228201 A1 · ASSURANCE OF SECURITY RULES IN A NETWORK

Abstract

In some examples, a system creates a requirement including EPG selectors representing EPG pairs, a traffic selector, and a communication operator; determines that EPGs in distinct pairs are associated with different network contexts and, for each pair, which network context(s) contains associated policies; creates first data representing the pair, operator, and traffic selector; when only one network context contains the associated policies, creates second data representing a network model portion associated with the only network context and determines whether the first data is contained in the second data to yield a first check; when both network contexts contain the associated policies, also creates third data representing a network model portion associated with a second network context, and determines whether the first data is contained in the second and/or third data to yield a second check; and determines whether policies for the pairs comply with the requirement based on the checks.

Claims20

Dependent claims

A system comprising:

one or more processors;
and
at least one non-transitory computer-readable storage medium having stored therein instructions that, when executed by the one or more processors, cause the system to:
create a first respective data structure representing a respective pair of endpoint groups from one or more pairs of endpoint groups;
create a second respective data structure representing a first portion of a logical model of a network, the first portion of the logical model containing policies corresponding to one of a plurality of different network contexts;
determine whether the first respective data structure is contained in the second respective data structure, by evaluating one or more of:
a binary decision diagram, a reduced ordered binary decision diagram, or an n-bit vector that represents respective policies, to yield a containment check;
determine, in response to the containment check, whether policies for traffic between endpoint groups in the one or more pairs of endpoint groups comply with a security compliance requirement across the plurality of different network contexts to obtain a policy determination;
and
generate, in response to the policy determination, one or more compliance assurance events.

7 more elements

A method comprising:

creating a first respective data structure representing a respective pair of endpoint groups from one or more pairs of endpoint groups;
creating a second respective data structure representing a first portion of a logical model of a network, the first portion of the logical model containing policies corresponding to one of a plurality of different network contexts;
determining whether the first respective data structure is contained in the second respective data structure, by evaluating one or more of a binary decision diagram, a reduced ordered binary decision diagram, or an n-bit vector that represents respective policies, to yield a containment check;
determining, in response to the containment check, whether policies for traffic between endpoint groups in the one or more pairs of endpoint groups comply with a security compliance requirement across the plurality of different network contexts to obtain a policy determination;
and
generating, in response to the policy determination, one or more compliance assurance events.

3 more elements

Dependencies are inferred from the claim text.

Assurance of security rules in a network

Life of this patent

Assurance of security rules in a network

Life of this patent

Abstract

Claims20