# US 9,438,560 B2 · Systems and methods for automatically applying firewall policies within data center applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,560 B2 - Document ID: US9438560B2 - Status: Granted - Kind: B2 - Application number: 14/588,146 - Filed: 2014-12-31 - Published: 2016-06-30 - Granted: 2016-09-06 - Earliest claimed: 2014-12-31 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Shubhabrata Mohanty; Amaresh Shirsat - Web page: https://patentgrep.com/patent/US9438560B2 ## CPC - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 41/0803: Configuration setting - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed method may include (1) identifying a data center application whose functionality is provided by a set of systems, (2) organizing, automatically by the computing device, the set of systems into one or more application model groups by, for each system in the set of systems, identifying an attribute of the system that is indicative of a security context under which the system should operate and assigning the system to an application model group for which the security context will be provided, and (3) for each application model group in the one or more application model groups, protecting the application model group by selecting a firewall configuration that will provide the security context for the application model group and by using the selected firewall configuration to protect the application model group. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for automatically applying firewall policies within data center applications, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a data center application whose functionality is provided by a set of systems; organizing, automatically by the computing device, the set of systems into one or more application model groups that each comprise a group of applications with a same security context by, for each system in the set of systems: identifying an attribute of the system within the set of systems that is indicative of a security context under which the system should operate; assigning the system to an application model group for which the security context will be provided; for each application model group in the one or more application model groups, protecting the application model group by: selecting a firewall configuration that, when applied, will provide the security context for the application model group based at least in part on correlating metadata about the firewall configuration with the application model group; using the selected firewall configuration to protect the application model group. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein: identifying the data center application comprises querying a data center platform to identify the set of systems that comprise the data center application; identifying the attribute of the system comprises querying the data center application to determine at least one of: an application tier that the system belongs to within the data center application; a service running on the system; an inbound dependency of the system; an outbound dependency of the system. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein organizing the systems into one or more application model groups comprises: determining, based on application tiers, services, and dependencies of the set of systems of the data center application, at least one of: how many application model groups the systems will be organized into; the security contexts that should be provided for each of the application model groups. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein: selecting the firewall configuration comprises: identifying a set of firewall configurations, wherein each firewall configuration within the set of firewall configurations comprises a different set of firewall policies; choosing the firewall configuration that corresponds to the security context for the application model group; using the selected firewall configuration to protect the application model group comprises: configuring a firewall with the firewall configuration; activating the firewall such that the firewall protects the application model group. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein identifying the set of firewall configurations comprises: identifying each application model group in which the systems of the data center application are organized; creating a firewall configuration for each identified application model group by establishing a set of firewall policies that, when enforced, will provide the security context for each identified application model group. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, wherein identifying a set of firewall configurations comprises identifying the metadata of each firewall configuration in the set of firewall configurations. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein using the selected firewall configuration to protect the application model group comprises providing security micro-segmentation by enforcing one or more policies of the selected firewall configuration on communications between the application model group and at least one other application model group of the data center application. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: determining that a new system has been added to the data center application; in response to determining that the new system has been added to the data center application: identifying an attribute of the new system that is indicative of a security context under which the new system should operate; assigning the system to an existing application model group for which the security context will be provided. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein: the system comprises a virtual machine; the firewall configuration is implemented within a virtual firewall; the data center application is implemented on a software-defined data center platform; organizing the set of systems into the one or more application model groups comprises instructing the software-defined data center platform to use a data structure of the software-defined data center platform to divide the set of systems into the one or more application model groups. ### Claim 10 A system for automatically applying firewall policies within data center applications, the system comprising: at least one hardware memory; an identification module, stored in the hardware memory, that identifies a data center application whose functionality is provided by a set of systems; an organization module, stored in the hardware memory, that organizes, automatically by a computing device, the set of systems into one or more application model groups that each comprise a group of applications with a same security context by, for each system in the set of systems: identifying an attribute of the system within the set of systems that is indicative of a security context under which the system should operate; assigning the system to an application model group for which the security context will be provided; a security module, stored in the hardware memory, that, for each application model group in the one or more application model groups, protects the application model group by: selecting a firewall configuration that, when applied, will provide the security context for the application model group based at least in part on correlating metadata about the firewall configuration with the application model group; using the selected firewall configuration to protect the application model group; at least one physical processor configured to execute the identification module, the organization module, and the security module. ### Claim 11 (depends on 10) The system of claim 10, wherein: the identification module identifies the data center application by querying a data center platform to identify the set of systems that comprise the data center application; the organization module identifies the attribute of the system by querying the data center application to determine at least one of: an application tier that the system belongs to within the data center application; a service running on the system; an inbound dependency of the system; an outbound dependency of the system. ### Claim 12 (depends on 11) The system of claim 11, wherein the organization module organizes the systems into one or more application model groups by: determining, based on application tiers, services, and dependencies of the set of systems of the data center application, at least one of: how many application model groups the systems will be organized into; the security contexts that should be provided for each of the application model groups. ### Claim 13 (depends on 10) The system of claim 10, wherein: the security module selects the firewall configuration by: identifying a set of firewall configurations, wherein each firewall configuration within the set of firewall configurations comprises a different set of firewall policies; choosing the firewall configuration that corresponds to the security context for the application model group; the security module uses the selected firewall configuration to protect the application model group by: configuring a firewall with the firewall configuration; activating the firewall such that the firewall protects the application model group. ### Claim 14 (depends on 13) The system of claim 13, wherein the security module identifies the set of firewall configurations by: identifying each application model group in which the systems of the data center application are organized; creating a firewall configuration for each identified application model group by establishing a set of firewall policies that, when enforced, will provide the security context for each identified application model group. ### Claim 15 (depends on 13) The system of claim 13, wherein the identification module identifies the set of firewall configurations by identifying the metadata of each firewall configuration in the set of firewall configurations. ### Claim 16 (depends on 10) The system of claim 10, wherein the security module uses the selected firewall configuration to protect the application model group by providing security micro-segmentation by enforcing one or more policies of the selected firewall configuration on communications between the application model group and at least one other application model group of the data center application. ### Claim 17 (depends on 10) The system of claim 10, wherein: the identification module determines that a new system has been added to the data center application; in response to determining that the new system has been added to the data center application: the organization module identifies an attribute of the new system that is indicative of a security context under which the new system should operate; the organization module assigns the system to an existing application model group for which the security context will be provided. ### Claim 18 (depends on 10) The system of claim 10, wherein: the system comprises a virtual machine; the firewall configuration is implemented within a virtual firewall; the data center application is implemented on a software-defined data center platform; the organization module organizes the set of systems into the one or more application model groups by instructing the software-defined data center platform to use a data structure of the software-defined data center platform to divide the set of systems into the one or more application model groups. ### Claim 19 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: identify a data center application whose functionality is provided by a set of systems; organize, automatically by the computing device, the set of systems into one or more application model groups that each comprise a group of applications with a same security context by, for each system in the set of systems: identifying an attribute of the system within the set of systems that is indicative of a security context under which the system should operate; assigning the system to an application model group for which the security context will be provided; for each application model group in the one or more application model groups, protect the application model group by: selecting a firewall configuration that, when applied, will provide the security context for the application model group based at least in part on correlating metadata about the firewall configuration with the application model group; using the selected firewall configuration to protect the application model group. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the one or more computer-readable instructions cause the computing device to: identify the data center application comprises querying a data center platform to identify the set of systems that comprise the data center application; identify the attribute of the system comprises querying the data center application to determine at least one of: an application tier that the system belongs to within the data center application; a service running on the system; an inbound dependency of the system; an outbound dependency of the system.