# US 9,521,115 B1 · Security policy generation using container metadata > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,115 B1 - Document ID: US9521115B1 - Status: Granted - Kind: B1 - Application number: 15/080,519 - Filed: 2016-03-24 - Granted: 2016-12-13 - Earliest claimed: 2016-03-24 - Assignees: vArmour Networks, Inc. - Applicants: vArmour Networks, Inc. - Inventors: Marc Woolward - Web page: https://patentgrep.com/patent/US9521115B1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and media for producing a firewall rule set are provided herein. Exemplary methods may include: receiving metadata about a deployed container from a container orchestration layer; determining an application or service associated with the container from the received metadata; retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the container; and generating a high-level declarative security policy associated with the container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the container can communicate. ## Claims ### Claim 1 A method for security in a container-based virtualization environment comprising: receiving metadata about a deployed container from a container orchestration layer, the metadata including an image type of the deployed container, the deployed container being deployed in a hardware server; determining an application or service performed by the deployed container from the received metadata; retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the deployed container; generating a high-level declarative security policy associated with the deployed container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the deployed container communicates; and launching a compiler, the compiler producing a low-level firewall rule set using the high-level declarative security policy, the low-level firewall rule set being provided to an enforcement point, the enforcement point applying the low-level firewall rule set to data network traffic. ### Claim 2 (depends on 1) The method of claim 1, in which the metadata is received from the container orchestration layer using at least an application programming interface (API). ### Claim 3 (depends on 1) The method of claim 1, in which: the metadata further includes at least one of an image name, service name, ports, and other tags and/or labels associated with the deployed container; and the at least one of the image name, service name, ports, and other tags and/or labels is associated with the determined application or service. ### Claim 4 (depends on 1) The method of claim 1, in which the determining the application or service includes: identifying the determined application or service using the image type. ### Claim 5 (depends on 1) The method of claim 1, in which the deployed container is at least one of: a Docker container and a Rocket (rkt) container. ### Claim 6 (depends on 5) The method of claim 5, in which the container orchestration layer is at least one of: Docker Swarm, Kubernetes, Diego, and Mesos. ### Claim 7 (depends on 1) The method of claim 1, in which the determined application or service is at least one of: a database, email server, message queue, web server, Session Initiation Protocol (SIP) server, file server, object-based storage, naming system, storage networking, and directory. ### Claim 8 (depends on 1) The method of claim 1 further comprising: determining a potential violation of the high-level declarative security policy using the low-level firewall rule set; and performing at least one of: sending an alert, dropping communications associated with the potential violation, and forwarding communications associated with the potential violation. ### Claim 9 A system for security in a container-based virtualization environment comprising: a hardware processor; and a memory coupled to the hardware processor, the memory storing instructions which are executable by the hardware processor to perform a method comprising: receiving metadata about a deployed container from a container orchestration layer, the metadata including an image type of the deployed container, the deployed container being deployed in a hardware server; determining an application or service performed by the deployed container from the received metadata; retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the deployed container; generating a high-level declarative security policy associated with the deployed container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the deployed container communicates; and launching a compiler, the compiler producing a low-level firewall rule set using the high-level declarative security policy, the low-level firewall rule set being provided to an enforcement point, the enforcement point applying the low-level firewall rule set to data network traffic. ### Claim 10 (depends on 9) The system of claim 9, wherein the metadata is received from the container orchestration layer using at least an application programming interface (API). ### Claim 11 (depends on 9) The system of claim 9, in which: the metadata further includes at least one of an image name, service name, ports, and other tags and/or labels associated with the deployed container; and the at least one of the image name, service name, ports, and other tags and/or labels is associated with the determined application or service. ### Claim 12 (depends on 9) The system of claim 9, in which the determining the application or service includes: identifying the determined application or service using the image type. ### Claim 13 (depends on 9) The system of claim 9, in which the deployed container is at least one of: a Docker container and a Rocket (rkt) container. ### Claim 14 (depends on 13) The system of claim 13, in which the container orchestration layer is at least one of: Docker Swarm, Kubernetes, Diego, and Mesos. ### Claim 15 (depends on 9) The system of claim 9, in which the determined application or service is at least one of: a database, email server, message queue, web server, Session Initiation Protocol (SIP) server, file server, object-based storage, naming system, storage networking, and directory. ### Claim 16 (depends on 9) The system of claim 9, in which the method further comprises: determining a potential violation of the high-level declarative security policy using the low-level firewall rule set; and performing at least one of: sending an alert, dropping communications associated with the potential violation, and forwarding communications associated with the potential violation. ### Claim 17 A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for security in a container-based virtualization environment, the method comprising: receiving metadata about a deployed container from a container orchestration layer, the metadata including an image type of the deployed container, the deployed container being deployed in a hardware server; determining an application or service performed by the deployed container from the received metadata; retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the deployed container; generating a high-level declarative security policy associated with the deployed container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the deployed container communicates; and launching a compiler, the compiler producing a low-level firewall rule set using the high-level declarative security policy, the low-level firewall rule set being provided to an enforcement point, the enforcement point applying the low-level firewall rule set to data network traffic.