Illumio, Inc.

Joy Anne Scott

Mukesh Gupta

Paul James Kirner

Matthew Kirby Glenn

Seth Bruce Ford

Nathaniel Jurist Gleicher

Juraj George Fandli

Joel E VanderKwaak

Kuhu Gupta

Brian Staats

Ambika Yadav

Ramnath Duggirala

Lawrence Wilson Chen

A hybrid tree and network visualization represents a segmented computer network. The visualization presents an overview of the segmentation as a hierarchy and displays connections within the network. Using the visualization, analysts can explore a segmented network, identify nodes and connections of interest through exploratory network analysis, and drill down on elements of interest to reason about the patterns of relationships in the network. Thus, analysts can intuitively obtain a deeper understanding of the network to identify potential security threats and other problems as well as write better segmentation policies.

Visualization of segmented network

A segmentation server generates vulnerability exposure scores associated with workloads operating in a segmented computing environment. The segmentation server may automatically aggregate the vulnerability exposure scores in various ways to generate vulnerability exposure information representative of workloads in an administrative domain controlled by the segmentation server. The aggregated vulnerability exposure information may be presented in a manner that enables an administrator to easily evaluate different segmentation strategies and assess the risks associated with each of them. Moreover, the segmentation server can automatically generate a segmentation policy that modifies a configured segmentation strategy based on the vulnerability exposure scores to reduce exposure to certain vulnerabilities without impeding operation of the workloads.

Generating a segmentation policy based on vulnerabilities

Generating vulnerability exposure scores in a segmented computing environment

In a segmented network environment, a traffic flow graph provides visibility into the connections between workloads or groups of workloads under management of a segmentation policy. Squelching rules may be applied to hide traffic in the traffic flow graph that meets specified criteria. The squelching rules may be label-based rules that enable configuration of squelching rules that apply to group of workloads and enable configurations to be rapidly updated as workloads or added or dropped from the network or as their configurations change. Additionally, squelching rules may be applied based on characteristics of the traffic data or based on an identity of an administrator viewing the traffic flow graph.

Label-based rules for squelching visible traffic in a segmented network environment

Growing community of inventors

Los Altos, CA, United States of America

Joy Anne Scott