Illumio, Inc.

Ilumio, Inc.

Juraj George Fandli

Paul James Kirner

Mukesh Gupta

Matthew Kirby Glenn

Daniel Richard Cook

Jerry B Scott

Andrew S Rubin

Sehyo Chang

Thukalan V Verghese

Thomas Michael McCormick

Hai Xiao

Michael J Carlton

Alan B Stokol

Antonio P A Rainha Dias

Rupesh Kumar Mishra

Roy Nobuo Nakashima

Joel E VanderKwaak

Ronald Isaacson

Russell Stuart Goodwin

Anish Vinodkumar Desai

Joy Anne Scott

Yair Harel

Charles Zou Liu

Ramnath Duggirala

Alan B Stokel

Nathanael John Iversen

Antonio Pedro Alexandre Rainha Dias

Bryan Patrick Pelham

Antonio Rainha Dias

A segmentation system includes a cluster of segmentation servers that interoperate to obtain and manage a segmentation policy for controlling communications between workloads in an administrative domain. The cluster of segmentation servers includes a leader segmentation server and at least one member segmentation server. The leader segmentation server controls policy generation and distributes the segmentation policy to the member segmentation servers. The segmentation servers are each optionally paired with a respective set of workloads. The segmentation servers each distribute descriptions of their respective paired workloads to the other segmentation servers. Each segmentation server processes the segmentation policy to generate management instructions for controlling communications to and from their respective paired workloads and distributes the management instructions to the operating system instances executing the workloads to enforce the segmentation policy. The cluster of segmentation servers beneficially enables a segmentation system with high scalability, reliability, and efficiency.

Segmentation server cluster for managing a segmentation policy

A policy management server manages a segmentation policy and policy constraints. The segmentation policy comprises a set of segmentation rules that each permit connections between specified groups of workloads that provide or consume network-based services. The policy constraints comprise a set of constraint rules that determine compliance of the segmentation rules. A workflow process may be initiated to resolve non-compliant rules by enabling an administrator to approve or deny the rule. In a large enterprise managing significant numbers of workloads, the policy constraints may be employed to ensure that overly permissive segmentation rules are not being created. This facilitates creation of a robust and narrowly tailored segmentation policy that reduces exposure of the enterprise to network-based security threats.

Constraint rules for constraining creation of a segmentation policy

A traffic control and monitoring module includes a firewall operating in a container namespace that is configured to control and monitor traffic to and from a container in the container namespace. The traffic control and monitoring module reports detected traffic to a traffic flow reporting module operating in a host namespace of the host operating system. The traffic control and monitoring module obtains traffic flows associated with a plurality of containers in different container namespaces and reports the traffic flows to a segmentation policy. Based on the reported traffic flows, the segmentation server may update a segmentation policy to improve network security.

Monitoring traffic flows of containers in a segmented network environment

A managed server (MS) within an administrative domain is quarantined. The administrative domain includes multiple MSs that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules. The quarantined MS is isolated from other MSs. A description of the MS is modified to indicate that the MS is quarantined, thereby specifying a description of the quarantined MS. Cached actor-sets are updated to indicate the quarantined MS's changed state, thereby specifying updated actor-sets. A determination is made regarding which updated actor-sets are relevant to an other MS, thereby specifying currently-relevant updated actor-sets. A determination is made regarding whether the currently-relevant updated actor-sets differ from actor-sets previously sent to the other MS. Responsive to determining that the currently-relevant updated actor-sets are identical to the previously-sent actor-sets, no further action is taken.

Distributed network security using a logical multi-dimensional label-based policy model

A policy management server enables selective enforcement of a segmentation policy. The policy management server manages a segmentation policy that specifies a set of segmentation rules specifying permitted communications between workloads. The policy management server separately manages an enforcement policy that controls whether or not the segmentation policy is enforced for different services provided by the workloads. For services that are enforced, the policy management server distributes instructions to distributed enforcement modules that configure traffic filters to block traffic pertaining to enforced services that does not meet the segmentation rules. For non-enforced services, the policy management server obtains traffic data from the distributed enforcement modules without enforcing the segmentation policy to enable an administrator to build and/or test the segmentation policy.

Selective enforcement of a segmentation policy

State information is received from a server indicating an identity of a user logged into the server. An administrative domain wide policy is determined that specifies a relationship between user a group and services or servers accessible to users belonging to the user group. Relevant servers are sent updated management instructions corresponding to rules of the administrative domain wide policy. Such rules provide access to a service or server to users belonging to user groups related to the service. As a result, the servers allow communications that provide access to users based on the specified relationships.

Enforcing label-based rules on a per-user basis in a distributed network management system

In a segmented network environment, a traffic flow graph provides visibility into the connections between workloads or groups of workloads under management of a segmentation policy. Squelching rules may be applied to hide traffic in the traffic flow graph that meets specified criteria. The squelching rules may be label-based rules that enable configuration of squelching rules that apply to group of workloads and enable configurations to be rapidly updated as workloads or added or dropped from the network or as their configurations change. Additionally, squelching rules may be applied based on characteristics of the traffic data or based on an identity of an administrator viewing the traffic flow graph.

Label-based rules for squelching visible traffic in a segmented network environment

In a segmented network environment, a segmentation server assigns labels to workloads to enable the segmentation server to implement a segmentation policy based on label-based rules. A first set of labels associated with one or more label dimensions may be assigned in a secure manner by automatically assigning the labels based on a pairing profile. A second set of labels associated with different label dimensions may be assigned automatically based on workload attributes. An administrator can manage which label dimensions are assigned in a secure way based on the pairing profile and which labels are assigned in an adaptable way based on workload attributes, thereby enabling the administrator to flexibly manage the tradeoff between adaptability and security.

Automatically assigning labels to workloads while maintaining security boundaries

A segmentation server generates and distributes management instructions for enforcing a segmentation policy. The segmentation server discovers a network configuration of workloads including an identification of workloads that are behind network address translation modules. The segmentation server generates management instructions for enforcing the rules in a manner dependent on the detected network configuration. Furthermore, the segmentation server monitors traffic flows and generates a traffic flow graph in a manner dependent on the detected network configuration.

Traffic visibility and segmentation policy enforcement for workloads in different address spaces

A container orchestration server stores pairing keys in association with container profiles. A container orchestration agent executing on an operating system instance instantiates a new container according to a particular container profile in response to an instruction from the container orchestration server and stores the pairing key as metadata associated with the container. An enforcement module detects the instantiation of the container and obtains the corresponding pairing key from the container orchestration agent. The enforcement module transmits the pairing key to a segmentation server for validation. If the segmentation server validates the key, the segmentation server determines a label set corresponding to the container profile associated with the pairing key and generates management instructions for the container based on the label set. The management instructions, when enforced by the operating system, controls communications between the container and other workloads in accordance with a segmentation policy.

Managing containers based on pairing keys in a segmented network environment

A change to a state of a particular managed server within an administrative domain is processed. The administrative domain includes a plurality of managed servers that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules. A first description of the particular managed server is modified to indicate the particular managed server's changed state, thereby specifying a second description of the particular managed server. The unmodified first description is compared to the second description, thereby specifying a description change. A determination is made, based on the description change, regarding whether to update management instructions previously sent to the particular managed server.

Handling changes in a distributed network management system that uses a logical multi-dimensional label-based policy model

Management instructions for a particular managed server within an administrative domain are generated according to an administrative domain-wide management policy that comprises a set of one or more rules. The administrative domain includes a plurality of managed servers. A determination is made regarding which rules within the set of rules are relevant to the particular managed server. Function-level instructions are generated based on the rules that were determined to be relevant. A determination is made regarding which managed servers within the plurality of managed servers are relevant to the particular managed server. The function-level instructions and information regarding the managed servers that were determined to be relevant are sent to the particular managed server. The particular managed server uses the function-level instructions and information regarding the managed servers to configure a management module so that the configured management module implements the administrative domain-wide management policy.

Distributed network management using a logical multi-dimensional label-based policy model

A global manager computer generates management instructions for a particular managed server within an administrative domain according to a set of rules. A global manager computer identifies a traffic midpoint device through which the provider managed server provides a service to a user device. The global manager determines a relevant rule from the set of rules that is applicable to communication between the provider managed server and the user device and generates a backend rule that is applicable to communication between the provider managed server and the traffic midpoint device. The global managed generates a backend function-level instruction including a reference to an actor-set authorized to communicate with the provider managed server to use the service. The global manager sends the backend function-level instruction to the provider managed server to configure the provider managed server to enforce the backend rule on communication with the actor-set including the traffic midpoint device.

Growing community of inventors

Campbell, CA, United States of America

Juraj George Fandli