Illumio, Inc.

Tropos Networks, Inc.

Juniper Networks, Inc.

Mukesh Gupta

Paul James Kirner

Matthew Kirby Glenn

Juraj George Fandli

Daniel Richard Cook

Jerry B Scott

Thukalan V Verghese

Andrew S Rubin

Ramanagopal V Vogety

Cyrus Behroozi

Joy Anne Scott

Sehyo Chang

Seth Bruce Ford

Devabhaktuni Srikrishna

Anish Vinodkumar Desai

Alan B Stokol

Nathaniel Jurist Gleicher

Amalavoyal Narasimha Chari

Wenge Ren

Roy Nobuo Nakashima

Huizhao Wang

Rupesh Kumar Mishra

Thomas Michael McCormick

Amit Kumar Saha

Frederick Dean

Nagavenkata Suresh Melam

Kevin Weil

Joel E VanderKwaak

Michael J Carlton

Saar Gillai

Charles Zou Liu

William R Long

Dhanalakshmi Balasubramaniam

Ramnath Duggirala

Antonio Pedro Alexandre Rainha Dias

Alan B Stokel

Bryan Patrick Pelham

Jaehong Park

Srikanth Chavali

A segmentation system includes a cluster of segmentation servers that interoperate to obtain and manage a segmentation policy for controlling communications between workloads in an administrative domain. The cluster of segmentation servers includes a leader segmentation server and at least one member segmentation server. The leader segmentation server controls policy generation and distributes the segmentation policy to the member segmentation servers. The segmentation servers are each optionally paired with a respective set of workloads. The segmentation servers each distribute descriptions of their respective paired workloads to the other segmentation servers. Each segmentation server processes the segmentation policy to generate management instructions for controlling communications to and from their respective paired workloads and distributes the management instructions to the operating system instances executing the workloads to enforce the segmentation policy. The cluster of segmentation servers beneficially enables a segmentation system with high scalability, reliability, and efficiency.

Segmentation server cluster for managing a segmentation policy

A segmentation server generates vulnerability exposure scores associated with workloads operating in a segmented computing environment. The segmentation server may automatically aggregate the vulnerability exposure scores in various ways to generate vulnerability exposure information representative of workloads in an administrative domain controlled by the segmentation server. The aggregated vulnerability exposure information may be presented in a manner that enables an administrator to easily evaluate different segmentation strategies and assess the risks associated with each of them. Moreover, the segmentation server can automatically generate a segmentation policy that modifies a configured segmentation strategy based on the vulnerability exposure scores to reduce exposure to certain vulnerabilities without impeding operation of the workloads.

Generating a segmentation policy based on vulnerabilities

Generating vulnerability exposure scores in a segmented computing environment

A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.

Enforcing a segmentation policy using cryptographic proof of identity

A managed server (MS) within an administrative domain is quarantined. The administrative domain includes multiple MSs that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules. The quarantined MS is isolated from other MSs. A description of the MS is modified to indicate that the MS is quarantined, thereby specifying a description of the quarantined MS. Cached actor-sets are updated to indicate the quarantined MS's changed state, thereby specifying updated actor-sets. A determination is made regarding which updated actor-sets are relevant to an other MS, thereby specifying currently-relevant updated actor-sets. A determination is made regarding whether the currently-relevant updated actor-sets differ from actor-sets previously sent to the other MS. Responsive to determining that the currently-relevant updated actor-sets are identical to the previously-sent actor-sets, no further action is taken.

Distributed network security using a logical multi-dimensional label-based policy model

State information is received from a server indicating an identity of a user logged into the server. An administrative domain wide policy is determined that specifies a relationship between user a group and services or servers accessible to users belonging to the user group. Relevant servers are sent updated management instructions corresponding to rules of the administrative domain wide policy. Such rules provide access to a service or server to users belonging to user groups related to the service. As a result, the servers allow communications that provide access to users based on the specified relationships.

Enforcing label-based rules on a per-user basis in a distributed network management system

In a segmented network environment, a traffic flow graph provides visibility into the connections between workloads or groups of workloads under management of a segmentation policy. Squelching rules may be applied to hide traffic in the traffic flow graph that meets specified criteria. The squelching rules may be label-based rules that enable configuration of squelching rules that apply to group of workloads and enable configurations to be rapidly updated as workloads or added or dropped from the network or as their configurations change. Additionally, squelching rules may be applied based on characteristics of the traffic data or based on an identity of an administrator viewing the traffic flow graph.

Label-based rules for squelching visible traffic in a segmented network environment

A segmentation server enables user-based management of a segmentation policy. Administrators belonging to different user groups may have different limited visibility into traffic flows controlled by the segmentation policy and may be assigned different privileges with respect to viewing, creating, and modifying rules of the segmentation policy. Thus, the burden of administering the segmentation policy may be distributed between administrators associated with different user groups that each may have responsibility for a different segment.

User-based visibility and control of a segmentation policy

An enforcement module receives a DNS-based rule of a segmentation policy that controls access of a managed workload to workloads in a DNS domain in which the IP addresses of the workloads associated with a domain name are resolved by a DNS server. When the managed workload makes a connection request to the workload associated with the domain name, the enforcement module snoops on a DNS response from the DNS server to learn the IP address of the workload associated with the domain name. If a domain name of the DNS domain is in a whitelist of domain names permitted by the DNS-based rule, the enforcement module adds the learned IP address to a whitelist of IP addresses and configures a firewall associated with the managed workload to permit connections to the IP addresses in the whitelist.

Domain name based visibility and policy enforcement in a segmented network environment

In a segmented network environment, a segmentation server assigns labels to workloads to enable the segmentation server to implement a segmentation policy based on label-based rules. A first set of labels associated with one or more label dimensions may be assigned in a secure manner by automatically assigning the labels based on a pairing profile. A second set of labels associated with different label dimensions may be assigned automatically based on workload attributes. An administrator can manage which label dimensions are assigned in a secure way based on the pairing profile and which labels are assigned in an adaptable way based on workload attributes, thereby enabling the administrator to flexibly manage the tradeoff between adaptability and security.

Automatically assigning labels to workloads while maintaining security boundaries

A container orchestration server stores pairing keys in association with container profiles. A container orchestration agent executing on an operating system instance instantiates a new container according to a particular container profile in response to an instruction from the container orchestration server and stores the pairing key as metadata associated with the container. An enforcement module detects the instantiation of the container and obtains the corresponding pairing key from the container orchestration agent. The enforcement module transmits the pairing key to a segmentation server for validation. If the segmentation server validates the key, the segmentation server determines a label set corresponding to the container profile associated with the pairing key and generates management instructions for the container based on the label set. The management instructions, when enforced by the operating system, controls communications between the container and other workloads in accordance with a segmentation policy.

Managing containers based on pairing keys in a segmented network environment

A change to a state of a particular managed server within an administrative domain is processed. The administrative domain includes a plurality of managed servers that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules. A first description of the particular managed server is modified to indicate the particular managed server's changed state, thereby specifying a second description of the particular managed server. The unmodified first description is compared to the second description, thereby specifying a description change. A determination is made, based on the description change, regarding whether to update management instructions previously sent to the particular managed server.

Handling changes in a distributed network management system that uses a logical multi-dimensional label-based policy model

Growing community of inventors

Milpitas, CA, United States of America

Mukesh Gupta