Segmented networks that implement scanning

Patent metadata

Field	Value
Publication number	US-10110636-B2
Application number	US-201715441156-A
Country	US
Kind code	B2
Filing date	Feb 23, 2017
Priority date	Mar 13, 2015
Publication date	Oct 23, 2018
Grant date	Oct 23, 2018

Abstract

Systems for providing scanning within distributed services are provided herein. In some embodiments, a system includes a plurality of segmented environments that each includes an enforcement point that has an active probe device, and a plurality of workloads that each implements at least one service. The system also has a data center server coupled with the plurality of segmented environments over a network. The data center server has a security controller configured to provide a security policy to each of the plurality of segmented environments and an active probe controller configured to cause the active probe device of the plurality of segmented environments to execute a scan.

First claim

What is claimed is:

1. A system comprising:
a plurality of segmented environments, each of the plurality of segmented environments comprising an enforcement point comprising an active probe device, and a plurality of workloads each implementing at least one service component, the plurality of segmented environments collectively providing a service, each of the plurality of segmented environments providing a portion of the service; and
a data center server coupled with the plurality of segmented environments over a network, the data center server comprising:
a security controller providing, via at least one processor, a security policy to each of the plurality of segmented environments, the security policy being configured using the service; and
an active probe controller requesting, via the at least one processor, each active probe device of the plurality of segmented environments to perform a respective scan of a plurality of scans, the plurality of scans performed on the plurality of segmented environments collectively providing the service, the plurality of scans occurring in parallel on the plurality of workloads implementing the at least one service component, the plurality of scans being executed synchronously on the plurality of segmented environments without affecting performance of the network established between the data center server and the plurality of segmented environments, the active probe device of one or more of the plurality of segmented environments implementing a remediation scheme when the plurality of scans indicate a vulnerability.

2. The system according to claim 1 , wherein each respective scan occurs independent of the data center server.

3. The system according to claim 2 , wherein each of the plurality of segmented environments comprises a firewall, each respective scan occurring without traversing the network or passing through the firewall.

4. The system according to claim 2 , wherein, in response to completion of the respective scan, each of the plurality of segmented environments reports a scan status to the data center server via the network.

5. The system according to claim 1 , wherein the active probe device of each of the plurality of segmented environments is configured to execute the respective scan on demand.

6. The system according to claim 1 , wherein the active probe controller is configured to cause the active probe device of one or more segmented environments of the plurality of segmented environments to execute the respective scan when a triggering event is detected by the security controller.

7. The system according to claim 1 , wherein the active probe device of each of the plurality of segmented environments is configured to execute the respective scan upon detection of a violation of the security policy.

8. The system according to claim 7 , wherein the violation of the security policy includes anomalous workload behaviors.

9. The system according to claim 1 , wherein the active probe device of each of the plurality of segmented environments uses one or more scanning tools to perform the respective scan, the active probe device of each of the plurality of segmented environments obtaining the one or more scanning tools from the active probe controller if the one or more scanning tools are not pre-provisioned on the enforcement point.

10. A method comprising:
establishing a plurality of segmented environments within a data center, each of the plurality of segmented environments comprising an enforcement point comprising an active probe device, and a plurality of workloads each implementing at least one service component, the plurality of segmented environments collectively providing a service, each of the plurality of segmented environments providing a portion of the service;
provisioning each of the plurality of segmented environments with a security policy, the security policy being configured using the service; and
performing a scan on each of the plurality of segmented environments using a respective active probe device, the scans performed on the plurality of segmented environments collectively providing the service, the scans occurring in parallel on the plurality of workloads implementing the at least one service component, the respective active probe device identifying an affected segmented environment, the scans being executed synchronously on the plurality of segmented environments without affecting performance of a network established between a data center and the plurality of segmented environments, the respective active probe device implementing a remediation scheme when the scans indicate a vulnerability.

11. The method according to claim 10 , wherein the network couples the plurality of segmented environments and the data center, wherein the performance of the scan occurs in its entirety without crossing the network.

12. The method according to claim 11 , further comprising reporting, in response to completion of the scan, a scan status to the data center via the network.

13. The method according to claim 10 , further comprising transmitting to the respective active probe device instructions to execute the scan.

14. The method according to claim 10 , wherein the respective active probe device of each of the plurality of segmented environments is configured to execute the scan on demand.

15. The method according to claim 10 , further comprising detecting a triggering event within one or more segmented environments of the plurality of segmented environments, wherein the respective active probe device of the one or more segmented environments is configured to execute the scan in response to the triggering event being detected.

16. The method according to claim 10 , further comprising detecting a violation of the security policy within one or more segmented environments of the plurality of segmented environments, wherein the respective active probe device of the one or more segmented environments is configured to execute the scan in response to the violation being detected.

17. The method according to claim 16 , wherein the violation of the security policy includes anomalous workload behaviors.

18. The method according to claim 10 , further comprising obtaining one or more scanning tools from the data center if the one or more scanning tools are not pre-provisioned on the respective active probe device, wherein the respective active probe device uses the one or more scanning tools to perform the scan.

19. A method comprising:
establishing a plurality of segmented environments coupled to a data center server over a network, each of the plurality of segmented environments comprising an enforcement point comprising an active probe device, and a plurality of workloads each implementing at least one service component, the plurality of segmented environments collectively providing a service, each of the plurality of segmented environments providing a portion of the service;
providing, using a security controller, a security policy to each of the plurality of segmented environments, the security policy being configured using the service; and
requesting each active probe device of the plurality of segmented environments to perform a respective scan of a plurality of scans, the plurality of scans performed within the plurality of segmented environments collectively providing the service, the respective scan occurring independently of the data center server and other segmented environments of the plurality of segmented environments, the plurality of scans occurring in parallel on the plurality of w

Assignees

• Varmour Networks Inc

Inventors

• Ross Colin
• Shieh Choung-Yaw
• Lian Jia-Jyi
• Xu Meng
• Sun Yi

Classifications

• H04L67/16

  Electricity · mapped topic

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/0254

  Stateful filtering · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title