Systems and methods for securing network traffic flow in a multi-service containerized application

Patent metadata

Field	Value
Publication number	US-10439987-B2
Application number	US-201715619978-A
Country	US
Kind code	B2
Filing date	Jun 12, 2017
Priority date	Jun 12, 2017
Publication date	Oct 8, 2019
Grant date	Oct 8, 2019

Abstract

Provided is a method for securing network traffic flow in a multi-service containerized application, including: obtaining, with one or more processors, a composition record defining a multi-service containerized application; analyzing, with one or more processors, the composition record to look for one or both of network traffic patterns and network traffic flow; adding, with one or more processors, to the composition record a configured firewall container definition of a network traffic enforcement container that upon execution of the multi-service containerized application is communicatively coupled between a first container and a second container of the multi-service containerized application, wherein the first container and the second container are configured to communicate with each other across a first virtualized network; and converting, with one or more processors, the first virtualized network between the first container and the second container into a second virtualized network and a third virtualized network.

First claim

What is claimed is:

1. A method for securing network traffic flow in a multi-service containerized application, the method comprising:
obtaining, with one or more processors, a composition record defining a multi-service containerized application;
analyzing, with one or more processors, the composition record to look for one or both of network traffic patterns and network traffic flow;
adding, with one or more processors, to the composition record a configured firewall container definition of a network traffic enforcement container that upon execution of the multi-service containerized application is communicatively coupled between a first container and a second container of the multi-service containerized application, wherein the first container and the second container are configured to communicate with each other across a first virtualized network; and
converting, with one or more processors, the first virtualized network between the first container and the second container into a second virtualized network and a third virtualized network.

2. The method of claim 1 , wherein obtaining the composition record comprises sending instructions to a client computing device to create canvass elements that represent containers that are part of the application and how the containers are communicatively coupled with each other.

3. The method of claim 1 , wherein analyzing the composition record comprises determining a host name and port number of the second container.

4. The method of claim 3 , further comprising inferring a network traffic flow enforcement pattern from the host name and port number of the second container, wherein the network traffic flow enforcement pattern dictates that information can flow from the first container to the second container, and wherein the network traffic flow enforcement pattern dictates that information cannot flow from the second container to the first container.

5. The method of claim 1 , wherein the second virtualized network and the third virtualized network, upon execution of the multi-service containerized application, are communicatively coupled with the network traffic enforcement container.

6. The method of claim 1 , wherein the network traffic enforcement container acts as a proxy by passing on requests between the first container and the second container by transport-control protocol encapsulation or by modifying a transport or network layer protocol header recipient address in a network packet.

7. The method of claim 1 , wherein the network traffic enforcement container acts as a firewall between the first container and the second container by preventing the second container from accessing the first container.

8. The method of claim 1 , wherein the network traffic enforcement container determines whether to allow the passage of network traffic between the first container and the second container.

9. The method of claim 1 , wherein the network traffic enforcement container is configured to allow network traffic to flow from the first container to the second container.

10. The method of claim 1 , wherein the network traffic enforcement container is configured to prevent network traffic from flowing from the second container to the first container.

11. The method of claim 1 , further comprising inferring from dependency information collected from the composition record that the first container is configured to communicate with the second container at a given port associated with the second container.

12. The method of claim 1 , wherein the multi-service containerized application is a Linux multi-service containerized application.

13. The method of claim 12 , wherein the network traffic enforcement container has a Linux iptable configuration.

14. The method of claim 13 , wherein the Linux iptable configuration allows some network traffic flow and disallows other network traffic flow.

15. The method of claim 1 , wherein network traffic policies and direction of network traffic flow are enforced with no user input required.

16. The method of claim 1 , wherein securing network traffic flow comprises determining whether network traffic flow from a second container to a first container should be allowed or disallowed.

17. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more computers effectuate operations comprising:
obtaining, with one or more processors, a composition record defining a multi-service containerized application;
analyzing, with one or more processors, the composition record to look for one or both of network traffic patterns and network traffic flow;
adding, with one or more processors, to the composition record a configured firewall container definition of a network traffic enforcement container that upon execution of the multi-service containerized application is communicatively coupled between a first container and a second container of the multi-service containerized application, wherein the first container and the second container are configured to communicate with each other across a first virtualized network; and
converting, with one or more processors, the first virtualized network between the first container and the second container into a second virtualized network and a third virtualized network.

18. The medium of claim 17 , wherein defining the composition record comprises sending instructions to a client computing device to create canvass elements that represent containers that are part of the application and how the containers are communicatively coupled with each other.

19. The medium of claim 17 , wherein analyzing the composition record comprises determining a host name and port number of the second container.

20. A method for securing network traffic flow in a multi-service containerized application, the method comprising:
obtaining, with one or more processors, a composition record defining a multi-service containerized application;
analyzing, with one or more processors, the composition record to look for one or both of network traffic patterns and network traffic flow;
adding, with one or more processors, to the composition record a configured firewall container definition of a network traffic enforcement container that upon execution of the multi-service containerized application is communicatively coupled between a first container and a second container of the multi-service containerized application, wherein the first container and the second container are configured to communicate with each other across a first virtualized network; and
converting, with one or more processors, the first virtualized network between the first container and the second container into a second virtualized network and a third virtualized network, wherein obtaining the composition record comprises sending instructions to a client computing device to create canvass elements that represent containers that are part of the application and how the containers are communicatively coupled with each other, and wherein the second virtualized network and the third virtualized network, upon execution of the multi-service containerized application, are communicatively coupled with the network traffic enforcement container.

Assignees

• Ca Inc

Inventors

• Church Dann M
• Emeis Mark
• Joshi Prabodh
• Engquist James Douglas
• Hendrich Bob

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L43/062

  related to network traffic · CPC title