Agent-less micro-segmentation of a network

Patent metadata

Field	Value
Publication number	US-10652213-B2
Application number	US-201715845605-A
Country	US
Kind code	B2
Filing date	Dec 18, 2017
Priority date	Dec 18, 2017
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

The technology disclosed herein enables the micro-segmentation of a network without agents. In a particular embodiment, a method provides, in a packet-handler controller of a virtual computing environment, determining one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment. The method further provides converting the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment. Also, the method provides distributing the one or more policies in the second format to at least one of the one or more computing systems.

First claim

What is claimed is:

1. A method for agent-less micro-segmentation of a network, the method comprising:
in a packet-handler controller of a virtual computing environment, determining one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment;
implementing the one or more policies in the first format within the virtual computing environment by transferring the one or more policies to one or more packet handlers in the virtual computing environment that enforce the one or more policies in the first format;
converting the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment; and
distributing the one or more policies in the second format to at least one of the one or more computing systems that enforce the one or more policies in the second format.

2. The method of claim 1 , wherein distributing the one or more policies in the second format comprises:
transferring the one or more policies in the second format to a domain controller server for the domain controller, wherein the domain controller server transfers the one or more policies to the at least one of the one or more computing systems.

3. The method of claim 2 , wherein transferring the one or more policies in the second format to the domain controller server comprises:
creating a secure Transmission Control Protocol (TCP) connection between the packet-handler controller and the domain controller server; and
pushing the one or more policies in the second format to the domain controller server over the secure TCP connection.

4. The method of claim 2 , wherein transferring the one or more policies in the second format to the domain controller server comprises:
converting the one or more policies in the second format to a template of the second format; and
copying the template to a folder that is accessible by the domain controller server, wherein the domain controller server monitors the folder for the template.

5. The method of claim 2 , further comprising:
in the packet-handler controller, receiving feedback information from the domain controller server about the at least one of the one or more computing systems handling of network packets based on the one or more policies in the second format.

6. The method of claim 1 , further comprising:
discovering the one or more computing systems in a network domain of the domain controller.

7. The method of claim 6 , wherein discovering the one or more computing systems comprises:
querying a domain controller server for the domain controller to identify the one or more computing systems as having joined the network domain of the domain controller.

8. The method of claim 1 , further comprising:
discovering a plurality of applications executing within the virtual computing environment.

9. The method of claim 8 , wherein determining the one or more policies comprises:
defining the one or more policies based on the plurality of applications.

10. The method of claim 1 , wherein the domain controller comprises Active Directory and the second format comprises one or more Group Policy Objects.

11. An apparatus, having physical computing resources, implementing a packet-handler controller of a virtual computing environment for agent-less micro-segmentation of a network, the apparatus comprising:
one or more computer readable storage media of the physical computing resources;
a processing system of the physical computing resources operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
determine one or more policies in a first format that identify one or more packet characteristics and how packets with the one or more packet characteristics should be handled within the virtual computing environment;
implement the one or more policies in the first format within the virtual computing environment by transferring the one or more policies to one or more packet handlers in the virtual computing environment that enforce the one or more policies in the first format;
convert the one or more policies from the first format to a second format used by a domain controller for one or more computing systems outside of the virtual computing environment; and
distribute the one or more policies in the second format to at least one of the one or more computing systems that enforce the one or more policies in the second format.

12. The apparatus of claim 11 , wherein to distribute the one or more policies in the second format, the program instructions direct the processing system to:
transfer the one or more policies in the second format to a domain controller server for the domain controller, wherein the domain controller server transfers the one or more policies to the at least one of the one or more computing systems.

13. The apparatus of claim 12 , wherein to transfer the one or more policies in the second format to the domain controller server, the program instructions direct the processing system to:
create a secure Transmission Control Protocol (TCP) connection between the packet-handler controller and the domain controller server; and
push the one or more policies in the second format to the domain controller server over the secure TCP connection.

14. The apparatus of claim 12 , wherein to transfer the one or more policies in the second format to the domain controller server, the program instructions direct the processing system to:
convert the one or more policies in the second format to a template of the second format; and
copy the template to a folder that is accessible by the domain controller server, wherein the domain controller server monitors the folder for the template.

15. The apparatus of claim 12 , wherein the program instructions further direct the processing system to:
receive feedback information from the domain controller server about the at least one of the one or more computing systems handling of network packets based on the one or more policies in the second format.

16. The apparatus of claim 11 , wherein the program instructions further direct the processing system to:
discover the one or more computing systems in a network domain of the domain controller.

17. The apparatus of claim 16 , wherein to discover the one or more computing systems, the program instructions direct the processing system to:
query a domain controller server for the domain controller to identify the one or more computing systems as having joined the network domain of the domain controller.

18. The apparatus of claim 11 , wherein the program instructions further direct the processing system to:
discover a plurality of applications executing within the virtual computing environment.

19. The apparatus of claim 18 , wherein to determine the one or more policies, the program instructions direct the processing system to:
define the one or more policies based on the plurality of applications.

20. The apparatus of claim 11 , wherein the domain controller comprises Active Directory and the second format comprises one or more Group Policy Objects.

Assignees

• Nicira Inc

Inventors

• Chanda Arijit
• Chen Lifeng
• Myneni Sirisha
• Poon Arnold Koon-Chee

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L47/20

  Traffic policing · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title