Microservice integration fabrics network intrusion detection and prevention service capabilities

Patent metadata

Field	Value
Publication number	US-11057406-B2
Application number	US-201916601040-A
Country	US
Kind code	B2
Filing date	Oct 14, 2019
Priority date	Dec 21, 2017
Publication date	Jul 6, 2021
Grant date	Jul 6, 2021

Abstract

Aspects of the present invention provide an approach for providing network intrusion detection and prevention service (NIDPS) capabilities to a microservice in a networked computing environment. In an embodiment, a set of rules for accessing the microservice is retrieved. A NIDPS microservice is created within the environment of the microservice fabric that supports the microservice using the set of rules. The NIDPS microservice is established as a proxy communications destination for communications to the microservice such that communications that are intended for the microservice are instead rerouted to the NIDPS microservice. These communications are filtered by the NIDPS microservice according to the set of rules (e.g., to remove any communications that are determined to be threats).

First claim

What is claimed is:

1. A method for providing network intrusion detection and prevention service (NIDPS) capabilities to a microservice in a networked computing environment, comprising:
retrieving a set of rules that are specific to the microservice for accessing the microservice, the microservice being a single function service that contains programmatic and data elements essential for performing a single function, while non-essential elements are not present in the microservice;
creating a NIDPS microservice as a microservice within an environment of a microservice fabric that supports the microservice using the set of rules;
establishing the NIDPS microservice as a proxy communications destination for communication to the microservice such that the communications that are intended for the microservice are rerouted to the NIDPS microservice, the establishing further including: locating an entry point for the microservice stored in the microservice fabric;
replacing the entry point in the microservice fabric with a proxy location of the NIDPS microservice; and
setting a forwarding location of the NIDPS microservice to the entry point for the microservice; and
filtering the communications intended for the microservice by the NIDPS microservice according to the set of rules.

2. The method of claim 1 , the filtering further comprising:
discarding, by the NIDPS microservice, a communication that is determined to be a threat based on the set of rules; and
forwarding, by the NIDPS microservice, a communication that is determined not to be a threat based on the set of rules to the microservice.

3. The method of claim 1 , further comprising: establishing the NIDPS microservice as a proxy communications destination for communications to a second microservice in the microservice fabric, the second microservice operating separately from the microservice; and filtering a second set of communications intended for the second microservice by the NIDPS microservice according to the set of rules.

4. The method of claim 1 ,
wherein the microservice is one of a plurality of microservices in a microservice chain, and
wherein the NIDPS microservice provides NIDPS capabilities to all of the plurality of microservices in the microservice chain.

5. The method of claim 4 , further comprising:
inserting a second NIDPS microservice having a second set of rules between the microservice and a subsequent microservice in the microservice chain,
wherein the second NIDPS microservice filters communications between the microservice and the subsequent microservice using the second set of rules.

6. A computer system for providing network intrusion detection and prevention service (NIDPS) capabilities to a microservice in a networked computing environment, the computer system comprising: a memory medium comprising instructions; a bus coupled to the memory medium; and a processor coupled to the bus, execution of the instructions cause the system to:
retrieve a set of rules that are specific to the microservice for accessing the microservice the microservice being a single function service that contains programmatic and data elements essential for performing a single function, while non-essential elements are not present in the microservice;
create a NIDPS as a microservice within an environment of a microservice fabric that supports the microservice using the set of rules;
establish the NIDPS microservice as a proxy communications destination for communications to the microservice such that the communications that are intended for the microservice are rerouted to the NIDPS microservice, the instructions that cause the system to establish further causing the system to: locating an entry point for the microservice stored in the microservice fabric;
replacing the entry point in the microservice fabric with a proxy location of the NIDPS microservice; and
setting a forwarding location of the NIDPS microservice to the entry point for the microservice; and
filter the communications intended for the microservice by the NIDPS microservice according to the set of rules.

7. The system of claim 6 , the SDN, the instructions that cause the system to filter further causing the system to:
discard, by the NIDPS microservice, a communication that is determined to be a threat based on the set of rules; and
forward, by the NIDPS microservice, a communication that is determined not to be a threat based on the set of rules to the microservice.

8. The system of claim 6 , the instructions further causing the system to:
establish the NIDPS microservice as a proxy communications destination for communications to a second microservice in the microservice fabric, the second microservice operating separately from the microservice; and
filter a second set of communications intended for the second microservice by the NIDPS microservice according to the set of rules.

9. The system of claim 6 ,
wherein the microservice is one of a plurality of microservices in a microservice chain, and
wherein the NIDPS microservice provides NIDPS capabilities to all of the plurality of microservices in the microservice chain.

10. The system of claim 9 , the instructions further causing the system to:
insert a second NIDPS microservice having a second set of rules between the microservice and a subsequent microservice in the microservice chain,
wherein the second NIDPS microservice filters communications between the microservice and the subsequent microservice using the second set of rules.

11. A computer program product embodied in a non-transitory computer readable storage device that, when executed by a computer device, performs a method for providing network intrusion detection and prevention service (NIDPS) capabilities to a microservice in a networked computing environment comprising:
retrieving a set of rules that are specific to the microservice for accessing the microservice, the microservice being a single function service that contains programmatic and data elements essential for performing a single function, while non-essential elements are not present in the microservice;
creating a NIDPS as a microservice within a microservice fabric of the microservice using the set of rules;
establishing the NIDPS microservice as a proxy communications destination for communications to the microservice such that the communications that are intended for the microservice are rerouted to the NIDPS microservice, the establishing further including: locating an entry point for the microservice stored in the microservice fabric;
replacing the entry point in the microservice fabric with a proxy location of the NIDPS microservice; and setting a forwarding location of the NIDPS microservice to the entry point for the microservice; and
filtering the communications intended for the microservice by the NIDPS microservice according to the set of rules.

12. The program product of claim 11 , the filtering further comprising:
discarding, by the NIDPS microservice, a communication that is determined to be a threat based on the set of rules; and
forwarding, by the NIDPS microservice, a communication that is determined not to be a threat based on the set of rules to the microservice.

13. The program product of claim 11 , the method further comprising:
establishing the NIDPS microservice as a proxy communications destination for communications to a second microservice in the microservice fabric, the second microservice operating separately from the microservice; and
filtering a second set of communications intended for the second microservice by the NIDPS microservice according to the set of rules.

Assignees

• IBM

Inventors

• Jain Vinit
• Kairali Sudheesh S
• Kalangumvathakkal Vijay R
• Madhavan Pillai Madhuri

Classifications

• H04L43/20 Primary

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L67/563

  Data redirection of data network streams · CPC title

• H04L67/2871

  Implementation details of single intermediate entities · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L43/028

  by filtering · CPC title