Micro-firewalls in a microservice mesh environment

Patent metadata

Field	Value
Publication number	US-11323418-B2
Application number	US-202117464847-A
Country	US
Kind code	B2
Filing date	Sep 2, 2021
Priority date	Dec 4, 2018
Publication date	May 3, 2022
Grant date	May 3, 2022

Abstract

A server, in communication with a plurality of microservices in a microservices mesh environment, obtains data about inbound communications to a first microservice and outbound communications from the first microservice of the plurality of microservices. The server analyzes the data to learn an operational behavior of the first microservice and determine a firewall rule set to be applied associated with the first microservice based on the operational behavior learned for the first microservice. The server causes a micro-firewall to be instantiated for the first microservice. The micro-firewall is configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

First claim

What is claimed is:

1. A method comprising:
at a system in communication with a plurality of microservices communicating via a service mesh, receiving first data and metadata relating to inbound and outbound communications from a first microservice from the plurality of microservices;
analyzing, by the system, the first data and metadata to learn normal operational behavior of the first microservice, wherein analyzing includes determining a type of application component being provided by the first microservice;
determining a firewall rule set to be applied to the first microservice based on the normal operational behavior learned for the first microservice; and
causing, by the system, a micro-firewall to be instantiated for the first microservice, the micro-firewall configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

2. The method of claim 1 , wherein the inbound communications are from a second microservice to the first microservice.

3. The method of claim 1 , wherein the outbound communications are from the first microservice to a second microservice.

4. The method of claim 1 , wherein the inbound communications are from an entity outside the service mesh to the first microservice.

5. The method of claim 1 , wherein the outbound communications are from the first microservice to an entity outside the service mesh.

6. The method of claim 1 , wherein analyzing the first data and metadata to learn the normal operational behavior of the first microservice includes determining the firewall rule set according to rules associated with normal behavior of a microservice that includes the type of application component being provided by the first microservice.

7. The method of claim 1 , wherein analyzing the first data and metadata to learn the normal operational behavior of the first microservice includes applying a machine learning process to the first data and/or metadata.

8. The method of claim 1 , wherein the first data and metadata are received from a first sidecar process logically attached to the first microservice.

9. The method of claim 8 , wherein analyzing comprises comparing the first data and metadata obtained for the first microservice with stored information about microservices in order to find a match to a microservice with similar behavior.

10. The method of claim 8 , wherein causing the micro-firewall to be instantiated comprises instructing a mesh orchestrator that manages the plurality of microservices to instantiate the micro-firewall between the first microservice and a second microservice in communication with the first microservice.

11. The method of claim 10 , wherein causing the micro-firewall to be instantiated further comprises the mesh orchestrator programming the first sidecar process and a second sidecar process associated with the second microservice to redirect all traffic between them, on behalf of the first microservice and second microservice, respectively, to the micro-firewall.

12. The method of claim 1 , wherein the firewall rule set is a limited set of rules based on communications expected for the first microservice.

13. The method of claim 1 , wherein causing comprises causing micro-firewalls to be created and removed as microservice containers are dynamically created and removed.

14. The method of claim 13 , further comprising:
when a new microservice container is created that includes a microservice that is similar to the first microservice, causing comprises causing the micro-firewall to be instantiated for the new microservice container without performing the analyzing for the new microservice container.

15. The method of claim 1 , wherein determining a firewall rule set to be applied to the first microservice further comprises:
generating a security policy for the first microservice based upon analysis of the normal operational behavior of the first microservice; and
creating a firewall rule set that implements the generated security policy.

16. The method of claim 1 , wherein determining a firewall rule set to be applied to the first microservice further comprises:
learning an intent relating to one or more of the normal operational behaviors of the first microservice; and
creating a firewall ruleset that reflects the learned intent.

17. An apparatus comprising:
a communication interface configured to enable network communications including communications with a plurality of microservices communicating via a service mesh;
a memory storing program instructions; and
a processor coupled to the communication interface and to the memory, wherein the processor is configured to execute the program instructions to perform operations including:
receiving first data and metadata relating to inbound and outbound communications from a first microservice from the plurality of microservices;
analyzing the first data and metadata to learn normal operational behavior of the first microservice, wherein analyzing includes determining a type of application component being provided by the first microservice;
determining a firewall rule set to be applied to the first microservice based on the normal operational behavior learned for the first microservice; and
causing a micro-firewall to be instantiated for the first microservice, the micro-firewall configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

18. The apparatus of claim 17 , wherein the inbound communications are from a second microservice to the first microservice or from an entity outside the service mesh to the first microservice.

19. The apparatus of claim 17 , wherein the outbound communications are from the first microservice to a second microservice or from the first microservice to an entity outside the service mesh.

20. The apparatus of claim 17 , wherein the processor is configured to execute the program instructions to generate a firewall rule set according to rules associated with normal behavior of a microservice that includes the type of application component being provided by the first microservice.

21. The apparatus of claim 17 , wherein the processor is configured to execute the program instructions to receive information generated by a first sidecar process logically attached to the first microservice.

22. The apparatus of claim 17 , wherein the processor is configured to execute the program instructions to cause micro-firewalls to be created and removed as microservice containers are dynamically created and removed.

23. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor of a server in communication with a plurality of microservices communicating via a service mesh, cause the server to perform operations including:
receiving first data and metadata relating to inbound and outbound communications from a first microservice from the plurality of microservices;
analyzing the first data and metadata to learn normal operational behavior of the first microservice, wherein analyzing includes determining a type of application component being provided by the first microservice;
determining a firewall rule set to be applied to the first microservice based on the normal operational behavior learned for the first microservice; and
causing a micro-firewall to be instantiated for the first microservic

Assignees

• Cisco Tech Inc

Inventors

• Barton Robert Edgar
• Henry Jerome
• Falkner Matthias
• Seewald Maik Guenter

Classifications

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0218 Primary

  Distributed architectures, e.g. distributed firewalls · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L41/5041

  characterised by the time relationship between creation and deployment of a service · CPC title