Microsegmentation for serverless computing

Patent metadata

Field	Value
Publication number	US-11792194-B2
Application number	US-202017124693-A
Country	US
Kind code	B2
Filing date	Dec 17, 2020
Priority date	Dec 17, 2020
Publication date	Oct 17, 2023
Grant date	Oct 17, 2023

Abstract

Systems and methods include obtaining a set of policies to in the serverless computing system, wherein the set of policies specify which applications are authorized for communication with the serverless computing system; and modifying rules in a network Access Control List (ACL) associated with the serverless computing system based on the set of policies, wherein the network ACL includes rules that specify allowing and blocking communication. The serverless computing system includes having underlying hardware abstracted therefrom. The network ACL is provided by a cloud provider that hosts the serverless computing system.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming a serverless computing system to perform steps of:
obtaining a set of policies in the serverless computing system, wherein the set of policies specify which applications are authorized for communication with the serverless computing system;
modifying rules in a network Access Control List (ACL) associated with the serverless computing system based on the set of policies, wherein the network ACL includes rules that specify allowing and blocking communication and operations with the applications;
obtaining updated network communication information based on monitoring in a microsegmentation system, wherein the microsegmentation system is a part of a Zero Trust Network Access (ZTNA) framework;
providing an update for the set of policies based on the updated network communication information; and
updating the rules in the network ACL based on the update.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the network ACL is obtained from a cloud provider that hosts the serverless computing system.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the set of policies include authorized applications that are on a same network as the serverless computing system and applications that are deemed authorized based on monitoring by the microsegmentation system.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the set of policies include a plurality of applications on associated systems that are monitored by the microsegmentation system.

5. The non-transitory computer-readable storage medium of claim 1 , wherein the rules include whether to allow or deny specified traffic based on any of a type of traffic, traffic protocol, ports, traffic source, and traffic destination.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the set of policies are determined by the microsegmentation system that monitors communication associated with the applications to generate a network communication model based thereon.

7. A method comprising steps of:
obtaining a set of policies in the serverless computing system, wherein the set of policies specify which applications are authorized for communication with the serverless computing system;
modifying rules in a network Access Control List (ACL) associated with the serverless computing system based on the set of policies, wherein the network ACL includes rules that specify allowing and blocking communication and operations with the applications;
obtaining updated network communication information based on monitoring in a microsegmentation system, wherein the microsegmentation system is a part of a Zero Trust Network Access (ZTNA) framework;
providing an update for the set of policies based on the updated network communication information; and
updating the rules in the network ACL based on the update.

8. The method of claim 7 , wherein the network ACL is obtained from a cloud provider that hosts the serverless computing system.

9. The method of claim 7 , wherein the set of policies include authorized applications that are on a same network as the serverless computing system and applications that are deemed authorized based on monitoring by the microsegmentation system.

10. The method of claim 7 , wherein the set of policies include a plurality of applications on associated systems that are monitored by the microsegmentation system.

11. The method of claim 7 , wherein the rules include whether to allow or deny specified traffic based on any of a type of traffic, traffic protocol, ports, traffic source, and traffic destination.

12. The method of claim 7 , wherein the set of policies are determined by the microsegmentation system that monitors communication associated with the applications to generate a network communication model based thereon.

13. A cloud-based system comprising:
a plurality of nodes interconnected to one another and collectively configured to operate a serverless computing system, wherein the plurality of nodes comprise memory and one or more processors, and wherein one or more nodes of the plurality of nodes are configured to:
obtain a set of policies in the serverless computing system, wherein the set of policies specify which applications are authorized for communication with the serverless computing system,
modify rules in a network Access Control List (ACL) associated with the serverless computing system based on the set of policies, wherein the network ACL includes rules that specify allowing and blocking communication and operations with the applications,
obtain updated network communication information based on monitoring in a microsegmentation system, wherein the microsegmentation system is a part of a Zero Trust Network Access (ZTNA) framework,
provide an update for the set of policies based on the updated network communication information, and
update the rules in the network ACL based on the update.

14. The cloud-based system of claim 13 , wherein the set of policies include authorized applications that are on a same network as the serverless computing system and applications that are deemed authorized based on monitoring by the microsegmentation system.

15. The cloud-based system of claim 13 , wherein the rules include whether to allow or deny specified traffic based on any of a type of traffic, traffic protocol, ports, traffic source, and traffic destination.

Assignees

• Zscaler Inc

Inventors

• Smith Peter

Classifications

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title