Segmentation management including translation

Patent metadata

Field	Value
Publication number	US-2020007397-A1
Application number	US-201816144130-A
Country	US
Kind code	A1
Filing date	Sep 27, 2018
Priority date	Jun 29, 2018
Publication date	Jan 2, 2020
Grant date	—

Abstract

Systems, methods, and related technologies for segmentation management are described. The segmentation management may include visualization, configuration including translation, simulation, or a combination thereof of one or more segmentation policies. In certain aspects, a segmentation policy is accessed and a segmentation rule is determined based on the segmentation policy. An enforcement point associated with the segmentation rule may be determined, where the enforcement point is communicatively coupled to a network. The segmentation rule may be translated into a configuration associated with the enforcement point and the configuration communicated to the enforcement point.

First claim

What is claimed is:

1 . A method comprising:
accessing a segmentation policy; determining a segmentation rule based on the segmentation policy; determining an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network; translating the segmentation rule into a configuration associated with the enforcement point; and communicating the configuration to the enforcement point.

2 . The method of claim 1 further comprising:
storing network traffic, wherein the network traffic comprises a plurality of communications between a plurality of devices;
determining respective source and respective destinations of the communications of the network traffic;
determining the segmentation policy based the respective source and respective destinations of the communications; and
monitoring additional network traffic based on the segmentation policy.

3 . The method of claim 2 , further comprising:
determining a baseline of the network traffic over a period of time.

4 . The method of claim 1 , further comprising:
detecting the enforcement point being communicatively coupled to the network.

5 . The method of claim 1 , wherein the configuration associated with the enforcement point comprises at least one of an access control list (ACL), a firewall command, or rule or a cloud packet filtering ACL.

6 . The method of claim 1 , wherein the communicating the configuration to the enforcement point comprises using at least one of an application programming interface (API), command line interface (CLI), or a simple network management protocol (SNMP) interface.

7 . The method of claim 1 , wherein the enforcement point is at least one of a firewall, a router, a switch, a portion of cloud infrastructure, hypervisor, software-defined networking (SDN) controller, or virtual firewall.

8 . The method of claim 1 further comprising:
accessing configuration information from the enforcement point;
translating the configuration information of the enforcement point into a portion of a segmentation policy; and
storing the portion of the segmentation policy.

9 . The method of claim 1 , wherein the segmentation rule is based on a characteristic of an entity determined without the use of an agent.

10 . The method of claim 9 , wherein the characteristic of the entity is based on determining at least one of a classification of the entity or an identification of the entity.

11 . The method of claim 9 , wherein the characteristic of the entity is based on a source and a destination of a communication of the entity.

12 . The method of claim 1 , wherein the plurality of entities comprises at least one of a device, an endpoint, a virtual machine, a service, a serverless service, a container, or a user.

13 . A system comprising:
a memory; and a processing device, operatively coupled to the memory, to:
access a segmentation policy;
determine a segmentation rule based on the segmentation policy;
determine an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network;
translate the segmentation rule into a configuration associated with the enforcement point; and
communicate the configuration to the enforcement point.

14 . The system of claim 13 , wherein the processing device further to:
store network traffic, wherein the network traffic comprises a plurality of communications between a plurality of devices; determine respective source and respective destinations of the communications of the network traffic; determine the segmentation policy based the respective source and respective destinations of the communications; and monitor additional network traffic based on the segmentation policy.

15 . The system of claim 15 , wherein the configuration associated with the enforcement point comprises at least one of an access control list (ACL), a firewall command, or rule or a cloud packet filtering ACL.

16 . The system of claim 15 , wherein the processing device further to:
access configuration information of the enforcement point; translate the configuration information of the enforcement point into a portion of a segmentation policy; and store the portion of the segmentation policy.

17 . A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access a segmentation policy; determine, using the processing device, a segmentation rule based on the segmentation policy; determine an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network; translate the segmentation rule into a configuration associated with the enforcement point; and communicate the configuration to the enforcement point.

18 . The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the processing device to:
store network traffic, wherein the network traffic comprises a plurality of communications between a plurality of devices; determine respective source and respective destinations of the communications of the network traffic; determine the segmentation policy based the respective source and respective destinations of the communications; and monitor additional network traffic based on the segmentation policy.

19 . The non-transitory computer readable medium of claim 17 , wherein the configuration associated with the enforcement point comprises at least one of an access control list (ACL), a firewall command, or rule or a cloud packet filtering ACL.

20 . The non-transitory computer readable medium of claim 17 , wherein the instructions further cause the processing device to:
access a configuration of an enforcement point; translate the configuration of the enforcement point into a portion of a segmentation policy; and store the portion of the segmentation policy.

Assignees

• Forescout Tech Inc

Inventors

• Fainberg Ilya

Classifications

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L41/0226

  Mapping or translating multiple network management protocols · CPC title

• H04L43/18

  Protocol analysers · CPC title

• H04L63/104

  Grouping of entities · CPC title