Automated Enforcement of Security Policies in Cloud and Hybrid Infrastructure Environments

Patent metadata

Field	Value
Publication number	US-2020389502-A1
Application number	US-202016908681-A
Country	US
Kind code	A1
Filing date	Jun 22, 2020
Priority date	Jan 23, 2017
Publication date	Dec 10, 2020
Grant date	—

Abstract

To prevent un-authorized accesses to data and resources available in workloads on an organization's or enterprise's computer network, various improvements to automated computer network security processes to enable them to enforce network security policies using native network security mechanisms to control communications to and/or from workload units of applications running on different nodes within hybrid computer network infrastructures having both traditional hardware resources and virtual resources provided by private and public cloud infrastructure services.

First claim

1 . In a computer network comprised of plurality of interconnected computing nodes, each node running at least one work load unit of an application workload and at least one network security mechanism for controlling data flows to the interconnected computing nodes of the computer network, a computer implemented method for enforcing a plurality of security policies for the computer network using the network security mechanism, the method executing on or more computers in communication with the network and comprising:
for each of the at least one infrastructure resources,
assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider, each attribute comprising a key and value for the key using information; and
selecting the infrastructure source as a member of in one or more logical groups using the one or more attributes; and
computing a configuration for at least one network security mechanism using the plurality of security policies and the infrastructure resources that are members of each of the logical groups to which each the plurality of security policies applies.

2 - 27 . (canceled)

Assignees

• Fireeye Inc

Inventors

• Kung Lisun Joao
• Santos Jose Renato Goncalves
• Sikder Sarowar Golam

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title