Auto re-segmentation to assign new applications in a microsegmented network

Patent metadata

Field	Value
Publication number	US-2021314250-A1
Application number	US-202117350180-A
Country	US
Kind code	A1
Filing date	Jun 17, 2021
Priority date	Jun 11, 2019
Publication date	Oct 7, 2021
Grant date	—

Abstract

Systems and methods include, subsequent to performing auto segmentation on a network that includes a set of policies of allowable and block communications, observing communication between a plurality of hosts on the network; determining unassigned communication paths based on the observing that are either blocked because of a lack of a policy of the set of policies or because there is no policy of the set of policies for coverage thereof; and assigning the unassigned communication paths to corresponding policies of the set of policies. The assigning can be based on heuristics. The assigning can be performed without reperforming auto segmentation.

First claim

What is claimed is:

1 . A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming a computing system to perform steps of:
subsequent to performing auto segmentation on a network that includes a set of policies of allowable and block communications, observing communication between a plurality of hosts on the network; determining unassigned communication paths based on the observing that are either blocked because of a lack of a policy of the set of policies or because there is no policy of the set of policies for coverage thereof; and assigning the unassigned communication paths to corresponding policies of the set of policies.

2 . The non-transitory computer-readable storage medium of claim 1 , wherein the assigning is based on heuristics.

3 . The non-transitory computer-readable storage medium of claim 1 , wherein the assigning is performed without reperforming auto segmentation.

4 . The non-transitory computer-readable storage medium of claim 1 , wherein the assigning further includes
providing the unassigned communication paths to a user; and receiving input from the user for the assigning.

5 . The non-transitory computer-readable storage medium of claim 1 , wherein each of the communication paths is a flow in the network where the flow is communication between a first application and a second application.

6 . The non-transitory computer-readable storage medium of claim 1 , wherein the auto segmentation includes
obtaining network communication information about the plurality of hosts in the network and applications executed on the plurality of hosts; and automatically generating one or more microsegments in the network based on analysis of the obtained network communication information, wherein each microsegment of the one or more microsegments is a grouping of resources including the hosts and the applications executed on the hosts that have rules for network communication.

7 . The non-transitory computer-readable storage medium of claim 6 , wherein each of the communication paths is a flow in the network where the flow is communication between a first application and a second application, wherein the communication between the first application and the second application was not included in the network communication information.

8 . A method comprising the steps of:
subsequent to performing auto segmentation on a network that includes a set of policies of allowable and block communications, observing communication between a plurality of hosts on the network; determining unassigned communication paths based on the observing that are either blocked because of a lack of a policy of the set of policies or because there is no policy of the set of policies for coverage thereof; and assigning the unassigned communication paths to corresponding policies of the set of policies.

9 . The method of claim 8 , wherein the assigning is based on heuristics.

10 . The method of claim 8 , wherein the assigning is performed without reperforming auto segmentation.

11 . The method of claim 8 , wherein the assigning further includes
providing the unassigned communication paths to a user; and receiving input from the user for the assigning.

12 . The method of claim 8 , wherein each of the communication paths is a flow in the network where the flow is communication between a first application and a second application.

13 . The method of claim 8 , wherein the auto segmentation includes
obtaining network communication information about the plurality of hosts in the network and applications executed on the plurality of hosts; and automatically generating one or more microsegments in the network based on analysis of the obtained network communication information, wherein each microsegment of the one or more microsegments is a grouping of resources including the hosts and the applications executed on the hosts that have rules for network communication.

14 . The method of claim 13 , wherein each of the communication paths is a flow in the network where the flow is communication between a first application and a second application, wherein the communication between the first application and the second application was not included in the network communication information.

15 . A server comprising:
one or more processors and memory comprising instructions that, when executed, cause the one or more processors to
subsequent to performance of auto segmentation on a network that includes a set of policies of allowable and block communications, observe communication between a plurality of hosts on the network,
determine unassigned communication paths based on the observation that are either blocked because of a lack of a policy of the set of policies or because there is no policy of the set of policies for coverage thereof, and
assign the unassigned communication paths to corresponding policies of the set of policies.

16 . The server of claim 15 , wherein the unassigned communication paths are assigned based on heuristics.

17 . The server of claim 15 , wherein the unassigned communication paths are assigned without reperforming auto segmentation.

18 . The server of claim 15 , wherein the unassigned communication paths are assigned by
providing the unassigned communication paths to a user; and receiving input from the user for the assigning.

19 . The server of claim 15 wherein each of the communication paths is a flow in the network where the flow is communication between a first application and a second application.

20 . The server of claim 15 , wherein the auto segmentation includes
obtaining network communication information about the plurality of hosts in the network and applications executed on the plurality of hosts; and automatically generating one or more microsegments in the network based on analysis of the obtained network communication information, wherein each microsegment of the one or more microsegments is a grouping of resources including the hosts and the applications executed on the hosts that have rules for network communication.

Assignees

• Zscaler Inc

Inventors

• Laplante Scott
• Nahas Peter
• Li Xing
• Suresh Suji
• Perkins Daniel R
• Smith Peter

Classifications

• H04L45/02 Primary

  Topology update or discovery · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L47/82

  Miscellaneous aspects · CPC title