Systems and methods for managing firewall rules and connections between different services

Patent metadata

Field	Value
Publication number	US-2025023846-A1
Application number	US-202418787943-A
Country	US
Kind code	A1
Filing date	Jul 29, 2024
Priority date	Feb 8, 2021
Publication date	Jan 16, 2025
Grant date	—

Abstract

A system for managing firewall rules between different services. In certain instances, the method includes receiving a discovery graph comprising a plurality of services and at least one application programming interface (API) dependency, wherein the plurality of services comprises a first service and a second service. In some instances, the method further includes determining whether the second service is permitted to receive an initial communication from the first service based upon the at least one API dependency included in the discovery graph. And, in response to determining the second service is permitted to receive the initial communication from the first service, the method can include establishing a first rule for a firewall between the first service and the second service, the first rule allowing the second service to receive the initial communication from the first service.

First claim

1 - 20 . (canceled)

21 . A computer-implemented method for managing firewall rules between different services, the method comprising:
determining whether a first service running on a first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of a second service running on a second VPC environment; in response to determining that the first service depends on the at least one application programming interface (API) of the second service, configuring one or more rules for a firewall between the first VPC environment and the second VPC environment to allow an initial communication from the first service to the second service; and establishing a virtual private connection between the first VPC environment and second VPC environment based on the one or more rules of the firewall.

22 . The computer-implemented method of claim 1 , wherein the first VPC environment is distinct from the second VPC environment.

23 . The computer-implemented method of claim 21 , wherein the initial communication is a one-way communication from the first service to the second service.

24 . The computer-implemented method of claim 21 , further comprising:
receiving a discovery graph comprising a plurality of services and one or more application programming interface (API) dependencies, wherein the plurality of services comprises the first service and the second service.

25 . The computer-implemented method of claim 24 , wherein the determining whether a first service running on a first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of a second service running on a second VPC environment comprises determining whether the first service running on the first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of the second service running on the second VPC environment based on the discovery graph.

26 . The computer-implemented method of claim 21 , further comprising:
in response to determining that the first service does not depend on any application programming interface (API) of the second service, configuring the one or more rules for the firewall to restrict the second service from receiving the initial communication from the first service.

27 . The computer-implemented method of claim 24 , further comprising dynamically updating the discovery graph in response to a change in the one or more API dependencies.

28 . The computer-implemented method of claim 27 , further comprising:
in response to determining that the second service is no longer permitted to receive the initial communication from the first service based upon the change in the one or more API dependencies, configuring the one or more rules for the firewall to restrict the second service from receiving the initial communication from the first service; and in response to determining that the second service is permitted to receive the initial communication from the first service based upon the change in the one or more API dependencies, configuring the one or more rules for the firewall to allow the second service to receive the initial communication from the first service.

29 . A computing system for managing firewall rules between different services, the computing system comprising:
one or more processors; and one or more memories storing instructions that, when executed by the one or more processors, causes the system to perform a set of operations, the set of operations comprising:
determining whether a first service running on a first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of a second service running on a second VPC environment;
in response to determining that the first service depends on the at least one application programming interface (API) of the second service, configuring one or more rules for a firewall between the first VPC environment and the second VPC environment to allow an initial communication from the first service to the second service; and
establishing a virtual private connection between the first VPC environment and second VPC environment based on the one or more rules of the firewall.

30 . The computing system of claim 29 , wherein the first VPC environment is distinct from the second VPC environment.

31 . The computing system of claim 29 , wherein the initial communication is a one-way communication from the first service to the second service.

32 . The computing system of claim 29 , wherein the set of operations further comprising:
receiving a discovery graph comprising a plurality of services and one or more application programming interface (API) dependencies, wherein the plurality of services comprises the first service and the second service.

33 . The computing system of claim 32 , wherein the determining whether a first service running on a first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of a second service running on a second VPC environment comprises determining whether the first service running on the first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of the second service running on the second VPC environment based on the discovery graph.

34 . The computing system of claim 29 , wherein the set of operations further comprising:
in response to determining that the first service does not depend on any application programming interface (API) of the second service, configuring the one or more rules for the firewall to restrict the second service from receiving the initial communication from the first service.

35 . The computing system of claim 32 , wherein the set of operations further comprising dynamically updating the discovery graph in response to a change in the one or more API dependencies.

36 . The computing system of claim 35 , wherein the set of operations further comprising:
in response to determining that the second service is no longer permitted to receive the initial communication from the first service based upon the change in the one or more API dependencies, configuring the one or more rules for the firewall to restrict the second service from receiving the initial communication from the first service; and in response to determining that the second service is permitted to receive the initial communication from the first service based upon the change in the one or more API dependencies, configuring the one or more rules for the firewall to allow the second service to receive the initial communication from the first service.

37 . A non-transitory computer-readable medium storing instructions for managing firewall rules between different services, the instructions when executed by one or more processors of a computing device, cause the computing device to perform operations comprising:
determining whether a first service running on a first virtual private cloud (VPC) environment depends on at least one application programming interface (API) of a second service running on a second VPC environment; in response to determining that the first service depends on the at least one application programming interface (API) of the second service, configuring one or more rules for a firewall between the first VPC environment and the second VPC environment to allow an initial communication from the first service to the second service; and establishing a virtual private connection between the first VPC environment and second

Assignees

• Palantir Technologies Inc

Inventors

• Hickman William
• Plattner Charissa
• Simons Kevin

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0263 Primary

  Rule management · CPC title