Policy enforcement with dynamic address object

Patent metadata

Field	Value
Publication number	US-8930529-B1
Application number	US-201113246472-A
Country	US
Kind code	B1
Filing date	Sep 27, 2011
Priority date	Sep 27, 2011
Publication date	Jan 6, 2015
Grant date	Jan 6, 2015

Abstract

Policy enforcement is disclosed. An identity notification is received from a network device. The identity notification is usable to determine a user identifier associated with the network device. The identity notification is also usable to determine an IP address associated with the network device. A policy is updated based on the received identity notification.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
receive a policy comprising an identifier associated with a network device;
receive a first identity notification from the network device;
store, in response to receiving the first identity notification, a mapping between the identifier associated with the network device and a first IP address determined based at least in part on the first identity notification;
implement the policy based at least in part on the stored mapping, including by using the first IP address to represent the network device;
receive a second identity notification from the network device;
determine, in response to receiving the second identity notification, that an IP address associated with the network device has changed to a second IP address;
update the stored mapping to a mapping between the identifier associated with the network device and the second IP address;
implement a revised version of the policy based at least in part on the updated mapping, including by using the second IP address to represent the network device; and
enforce the implemented revised version of the policy, including by allowing or denying one or more requests to access the network device; and
a memory coupled to the processor and configured to provide the processor with instructions;
wherein the network device comprises a virtual machine, and the second identity notification is received from the virtual machine in conjunction with a migration of the virtual machine.

2. The system of claim 1 wherein at least one of the first identity notification and the second identity notification is received from the network device in conjunction with an execution of a startup script by the network device machine.

3. The system of claim 1 wherein an identity notification is received from the network device periodically.

4. The system of claim 1 wherein at least one of the first identity notification and the second identity notification is received from the network device in response to a login event occurring on the network device.

5. The system of claim 1 wherein at least one of the first identity notification and the second identity notification explicitly includes a user identifier.

6. The system of claim 1 wherein at least one of the first identity notification and the second identity notification explicitly includes a current IP address associated with the network device.

7. The system of claim 1 wherein at least one of the first identity notification and the second identity notification includes a digital certificate usable to determine a user identifier.

8. The system of claim 1 wherein implementing the revised version of the policy includes retrieving the stored mapping between the identifier associated with the network device and the first IP address.

9. The system of claim 1 wherein implementing the revised version of the policy includes compiling a current IP address associated with the network device into a rule usable by a firewall.

10. The system of claim 1 wherein at least one of the first identity notification and the second identity notification is received by the system via an application programming interface.

11. The system of claim 1 wherein the network device is located at a hosting facility.

12. A method, comprising:
receiving a policy comprising an identifier associated with a network device;
receiving a first identity notification from the network device;
storing, in response to receiving the first identity notification, a mapping between the identifier associated with the network device and a first IP address determined based at least in part on the first identity notification;
implementing the policy based at least in part on the stored mapping, including by using the first IP address to represent the network device;
receiving a second identity notification from the network device;
determining, in response to receiving the second identity notification, that an IP address associated with the network device has changed to a second IP address;
updating the stored mapping to a mapping between the identifier associated with the network device and the second IP address;
implementing a revised version of the policy based at least in part on the updated mapping, including by using the second IP address to represent the network device; and
enforcing the implemented revised version of the policy, including by allowing or denying one or more requests to access the network device;
wherein the network device comprises a virtual machine, and the second identity notification is received from the virtual machine in conjunction with a migration of the virtual machine.

13. The method of claim 12 wherein at least one of the first identity notification and the second identity notification is received from the network device in response to a login event occurring on the network device.

14. A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
receiving a policy comprising an identifier associated with a network device;
receiving a first identity notification from the network device;
storing, in response to receiving the first identity notification, a mapping between the identifier associated with the network device and a first IP address determined based at least in part on the first identity notification;
implementing the policy based at least in part on the stored mapping, including by using the first IP address to represent the network device;
receiving a second identity notification from the network device;
determining, in response to receiving the second identity notification, that an IP address associated with the network device has changed to a second IP address;
updating the stored mapping to a mapping between the identifier associated with the network device and the second IP address;
implementing a revised version of the policy based at least in part on the updated mapping, including by using the second IP address to represent the network device; and
enforcing the implemented revised version of the policy, including by allowing or denying one or more requests to access the network device;
wherein the network device comprises a virtual machine, and the second identity notification is received from the virtual machine in conjunction with a migration of the virtual machine.

Assignees

• Wang Song
• Deng Suiqiang
• Xu Wilson
• Walter Martin
• Palo Alto Networks Inc

Inventors

• Wang Song
• Deng Suiqiang
• Xu Wilson
• Walter Martin

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L61/45

  Network directories; Name-to-address mapping · CPC title

• H04L61/5076

  Update or notification mechanisms, e.g. DynDNS · CPC title