Systems and methods for automatically applying firewall policies within data center applications

Patent metadata

Field	Value
Publication number	US-9438560-B2
Application number	US-201414588146-A
Country	US
Kind code	B2
Filing date	Dec 31, 2014
Priority date	Dec 31, 2014
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

The disclosed method may include (1) identifying a data center application whose functionality is provided by a set of systems, (2) organizing, automatically by the computing device, the set of systems into one or more application model groups by, for each system in the set of systems, identifying an attribute of the system that is indicative of a security context under which the system should operate and assigning the system to an application model group for which the security context will be provided, and (3) for each application model group in the one or more application model groups, protecting the application model group by selecting a firewall configuration that will provide the security context for the application model group and by using the selected firewall configuration to protect the application model group. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for automatically applying firewall policies within data center applications, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a data center application whose functionality is provided by a set of systems;
organizing, automatically by the computing device, the set of systems into one or more application model groups that each comprise a group of applications with a same security context by, for each system in the set of systems:
identifying an attribute of the system within the set of systems that is indicative of a security context under which the system should operate;
assigning the system to an application model group for which the security context will be provided;

for each application model group in the one or more application model groups, protecting the application model group by:
selecting a firewall configuration that, when applied, will provide the security context for the application model group based at least in part on correlating metadata about the firewall configuration with the application model group;
using the selected firewall configuration to protect the application model group.

2. The computer-implemented method of claim 1 , wherein:
identifying the data center application comprises querying a data center platform to identify the set of systems that comprise the data center application;
identifying the attribute of the system comprises querying the data center application to determine at least one of:
an application tier that the system belongs to within the data center application;
a service running on the system;
an inbound dependency of the system;
an outbound dependency of the system.

3. The computer-implemented method of claim 2 , wherein organizing the systems into one or more application model groups comprises:
determining, based on application tiers, services, and dependencies of the set of systems of the data center application, at least one of:
how many application model groups the systems will be organized into;
the security contexts that should be provided for each of the application model groups.

4. The computer-implemented method of claim 1 , wherein:
selecting the firewall configuration comprises:
identifying a set of firewall configurations, wherein each firewall configuration within the set of firewall configurations comprises a different set of firewall policies;
choosing the firewall configuration that corresponds to the security context for the application model group;

using the selected firewall configuration to protect the application model group comprises:
configuring a firewall with the firewall configuration;
activating the firewall such that the firewall protects the application model group.

5. The computer-implemented method of claim 4 , wherein identifying the set of firewall configurations comprises:
identifying each application model group in which the systems of the data center application are organized;
creating a firewall configuration for each identified application model group by establishing a set of firewall policies that, when enforced, will provide the security context for each identified application model group.

6. The computer-implemented method of claim 4 , wherein
identifying a set of firewall configurations comprises identifying the metadata of each firewall configuration in the set of firewall configurations.

7. The computer-implemented method of claim 1 , wherein using the selected firewall configuration to protect the application model group comprises providing security micro-segmentation by enforcing one or more policies of the selected firewall configuration on communications between the application model group and at least one other application model group of the data center application.

8. The computer-implemented method of claim 1 , further comprising:
determining that a new system has been added to the data center application;
in response to determining that the new system has been added to the data center application:
identifying an attribute of the new system that is indicative of a security context under which the new system should operate;
assigning the system to an existing application model group for which the security context will be provided.

9. The computer-implemented method of claim 1 , wherein:
the system comprises a virtual machine;
the firewall configuration is implemented within a virtual firewall;
the data center application is implemented on a software-defined data center platform;
organizing the set of systems into the one or more application model groups comprises instructing the software-defined data center platform to use a data structure of the software-defined data center platform to divide the set of systems into the one or more application model groups.

10. A system for automatically applying firewall policies within data center applications, the system comprising:
at least one hardware memory;
an identification module, stored in the hardware memory, that identifies a data center application whose functionality is provided by a set of systems;
an organization module, stored in the hardware memory, that organizes, automatically by a computing device, the set of systems into one or more application model groups that each comprise a group of applications with a same security context by, for each system in the set of systems:
identifying an attribute of the system within the set of systems that is indicative of a security context under which the system should operate;
assigning the system to an application model group for which the security context will be provided;

a security module, stored in the hardware memory, that, for each application model group in the one or more application model groups, protects the application model group by:
selecting a firewall configuration that, when applied, will provide the security context for the application model group based at least in part on correlating metadata about the firewall configuration with the application model group;
using the selected firewall configuration to protect the application model group;

at least one physical processor configured to execute the identification module, the organization module, and the security module.

11. The system of claim 10 , wherein:
the identification module identifies the data center application by querying a data center platform to identify the set of systems that comprise the data center application;
the organization module identifies the attribute of the system by querying the data center application to determine at least one of:
an application tier that the system belongs to within the data center application;
a service running on the system;
an inbound dependency of the system;
an outbound dependency of the system.

12. The system of claim 11 , wherein the organization module organizes the systems into one or more application model groups by:
determining, based on application tiers, services, and dependencies of the set of systems of the data center application, at least one of:
how many application model groups the systems will be organized into;
the security contexts that should be provided for each of the application model groups.

13. The system of claim 10 , wherein:
the security module selects the firewall configuration by:
identifying a set of firewall configurations, wherein each firewall configuration within the set of firewall configurations comprises a different set of firewall policies;
choosing the firewall configuration that corr

Assignees

• Symantec Corp

Inventors

• Mohanty Shubhabrata
• Shirsat Amaresh

Classifications

• H04L63/02 Primary

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L41/0803

  Configuration setting · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title