Firewall configured with dynamic membership sets representing machine attributes

Patent metadata

Field	Value
Publication number	US-9621516-B2
Application number	US-49077309-A
Country	US
Kind code	B2
Filing date	Jun 24, 2009
Priority date	Jun 24, 2009
Publication date	Apr 11, 2017
Grant date	Apr 11, 2017

Abstract

A method is provided to control the flow of packets within a system that includes one or more computer networks comprising: policy rules are provided that set forth attribute dependent conditions for communications among machines on the one or more networks; machine attributes and corresponding machine identifiers are obtained for respective machines on the networks; and policy rules are transformed to firewall rules that include machine identifiers of machines having attributes from among the obtained machine attributes that satisfy the attribute dependent policy rules.

First claim

What is claimed is:

1. A method to control the flow of packets through a firewall that is implemented in a system that includes one or more computer networks comprising:
storing policy rules in machine readable storage media that set forth attribute dependent conditions for communications among machines on the one or more computer networks;
obtaining respective machine attributes and corresponding machine identifiers for respective machines on the one or more computer networks;
transforming the policy rules to firewall rules that include machine identifiers of machines having attributes from among the obtained machine attributes that satisfy the attribute dependent policy rules, wherein transforming the policy rules to firewall rules further includes:
matching an attribute condition within a policy rule with one or more obtained machine attributes;
generating at least one firewall rule for each machine identifier of a machine having all machine attributes required to satisfy the attribute condition within the policy rule;
resolving at least one set operation within the attribute condition to produce a resolved attribute condition; and
generating at least one firewall rule for each machine identifier of a machine having all attributes required to satisfy the resolved attribute condition within the policy rule;

storing the firewall rules in machine readable storage media; and
filtering communications from and to a first machine on the one or more computer networks and communications from and to a second machine on the one or more computer networks at the firewall according to the firewall rules.

2. The method of claim 1 further including:
identifying an occurrence of one or more updates to at least one of the networks;
wherein the act of obtaining machine attributes and corresponding machine identifiers is responsive to identification of an occurrence of one or more updates to the at least one of the networks.

3. The method of claim 2 , wherein at least one identified update includes a change in an attribute of a machine of the at least one of the networks.

4. The method of claim 3 , wherein the change in an attribute includes a change in an inventory of software running on a machine from the at least one of the networks.

5. The method of claim 3 , wherein the change in an attribute includes a change in physical location of a machine from the at least one of the networks.

6. The method of claim 3 , wherein the change in an attribute includes a change in a network property of a machine from the at least one of the networks.

7. The method of claim 2 , wherein at least one identified update includes an addition of a machine to the at least one of the networks.

8. The method of claim 2 , wherein at least one identified update includes a deletion of a machine from the at least one of the networks.

9. The method of claim 1 , further including:
receiving from a machine attribute update gathering tool an indication of an occurrence of one or more updates to at least one of the networks;
wherein the act of obtaining machine attributes and corresponding machine identifiers is responsive to receiving such indication of an occurrence of one or more updates to the at least one of the networks.

10. The method of claim 9 further including:
periodically sending an update inquiry to the machine attribute update gathering tool.

11. The method of claim 1 further including:
identifying an occurrence of one or more manual updates to membership of a set of machines;
wherein the act of obtaining machine attributes and corresponding machine identifiers is responsive to identification of an occurrence of one or more updates to the set of machines.

12. The method of claim 1 , wherein resolving the at least one set operation within the attribute condition to produce the resolved attribute condition further including:
resolving an intersection set operation within the attribute condition to a set of machines matching at least one attribute condition within the policy rule subject to the intersection set operation with one or more obtained machine attributes.

13. The method of claim 1 further including:
inspecting a packet en route within the system to identify a machine identifier associated with the packet;
searching for a match between the identified machine identifier and a machine identifier within a stored firewall rule; and
configuring a firewall engine to pass the packet or to deny passage of the packet based at least in part upon whether one or more stored firewall rules includes a machine identifier that matches the identified machine identifier within the packet.

14. The method of claim 1 , wherein the firewall is a central firewall that filters communications from and to all machines in one of the computer networks including the first machine and the second machine.

15. The method of claim 1 , wherein the first and second machines are virtual machines running in a host computer and the firewall is configured in the host computer to filter communications from and to virtual machines running in the host computer including the first machine and the second machine.

16. An article of manufacture including non-transitory computer readable storage media encoded with program code to cause a processor to execute a process to control the flow of packets through a firewall that is implemented in a system that includes one or more computer networks, said process comprising:
storing policy rules in machine readable storage media that set forth attribute dependent conditions for communications among machines on the one or more computer networks;
obtaining respective machine attributes and corresponding machine identifiers for respective machines on the one or more computer networks;
transforming the policy rules to firewall rules that include machine identifiers of machines having attributes from among the obtained machine attributes that satisfy the attribute dependent policy rules, wherein transforming the policy rules to firewall rules further includes:
matching an attribute condition within a policy rule with one or more obtained machine attributes;
generating at least one firewall rule for each machine identifier of a machine having all machine attributes required to satisfy the attribute condition within the policy rule;
resolving at least one set operation within the attribute condition to produce a resolved attribute condition; and
generating at least one firewall rule for each machine identifier of a machine having all attributes required to satisfy the resolved attribute condition within the policy rule;

storing the firewall rules in machine readable storage media; and
filtering communications from and to a first machine on the one or more computer networks and communications from and to a second machine on the one or more computer networks at the firewall according to the firewall rules.

17. The method of claim 16 , wherein the first and second machines are virtual machines running in a host computer and the firewall is configured in the host computer to filter communications from and to virtual machines running in the host computer including the first machine and the second machine.

18. The article of manufacture of claim 16 , wherein the first and second machines are virtual machines running in a host computer and the firewall is configured in the host computer to filter communications from and to virtual machines running in the host computer including the first machine and the second machine.

Assignees

• Basak Debashis
• Toshniwal Rohit
• Sequeira Allwyn
• Vmware Inc

Inventors

• Basak Debashis
• Toshniwal Rohit
• Sequeira Allwyn

Classifications

• H04L63/0218 Primary

  Distributed architectures, e.g. distributed firewalls · CPC title

• H04L63/0263 Primary

  Rule management · CPC title