Security agent for distributed network security system

Patent metadata

Field	Value
Publication number	US-9930010-B2
Application number	US-201514811425-A
Country	US
Kind code	B2
Filing date	Jul 28, 2015
Priority date	Apr 6, 2015
Publication date	Mar 27, 2018
Grant date	Mar 27, 2018

Abstract

Some embodiments of the invention provide a method that performs security operations for packets that are processed by a forwarding element. The method of some embodiments receives, at a security agent operating on a physical machine, a packet from a forwarding element that also operates on the physical machine. The method then determines whether a security rule is stored for the packet at the security agent. When no security rule is stored for the packet, the method transmits the packet to a default security controller of several security controllers that store security rules for a network and process packets according to the stored security rules. When the security rule is stored for the packet, the method processes the packet according to the stored security rule for the packet.

First claim

We claim:

1. A method for performing security operations for packets processed by a forwarding element, the method comprising:
at a security agent operating on a physical machine, determining whether the security agent stores any security rule for a packet that is for processing by the forwarding element that also operates on the physical machine;
when the security agent does not store any security rule for the packet, applying a default rule to the packet that specifies a default security controller to which to transmit the packet, wherein the default security controller is one of a plurality of security controllers that store security rules for a network and process packets according to the stored security rules; and
when the security agent stores a security rule for the packet, processing the packet according to the stored security rule for the packet.

2. The method of claim 1 , wherein the physical machine is a host machine on which a plurality of data compute nodes reside, wherein the packet is destined for one of the data compute nodes.

3. The method of claim 1 , wherein the physical machine is a host machine on which a plurality of data compute nodes reside, wherein the packet is transmitted from one of the data compute nodes.

4. The method of claim 1 , wherein the physical machine operates in a datacenter comprising a plurality of physical machines on each of which a security agent and a forwarding element operate.

5. The method of claim 4 , wherein the physical machine is a first physical machine, the security agent is a first security agent, the packet is a first packet, and the default rule is a first default rule, wherein a second security agent operating on a second physical machine transmits a second packet to the default security controller based on application of a second default rule when the second security agent does not store any security rule for the second packet.

6. The method of claim 4 , wherein the physical machine is a first physical machine, the security agent is a first security agent, the packet is a first packet, the default rule is a first default rule, and the default security controller is a first security controller, wherein when a second security agent of a second host machine does not store any security rule for a second packet, the second security agent applies a second default rule to the second packet that specifies a second security controller of the plurality of security controllers as a default security controller to which to transmit the second packet.

7. The method of claim 1 , wherein processing the packet according to the stored security rule comprises transmitting the packet to a particular security controller specified by the stored security rule for the packet for deep-packet inspection processing.

8. The method of claim 7 , wherein the particular security controller specified by the stored security rule is different than the default security controller.

9. The method of claim 1 , wherein determining whether the security agent stores any security rule for the packet comprises:
extracting identification information from a set of packet headers of the packet; and
matching the extracted identification information against a rules table stored in a local data storage of the physical machine.

10. The method of claim 9 , wherein the rules table comprises a plurality of rules, each rule comprising (i) a set of packet identification fields and (ii) security processing instructions, wherein the extracted identification information is matched against the sets of packet identification fields for the plurality of rules.

11. The method of claim 1 further comprising:
transmitting the packet to the default security controller;
receiving a new security rule from the default security controller; and
storing the new security rule at the security agent.

12. The method of claim 11 , wherein after the default security controller processes the packet, the packet is received from the default security controller at the forwarding element for further processing.

13. A non-transitory machine readable medium of a host machine storing a security agent for performing security operations for packets processed by a forwarding element of the host machine, the security agent comprising sets of instructions for:
determining whether the security agent stores any security rule for a packet that is for processing by the forwarding element of the host machine;
when the security agent does not store any security rule for the packet, applying a default rule to the packet that specifies a default security controller to which to transmit the packet, wherein the default security controller is one of a plurality of security controllers that store security rules for a network and process packets according to the stored security rules; and
when the security agent stores a security rule for the packet, processing the packet according to the stored security rule for the packet.

14. The non-transitory machine readable medium of claim 13 , wherein the default security controller is a first controller, wherein when the default security controller does not store any security rule for the packet, the default security controller transmits the packet to a second controller in the plurality of security controllers that the default security controller determines is a security controller that stores a security rule for the packet.

15. The non-transitory machine readable medium of claim 14 , wherein when the second security controller does not store any security rule for the packet, the second security controller sends a message to the security agent indicating that no rule was found for the packet.

16. The non-transitory machine readable medium of claim 13 , wherein the security rule stored by the security agent specifies to perform at least one of dropping the packet, allowing the packet, blocking the packet, and transmitting the packet to a particular security controller of the plurality of security controllers for deep-packet inspection.

17. The non-transitory machine readable medium of claim 16 , wherein the deep packet inspection comprises inspecting the packet for viruses by a third-party anti-virus application.

18. The non-transitory machine readable medium of claim 13 , wherein the host machine operates in a datacenter comprising a plurality of host machines on each of which a security agent and a forwarding element operate.

19. The non-transitory machine readable medium of claim 18 , wherein the host machine is a first host machine, the security agent is a first security agent, the packet is a first packet, and the default rule is a first default rule, wherein a second security agent operating on a second host machine transmits a second packet to the default security controller based on application of a second default rule when the second security agent does not store any security rule for the second packet.

20. The non-transitory machine readable medium of claim 18 , wherein the host machine is a first host machine, the security agent is a first security agent, the packet is a first packet, the default rule is a first default rule, and the default security controller is a first security controller, wherein when a second security agent of a second host machine does not store any security rule for a second packet, the second security agent applies a second default rule to the second packet that specifies a second security controller of the plurality of security controllers as a default security controller to which to t

Assignees

• Nicira Inc

Inventors

• Sun Keyong
• Wang Yonggang
• Guo Frank
• Li Liang
• Chen Zikang

Classifications

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title