专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US11425139B2 Enforcing label-based rules on a per-user basis in a distributed network management system 有权
公开(公告)号：US11425139B2
公开(公告)日：2022-08-23
申请号：US16874411
申请日：2020-05-14
申请人： Illumio, Inc.
发明人： Anish V. Desai , Juraj G. Fandli , Matthew Glenn , Mukesh Gupta , Paul J. Kirner
IPC分类号： H04L29/06 , H04L9/40 , H04L67/53 , H04L67/51 , G06F21/62
摘要： State information is received from a server indicating an identity of a user logged into the server. An administrative domain wide policy is determined that specifies a relationship between user a group and services or servers accessible to users belonging to the user group. Relevant servers are sent updated management instructions corresponding to rules of the administrative domain wide policy. Such rules provide access to a service or server to users belonging to user groups related to the service. As a result, the servers allow communications that provide access to users based on the specified relationships.

2. 发明授权

US11356483B2 Protecting network-based services using deception in a segmented network environment 有权
公开(公告)号：US11356483B2
公开(公告)日：2022-06-07
申请号：US16683127
申请日：2019-11-13
申请人： Illumio, Inc.
发明人： Rupesh Kumar Mishra , Paul James Kirner , Rushabh Sanghvi
IPC分类号： H04L9/40 , H04L43/062
摘要： A policy management server manages a segmentation policy for segmenting a network and a deception policy for implementing deception services. The policy management server distributes segmentation rules and deception rules to distributed enforcement modules that configure respective traffic filters to enforce the policies. The deception rule may be enforced directly by the traffic filter acting as a deception service, or the traffic filter may act as a proxy to an external deception service. The deception service can behave similarly to a real service to obtain information about the malicious actor that is reported to the policy management server to enable the policy management server to take a remedial action. Furthermore, the policy management server may automatically generate the deception policy based on the segmentation policy such that connection requests that are not allowed by the segmentation policy are automatically sent to a deception service.

3. 发明申请

US20210226865A1 LABEL-BASED RULES FOR SQUELCHING VISIBLE TRAFFIC IN A SEGMENTED NETWORK ENVIRONMENT 有权
公开(公告)号：US20210226865A1
公开(公告)日：2021-07-22
申请号：US16748735
申请日：2020-01-21
申请人： Illumio, Inc.
发明人： Mukesh Gupta , Joy Anne Scott , Juraj George Fandli , Joel E. Vanderkwaak , Ramnath Duggirala
IPC分类号： H04L12/26
摘要： In a segmented network environment, a traffic flow graph provides visibility into the connections between workloads or groups of workloads under management of a segmentation policy. Squelching rules may be applied to hide traffic in the traffic flow graph that meets specified criteria. The squelching rules may be label-based rules that enable configuration of squelching rules that apply to group of workloads and enable configurations to be rapidly updated as workloads or added or dropped from the network or as their configurations change. Additionally, squelching rules may be applied based on characteristics of the traffic data or based on an identity of an administrator viewing the traffic flow graph.

4. 发明申请

US20210144181A1 PROTECTING NETWORK-BASED SERVICES USING DECEPTION IN A SEGMENTED NETWORK ENVIRONMENT 有权
公开(公告)号：US20210144181A1
公开(公告)日：2021-05-13
申请号：US16683127
申请日：2019-11-13
申请人： Illumio, Inc.
发明人： Rupesh Kumar Mishra , Paul James Kirner , Rushabh Sanghvi
IPC分类号： H04L29/06 , H04L12/26
摘要： A policy management server manages a segmentation policy for segmenting a network and a deception policy for implementing deception services. The policy management server distributes segmentation rules and deception rules to distributed enforcement modules that configure respective traffic filters to enforce the policies. The deception rule may be enforced directly by the traffic filter acting as a deception service, or the traffic filter may act as a proxy to an external deception service. The deception service can behave similarly to a real service to obtain information about the malicious actor that is reported to the policy management server to enable the policy management server to take a remedial action. Furthermore, the policy management server may automatically generate the deception policy based on the segmentation policy such that connection requests that are not allowed by the segmentation policy are automatically sent to a deception service.

5. 发明授权

US10917309B2 Distributed network management using a logical multi-dimensional label-based policy model 有权
公开(公告)号：US10917309B2
公开(公告)日：2021-02-09
申请号：US15597127
申请日：2017-05-16
申请人： Illumio, Inc.
发明人： Paul J. Kirner , Daniel R. Cook , Juraj G. Fandli , Matthew K. Glenn , Mukesh Gupta , Andrew S. Rubin , Jerry B. Scott , Sehyo Chang , Alan B. Stokol
IPC分类号： H04L12/24 , H04L29/06 , H04L12/801 , H04L12/815 , H04L12/715 , G06F9/50 , G06Q10/06 , H04L29/08 , G06F11/36 , G06Q30/02
摘要： Management instructions for a particular managed server within an administrative domain are generated according to an administrative domain-wide management policy that comprises a set of one or more rules. The administrative domain includes a plurality of managed servers. A determination is made regarding which rules within the set of rules are relevant to the particular managed server. Function-level instructions are generated based on the rules that were determined to be relevant. A determination is made regarding which managed servers within the plurality of managed servers are relevant to the particular managed server. The function-level instructions and information regarding the managed servers that were determined to be relevant are sent to the particular managed server. The particular managed server uses the function-level instructions and information regarding the managed servers to configure a management module so that the configured management module implements the administrative domain-wide management policy.

6. 发明授权

US10785115B2 Allocating enforcement of a segmentation policy between host and network devices 有权
公开(公告)号：US10785115B2
公开(公告)日：2020-09-22
申请号：US16172630
申请日：2018-10-26
申请人： Illumio, Inc.
发明人： Rupesh Kumar Mishra , Paul James Kirner , Matthew Kirby Glenn
IPC分类号： G06F15/173 , H04L12/24 , H04L29/06 , H04L12/917 , H04L12/911 , H04L12/927
摘要： A segmentation server configures enforcement of a segmentation policy by allocating enforcement of management instructions between network devices and hosts. The segmentation policy comprises rules that control communications between workloads. For a particular workload, the segmentation server generates management instructions for controlling communications to and from the particular workload in accordance with the rules. The segmentation server determines an allocation of management instructions between enforcement on a host on which the particular workload executes and enforcement on a network device upstream from the workload. The segmentation server sends configuration information to at least one of the host and the network device in accordance with the allocation to enable enforcement of the management instructions.

7. 发明授权

US10701090B2 Distributed network security using a logical multi-dimensional label-based policy model 有权
公开(公告)号：US10701090B2
公开(公告)日：2020-06-30
申请号：US15841542
申请日：2017-12-14
申请人： Illumio, Inc.
发明人： Paul J. Kirner , Daniel R. Cook , Juraj G. Fandli , Matthew K. Glenn , Mukesh Gupta , Andrew S. Rubin , Jerry B. Scott , Thukalan V. Verghese
IPC分类号： H04L29/06 , H04L12/24 , H04L29/12
摘要： A managed server (MS) within an administrative domain is quarantined. The administrative domain includes multiple MSs that use management instructions to configure management modules so that the configured management modules implement an administrative domain-wide management policy that comprises a set of one or more rules. The quarantined MS is isolated from other MSs. A description of the MS is modified to indicate that the MS is quarantined, thereby specifying a description of the quarantined MS. Cached actor-sets are updated to indicate the quarantined MS's changed state, thereby specifying updated actor-sets. A determination is made regarding which updated actor-sets are relevant to an other MS, thereby specifying currently-relevant updated actor-sets. A determination is made regarding whether the currently-relevant updated actor-sets differ from actor-sets previously sent to the other MS. Responsive to determining that the currently-relevant updated actor-sets are identical to the previously-sent actor-sets, no further action is taken.

8. 发明授权

US10476745B1 Infrastructure-agnostic network-level visibility and policy enforcement for containers 有权
公开(公告)号：US10476745B1
公开(公告)日：2019-11-12
申请号：US15995080
申请日：2018-05-31
申请人： Illumio, Inc.
发明人： Thomas Michael McCormick , Daniel Richard Cook , Rupesh Kumar Mishra , Matthew Kirby Glenn , Paul James Kirner , Mukesh Gupta , Juraj George Fandli
IPC分类号： H04L12/24 , H04L29/06 , H04L12/26 , H04L29/08
摘要： An enforcement mechanism on an operating system instance enforces a segmentation policy on a container. A configuration generation module executing in a host namespace of the operating system instance receives management instructions from a segmentation server for enforcing the segmentation policy on a container. The configuration generation module executes in the host namespace to configure a traffic control and monitoring module in a container namespace associated with the container. The traffic control and monitoring module in the container namespace controls and monitors communications to and from the container in accordance with its configuration. By executing a configuration generation module in the host namespace to configure traffic control and monitoring module in the container namespace, the enforcement mechanism beneficially enables robust and lightweight enforcement in a manner that is agnostic to different containerization protocols.

9. 发明授权

US09485279B2 Automated generation of access control rules for use in a distributed network management system that uses a label-based policy model 有权
标题翻译：自动生成访问控制规则，用于使用基于标签的策略模型的分布式网络管理系统
公开(公告)号：US09485279B2
公开(公告)日：2016-11-01
申请号：US14528879
申请日：2014-10-30
申请人： Illumio, Inc.
发明人： Paul J. Kirner , Matthew K. Glenn , Mukesh Gupta , Roy N. Nakashima , Thukalan V. Verghese
IPC分类号： H04L29/06
CPC分类号： H04L63/20 , H04L63/10 , H04L63/104
摘要： An access control rule authorizing communication between a plurality of managed servers within an administrative domain is determined. Communication information describing past communication between the plurality of managed servers is obtained. A subset of managed servers from the plurality of managed servers is identified by grouping the plurality of managed servers based on the obtained communication information. A group-level label set is determined to associate with the subset of managed servers. Role labels are determined for managed servers in the subset of managed servers. A managed server is associated with one role label. Based on the group-level label set and the role labels, an access control rule is generated authorizing communication between a first managed server of the subset of managed servers and a second managed server. The access control rule is stored as part of an administrative domain-wide management policy.
摘要翻译：确定授权管理域内的多个被管理服务器之间的通信的访问控制规则。获得描述多个被管理服务器之间的过去通信的通信信息。通过基于所获得的通信信息对多个被管理服务器进行分组来识别来自多个被管理服务器的被管理服务器的子集。确定组级标签集与受管服务器的子集相关联。为受管服务器子集中的受管服务器确定角色标签。受管服务器与一个角色标签相关联。基于组级标签集和角色标签，生成访问控制规则，授权受管理服务器子集的第一受管服务器和第二受管服务器之间的通信。访问控制规则作为管理域范围的管理策略的一部分存储。

10. 发明申请

US20220255899A1 ENFORCING A SEGMENTATION POLICY IN CO-EXISTENCE WITH A SYSTEM FIREWALL 有权
公开(公告)号：US20220255899A1
公开(公告)日：2022-08-11
申请号：US17730062
申请日：2022-04-26
申请人： Illumio, Inc.
发明人： Daniel Richard Cook , Anish Vinodkumar Desai , Thomas Michael McCormick
IPC分类号： H04L9/40 , G06F9/38 , H04L41/0803 , H04L43/04 , G06F9/448
摘要： A segmentation firewall executing on a host enforces a segmentation policy. In a co-existence mode, the segmentation firewall operates in co-existence with a system firewall that enforces a security policy. The segmentation firewall is configured to either drop packets that do not match any permissive rule or pass packets that match a permissive rule to the system firewall to enable the system firewall to determine whether to drop or accept the passed packets. To enable efficient operation of the segmentation firewall when operating in co-existence with the system firewall, the segmentation firewall may include a plurality of rule chains and may be configured to exit a chain and bypass remaining rule chains upon an input packet matching a permissive rule of the segmentation policy.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式