Automated network security policy deployment in a dynamic environment

a dynamic environment and network security technology, applied in the computer field, can solve the problems of more memory consumption on the ips, difficult to enforce intrusion prevention system policies, and more difficult to achieve the task of enforcing network security policies for all vms

Inactive Publication Date: 2017-06-01
AIRBNB
View PDF0 Cites 5 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

Because of the dynamic nature of the environment, the task of enforcing network security policy for all VMs can be more difficult.
With such an environment it can be challenging to enforce intrusion prevention system policies.
The large policies lead to more memory consumption on the IPS and also introduce more computational overhead when processing network traffic.
Additionally the policy can become confusing for security administrators.
The extra-dynamic nature of SDN exposes all the assets, including physical assets and virtual assets to a rapidly changing network environment, which can make designing a comprehensive security policy challenging.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Automated network security policy deployment in a dynamic environment
  • Automated network security policy deployment in a dynamic environment
  • Automated network security policy deployment in a dynamic environment

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0018]A method, system and computer-usable medium are disclosed for performing a network flow security operation. In various embodiments, the network flow security operation is performed via a network flow controller. The network flow controller is based on a virtual network topology and flow information to initiate a process of loading and deploying policies on a policy enforcement point. In various embodiments, the network flow security operation further includes utilization of a mechanism in a policy enforcement point to dynamically load policies based on command and data sent from the network flow controller based on dynamic topology.

[0019]Because the network flow controller has knowledge of any networks associated with the controller, had knowledge of any endpoints operationally coupled to the networks and has knowledge of the policy that is appropriate to each endpoint, the network flow controller can apply policies in a dynamic environment that is optimal for the network conf...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

A method, system and computer-usable medium are disclosed for automatically deploying a network security policy based on virtual network topology in a dynamic software defined network (SDN) comprising: providing a flow control interface in a dynamic SDN wherein the flow control interface receives virtual network topology, operational endpoints, and policy to apply to the operational endpoints; responsive to receiving an SDN change indication, identifying changes to enforcement points for an SDN change corresponding to the SDN change indication; and, providing enforcement points affected by the SDN change with a policy reflecting the SDN change.

Description

BACKGROUND OF THE INVENTION[0001]Field of the Invention[0002]The present invention relates in general to the field of computers and similar technologies, and in particular to software utilized in this field. Still more particularly, it relates to a method, system and computer-usable medium for automated network security policy deployment in a dynamic environment.[0003]Description of the Related Art[0004]In many known networking environments having physical switches and servers, the security policy for any particular network security control element (e.g. firewalls, intrusion prevention) often remains relatively static. Because the network and applications remain relatively static and the policy depends on the network configuration and application workload, the changes to the security policy occur relatively infrequently. This allows security administrators to customize security policy for each security control element. For example, referring to FIG. 1, labeled Prior Art, certain kno...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & AuthorityApplications(United States)
IPC IPC(8): H04L29/06H04L12/825
CPCH04L47/25H04L63/20H04L47/00
InventorASHLEY, PAUL A.LEE, CHENG-TAWILLIAMS, RONALD B.
OwnerAIRBNB