Dynamic firewall configuration and control for accessing services hosted in virtual networks.

Abstract

Method for dynamic firewall configuration for accessing services (104) hosted in virtual networks (106), wherein the method comprises the following steps: Providing a firewall (108) to control traffic between clients in an enterprise network (102) that is on a protected side of the firewall (108) and services that are hosted in a virtual network (106) that is separate from the enterprise network (102) and is not on the protected side of the firewall (108); Monitor, in the virtual network (106), changes in an Internet Protocol (IP) address of a service (104) hosted in the virtual network (106); Detecting a change in the IP address of the service (104) hosted in the virtual network (106); Communicate a notification of the change in IP address to a firewall policy management interface (114); and Automatically configure the firewall (108) to allow traffic from the corporate network (102) to the service hosted in the virtual network (106) and to allow traffic from the service hosted in the virtual network (106) to the corporate network (102).

Description

[0001] The subject matter described herein relates to providing access to services hosted in virtual networks. More specifically, the subject matter described herein relates to dynamic firewall configuration and control for services hosted in virtual networks.

[0002] Network services are often hosted in virtual networks. For example, business organizations may move some or all of the services required to conduct their business to virtual networks, such as cloud networks, where the interfaces to the computing hardware are virtualized. Virtual network service providers maintain the underlying hardware and ensure the proper operation of hosted services running on that hardware. Part of ensuring the proper operation of hosted services may involve moving services between hardware platforms for load balancing, failover, or other operational reasons. Moving hosted services between hardware platforms can lead to accessibility issues, especially when accessing hosted services through firewalls.

[0003] Firewalls are used to monitor and control traffic entering and leaving networks. A challenge when accessing services hosted in a virtual network environment, especially when services move between platforms, is that the IP addresses of these services change. Firewalls controlling access to these hosted services must be configured to allow traffic to and from the hosted service. If a firewall is programmed to deny all traffic except that specifically authorized by a firewall rule, it must be configured to allow traffic from a client to the hosted service and from the hosted service to the client. If the IP address of the hosted service changes frequently, the firewall must be regularly reconfigured to permit such access.

[0004] Reconfiguring a firewall sometimes requires contacting an organization's IT department (IT = Information Technology), and an individual must configure the firewall to allow the desired traffic. Such manual configuration is labor-intensive and unsuitable for dynamically changing network environments where the IP address used to access a hosted service is volatile. Accordingly, there is a need for improved procedures and systems for firewall configuration and control when accessing services hosted in virtual networks.

[0005] US 2015 / 0082417A1 describes a method for automatically configuring a firewall in a virtual computer network environment, the method comprising: configuring firewall rules using virtual machine (VM) inventory objects; transforming the firewall rules by replacing the virtual machine inventory objects in the configured firewall rules with their associated Internet Protocol (IP) addresses, using an IP Address Management Table (IPAM table) and a Network Address Translation (NAT) table;and sending the converted firewall rules to a firewall engine to filter communication to and from virtual machines running on a first host computer system in one or more computer networks, as well as communication to and from virtual machines running on a second host computer system in one or more computer networks, at a firewall according to the converted firewall rules.

[0006] US 2012 / 0311693A1 describes a procedure comprising: receiving an update notification from a nameserver, wherein the update notification indicates a change to an address associated with a hostname of a host machine; a firewall server requesting an entry corresponding to the hostname specified in the update notification in response to receiving the update notification; receiving the contents of the entry in response to the request from the nameserver; and updating a firewall rule corresponding to the address specified in the update notification by the firewall server to include the contents of the entry.

[0007] US 2005 / 0138204A1 describes a computer network comprising a first edge device connected to a first private network, wherein the first edge device is configured to create a first table containing information about member networks reachable by the first edge device, the first table being stored in a first database; a second edge device connected to a second private network, wherein the second edge device is configured to create a second table containing information about member networks reachable by the second edge device, the second table being stored in a second database; wherein the first and second edge devices enable secure communication between the first and second private networks, and the first edge device shares the first table with the second edge device, and the second edge device shares the second table with the first edge device.

[0008] The object of the present invention is to create a method for dynamic firewall configuration and a system with improved characteristics.

[0009] The problem is solved by a method according to claim 1 and a system according to claim 10.

[0010] A method for dynamic firewall configuration to access services hosted in virtual networks includes deploying a firewall to control traffic between clients on a corporate network located on a protected side of the firewall and services hosted in a virtual network that is separate from the corporate network and not on the protected side of the firewall. The method further includes monitoring, within the virtual network, for changes in the Internet Protocol (IP) address of a service hosted in the virtual network. The method further includes detecting a change in the IP address of the service hosted in the virtual network. The method further includes communicating a notification of the IP address change to a firewall policy management interface.The procedure also includes automatically configuring a firewall to allow access from the corporate network to the service hosted in the virtual network and to allow traffic from the service hosted in the virtual network to the corporate network.

[0011] A system for dynamic firewall configuration for accessing services hosted in virtual networks includes a hosted service metadata collector for providing a firewall to control traffic between clients in a corporate network located on a protected side of the firewall and services hosted in a virtual network that is separate from the corporate network (102) and not on the protected side of the firewall (108), monitoring, in a virtual network, of changes in an Internet Protocol (IP) address of a service hosted in the virtual network, detecting a change in the IP address of the service hosted in the virtual network, and communicating a notification of the change in the IP address.The system also includes a firewall policy management interface for receiving notification of the IP address change and automatically configuring the firewall to allow traffic from the corporate network to the service hosted in the virtual network and to allow traffic from the service hosted in the virtual network to the corporate network.

[0012] According to one aspect of the subject matter described herein, the Hosted Service Metadata Collector gathers metadata for a plurality of different services hosted in the virtual network, the Hosted Service Metadata comprising mappings between Hosted Service Identifiers and network addresses associated with the hosted services.

[0013] According to another aspect of the subject matter described herein, a visibility agent associated with the hosted service automatically notifies the hosted service metadata collector of changes in the IP address of the hosted service.

[0014] According to another aspect of the subject matter described herein, the hosted service metadata collector is configured to monitor domain name system (DNS; DNS = domain name system) records for the service that is hosted in the virtual network.

[0015] According to another aspect of the subject matter described herein, the hosted service metadata collector is configured to monitor service logs of the virtual network.

[0016] According to another aspect of the subject matter described herein, the hosted service metadata collector is configured to communicate notification of the change in IP address in response to a subscription previously received by the firewall policy management interface.

[0017] According to another aspect of the subject matter described herein, the hosted service metadata collector is configured to notify the firewall policy management interface of any change in IP address without requiring prior communication from the firewall policy management interface.

[0018] According to another aspect of the subject matter described herein, the firewall policy management interface is configured to monitor session traffic associated with the hosted service and to automatically configure the firewall based on usage of the hosted service.

[0019] According to another aspect of the subject described herein, the virtual network includes a cloud network.

[0020] The dynamic firewall configuration device described herein for accessing services hosted in virtual networks may be implemented in hardware, software, firmware, or any combination thereof. Therefore, the terms "function" or "module," as used herein, refer to hardware, software, and / or firmware for implementing the described feature. In an exemplary implementation, the device described herein may be implemented using a computer-readable medium on which computer-executable instructions are stored. When executed by a computer's processor, these instructions control the computer to perform certain actions. Exemplary computer-readable media suitable for implementing the device described herein include non-volatile computer-readable media, such as...Disk storage devices, chip storage devices, programmable logic devices, and application-specific integrated circuits. Furthermore, a computer-readable medium implementing the subject matter described herein may be located on a single device or computing platform, or it may be distributed across multiple devices or computing platforms.

[0021] Preferred embodiments of the present invention are explained in more detail below with reference to the accompanying drawings. These show: Fig. 1 a network diagram representing a client accessing a service hosted in a virtual network; Fig. 2 a network diagram representing a client that is prevented from accessing a service hosted in a virtual network when the IP address of the service changes; Fig. 3. A network diagram representing a system for automatically configuring a firewall to allow access to a service hosted in a virtual network, where the firewall requests an initial IP address of a service and is automatically configured with the same; Fig. 4. A network diagram illustrating the automatic configuration of a firewall when the IP address assigned to a hosted service changes; Fig. 5 a diagram illustrating the automatic communication of hosted service IP addresses with a firewall without requiring the firewall to subscribe to receive notifications about changes in the IP addresses of a hosted service; Fig. 6 a table representing an exemplary firewall control rule that can be maintained by a firewall rule control and configuration system; and Fig. 7. A flowchart illustrating an exemplary process for automatic firewall configuration and control to access services hosted in virtual networks.

[0022] The subject matter described herein includes methods and systems for dynamic firewall configuration and control for accessing services hosted in virtual networks. Fig. Figure 1 provides an example of accessing services hosted in a virtual network through a firewall. Fig. A client 100, located on a corporate network 102, wants to access a service 104 hosted on a virtual network 106. The client 100 can be a user endpoint or another computing platform through which computing services are accessed. The corporate network 102 can be an organization's on-premises network or a virtual network, such as a public or private cloud network, where an organization runs all or some of its services. The virtual network 106 can be a separate on-premises network, a public cloud network, or a private cloud network that hosts at least some of the services accessed by the corporate network 102.

[0023] A firewall 108 controls access to and from the corporate network 102. The firewall 108 can be any device or collection of devices that monitors and controls traffic flow to or from a network. The term "firewall" is intended to encompass security groups that control access to cloud networks. An internet gateway 110 provides an interface between the virtual network 106 and the internet. A network address translator (NAT) 112 translates private IP addresses to public addresses and vice versa to protect private IP addresses in the virtual network 106.

[0024] In the example shown, NAT 112 offers the public IP address 20.20.20.20 for accessing the hosted service 104. The public IP address of the hosted service 104 can be propagated by Domain Name System (DNS) services, allowing access to the service using a hostname. Once a client 100 or the DNS servers in network 102 learn of the IP address of the hosted service 104, the network administrator of network 102 must manually configure firewall 108 to allow traffic to and from the public IP address 20.20.20.20. This configuration can be performed manually by an IT administrator adding a rule to the firewall to permit traffic to and from the IP address. Once a firewall 108 is configured to allow traffic, the client 100 can use the IP address 20.20.20.20 or a hostname that the DNS assigns to 20.20.20.20 translated, access the hosted service.

[0025] In Fig. 2. The IP address of the hosted service 104 changes to 20.20.20.30. Client 100 and / or the DNS servers in network 102 learn of the IP address change through normal DNS update propagation between DNS servers. However, firewall 108 may not be aware of this change. Consequently, client 100 attempts to send traffic to the hosted service 104 using the IP address 20.20.20.30, but the traffic is blocked by firewall 108 because firewall 108 is not configured to allow traffic to the new IP address for the hosted service 104. Similarly, the hosted service 104 may attempt to send traffic to client 100, but the traffic may be blocked by firewall 108 because firewall 108 is not configured to allow traffic from the new IP address for the hosted service 104.As soon as a change occurs in the IP address of a hosted service, firewall 108 must be manually reconfigured for all traffic to and from the new IP address. Such a manual and labor-intensive process is not suitable for accessing services hosted in virtual networks, where the IP address assigned to the service is volatile.

[0026] Fig. Figure 3 is a network diagram illustrating an automatic firewall configuration for accessing services hosted in a virtual network. Fig. 3. Firewall 108 includes an automatic firewall policy management interface 114 that requests or subscribes to a hosted service metadata collector 116, operating in the virtual network 106, to be informed about IP addresses used by a hosted service. It is clear that the enterprise network 102 can include a computing platform that has at least one processor on which the automatic firewall policy management interface 114 runs. The computing platform on which the automatic firewall policy management interface 114 runs can be the same platform on which firewall 108 runs, or a computing platform that is separate from the platform on which firewall 108 runs. It is also clear that the virtual network 106 can include a computing platform that has at least one processor on which the hosted service metadata collector 116 runs.

[0027] In the example shown, the automatic firewall policy management interface 114 transmits a message to the hosted service metadata collector 116 indicating that a client on network 102 needs access to a hosted service. The message can identify the hosted service by domain name or another suitable identifier. In one example, the message could be a subscription request by which the automatic firewall policy management interface 114 subscribes to receive the current IP address of a hosted service and to automatically receive updates when the IP address of the hosted service changes.

[0028] The Hosted Service Metadata Collector 116 responds with the IP address or addresses used by the hosted service. The Hosted Service Metadata Collector 116 can maintain a database 118 of the Hosted Service Metadata obtained from the virtual network 106. The Hosted Service Metadata can include service names or identifiers and IP addresses associated with each hosted service. The Hosted Service Metadata Collector 116 can obtain the Hosted Service Metadata from Visibility Agents 120 associated with each hosted service. In an alternative implementation, the Hosted Service Metadata Collector 116 can scan DNS records for the names and IP addresses of hosted services. In yet another example, the Hosted Service Metadata Collector 116 can obtain Hosted Service Metadata from service logs that are associated with virtual network 106.

[0029] Fig. 4 provides an example of the in Fig. Figure 3 shows the network where the IP address assigned to hosted service 104 changes. In the example shown, the IP address of hosted service 104 changes to 20.20.20.30. Because the automatic firewall policy management interface 114 previously subscribed to the hosted service metadata collector 116 to be notified of IP address changes for the hosted service, the hosted service metadata collector 116 automatically publishes new IP addresses used for the hosted service to subscribers, such as a firewall policy management interface 114.Thus, in one example, the Hosted Service Metadata Collector 116 can implement a publish-subscribe interface where interested firewalls, firewall configuration interfaces, or other entities subscribe to receive changes to IP addresses associated with a hosted service. The Hosted Service Metadata Collector 116 then publishes these changes to the IP address of the hosted services to authorized subscribers. Once the Automatic Firewall Policy Management Interface 114 receives the new IP address, it automatically configures the firewall 108 to allow traffic to and from the new IP address associated with the hosted service, thereby eliminating the need to block traffic to and from the hosted service and the need to manually reconfigure firewall rules whenever the IP address of a hosted service changes.

[0030] In Fig. 3 and Fig. 4. Firewall policy management interface 114 initiates the request to obtain IP address information associated with a hosted service. In an alternative implementation, client 100 can generate and send the subscription request to interface 114 to be notified of changes to the IP address of a hosted service. Alternatively, the hosted service metadata collector 116 can automatically notify firewall policy management interface 114 of changes to the IP address of a hosted service without requiring firewall 108 or firewall policy management interface 114 to send a subscription request. Fig. Section 5 provides an example where Firewall 108 and Firewall Policy Management Interface 114 do not need to initiate the request to be notified of changes to the IP address of a hosted service. Fig. In step 1, client 100 transmits a message to virtual network 106 indicating a request to access a service hosted on virtual network 106. Responding to this message, the hosted service metadata collector 116 subscribes to the firewall policy management interface 114 to automatically receive notifications of changes to the IP address of the hosted service identified in the message.

[0031] In an alternative implementation, the Hosted Service Metadata Collector 116 can be configured by the service provider of virtual network 106 to automatically notify certain parties of changes to the IP address of the hosted services. For example, if an end user places a hosted service in virtual network 106, the operator of virtual network 106 can configure the Hosted Service Metadata Collector 116 to notify a firewall policy management interface on the end user's network of changes to the IP address of the hosted service.Once the Hosted Service Metadata Collector 116 is configured or notified that address information related to the hosted service is required, it transmits a rule, or at least IP address information, to Firewall 108 in step 2 to automatically configure Firewall 108 to allow traffic to and from the hosted service. Upon receiving the address information, the automatic firewall policy management interface 114 automatically configures Firewall 108 to allow traffic to or from the hosted service associated with the IP address.

[0032] At step 3 in Fig. 5. The hosted service metadata collector 116 detects a change in the IP address associated with the hosted service from a visibility agent 120 associated with the hosted service 104. The visibility agent 120 can be configured to automatically notify the hosted service metadata collector 116 of changes to the IP address of the hosted service 104. In an alternative implementation, the hosted service metadata collector 116 can sample DNS records or service logs of the network 106 to detect changes to the IP address of the hosted service 104.Upon detecting the change in the IP address of the hosted service (104), the hosted service metadata collector (116) sends a message to the automatic firewall policy management interface (114) at step 104 to indicate new IP addresses associated with the hosted service and to block access to the old IP addresses. The automatic firewall policy management interface (114) then automatically configures the firewall (108) to allow access to the hosted service through the new IP address. The automatic firewall policy management interface (114) can also delete the firewall policy rule that allowed access to the hosted service through the previous IP address used by the hosted service.

[0033] According to another aspect of the subject matter described herein, the Hosted Service Metadata Collector 116 can maintain records associated with the hosted services and use data in the records to determine whether or not to trigger a change in a corresponding firewall rule. For example, the Hosted Service Metadata Collector 116 can monitor traffic volume associated with a session encompassing a hosted service, the time the firewall bottleneck was open, or another usage metric of a particular hosted service. The term "bottleneck" refers to a firewall rule that allows traffic to pass through the firewall when other traffic is blocked.In the context of hosted services, a firewall bottleneck is a rule that allows traffic to and from the IP address currently used by a hosted service, and to and from a specific client on the protected side of the firewall. If the traffic volume or the duration that a bottleneck is open exceeds a threshold, the hosted service metadata collector 116 can send a message to the automatic firewall policy management interface 114 to indicate that the firewall rule allowing access to the hosted service should be modified or deleted.

[0034] Fig. Figure 6 is a table that presents sample data that can be stored by the Hosted Service Metadata Collector 116 to monitor the usage of firewall bottlenecks and hosted services. In the example shown, a specific client, Client 1, has an IP address x and a port y. Client 1 accesses a hosted service at IP address z and port zz. The associated bottleneck in firewall 108 has a bottleneck duration of 2 minutes and 30 seconds, a maximum packet count of 10,000, and a maximum data quota of 1 gigabyte. The Hosted Service Metadata Collector 116 can monitor traffic associated with a hosted service to a specific client and compare the usage with the data in the rule table in Figure 6. Fig. 6 are stored, and instruct the firewall 108 to modify or change the firewall policy in response to the fact that a threshold has been exceeded.

[0035] Fig. Figure 7 is a flowchart illustrating an exemplary process for automatically configuring and controlling a firewall that provides access to a service hosted in a virtual network. With reference to Fig. Step 700 monitors a virtual network for changes to an IP address associated with the hosted service. For example, the Hosted Service Metadata Collector 116 can obtain information associated with changes to the IP address of a hosted service from the Visibility Agent 120, the DNS, or the service logs of the virtual network 106. Step 702 determines whether a change to the IP address of a hosted service is detected. If no change is detected, monitoring continues without sending firewall reconfiguration rules.

[0036] If a change in the IP address of a hosted service is detected at step 702, the control process proceeds to step 704, where the change is communicated to the address of a firewall configuration interface associated with a network that accesses or requests access to the service. For example, the Hosted Service Metadata Collector 116 can notify the Automatic Firewall Policy Management Interface 114 of the change in the IP address associated with a hosted service. As described above, the Automatic Firewall Policy Management Interface can subscribe to receive updates regarding IP addresses associated with hosted services.Alternatively, the Hosted Service Metadata Collector 116 can be configured to provide the IP address information without requiring the firewall 108 or its associated policy management interface to subscribe to receive the updates.

[0037] In step 706, the firewall is automatically configured to allow traffic to or from the hosted service. This step can be performed automatically by the automatic firewall policy management interface 114 when an IP address associated with a hosted service changes. Automatic firewall configuration can include adding a rule, modifying an existing rule, and / or deleting a rule when an IP address associated with a hosted service changes.

[0038] By providing visibility agents and a hosted service metadata collector to monitor changes in the IP address of hosted services and to automatically communicate notification of such changes to firewall policy management interfaces, the subject matter described herein improves computer networking and security technology by reducing the time and effort required to access a hosted service when its IP address changes.The need for manual firewall reconfiguration by the IT department in an organization is reduced by providing a firewall policy management interface that subscribes to receive notifications about changes to the IP address of a hosted service, automatically receives a notification about the changes to the IP address, and automatically reconfigures the firewall to allow traffic to and from the hosted service in response to receiving the notification about the change to the IP address.

[0039] It is clear that various details of the subject matter described herein may be modified without deviating from the scope of protection of the subject matter described herein. Furthermore, the above description serves only illustrative purposes and not limiting purposes, since the subject matter described herein is defined by the claims listed below.

Claims

[1] Method for dynamic firewall configuration for accessing services (104) hosted in virtual networks (106), the method comprising the following steps: Providing a firewall (108) to control traffic between clients in an enterprise network (102) that is on a protected side of the firewall (108) and services that are hosted in a virtual network (106) that is separate from the enterprise network (102) and is not on the protected side of the firewall (108); Monitor, in the virtual network (106), changes in an Internet Protocol (IP) address of a service (104) hosted in the virtual network (106); Detecting a change in the IP address of the service (104) hosted in the virtual network (106); Communicate a notification of the change in IP address to a firewall policy management interface (114); and Automatically configure the firewall (108) to allow traffic from the corporate network (102) to the service hosted in the virtual network (106) and to allow traffic from the service hosted in the virtual network (106) to the corporate network (102). [2] Method according to claim 1, wherein monitoring changes in the IP address of the service (104) hosted in the virtual network (106) comprises providing a hosted service metadata collector (116) that collects hosted service metadata for a plurality of different services (104) hosted in the virtual network (106). [3] Method according to claim 2, wherein the hosted service metadata comprises mappings between hosted service identifiers and network addresses associated with the hosted services (104). [4] Method according to any one of claims 1 to 3, wherein monitoring changes in the IP address of the service (104) hosted in the virtual network (106) comprises providing a visibility agent associated with the hosted service (104) which automatically notifies a hosted service metadata collector (116) of changes in the IP address of the hosted service (104). [5] Method according to any one of claims 1 to 4, wherein monitoring changes in the IP address of the service (104) hosted in the virtual network (106) comprises monitoring Domain Name System (DNS) records for the service (104) hosted in the virtual network (106). [6] Method according to any one of claims 1 to 5, wherein monitoring changes in the IP address of the service (104) hosted in the virtual network (106) includes monitoring service logs of the virtual network (106). [7] Method according to any one of claims 1 to 6, wherein communicating the notification of the change in IP address to the firewall policy management interface (114) comprises communicating the notification of the change in IP address in response to a subscription previously received by the firewall policy management interface (114). [8] Method according to any one of claims 1 to 7, wherein communicating the notification of the change in the IP address of the hosted service (104) comprises communicating a notification of the change in the IP address to the firewall policy management interface (114) without requiring prior communication from the firewall policy management interface (114). [9] Method according to any one of claims 1 to 8, comprising monitoring session traffic associated with the hosted service (104) and automatically configuring the firewall (108) based on usage of the hosted service (104). [10] System comprising a hosted service metadata collector (116) and a firewall policy management interface (114) for implementing the method according to any one of claims 1 to 9.

Images