Dynamically Scalable Application Firewall Deployment for Cloud-Native Applications

Abstract

The configuration of a cloud application exposed through a public IP address is replicated with modifications to include a private IP address to expose the application internally. The original configuration is updated so that external network traffic sent to the application is redirected to and distributed among agents running on nodes of a cloud cluster where a web application firewall (WAF) is implemented. The set of agents that each WAF should inspect the redirected network traffic is selected based on cluster metrics, such as network and resource utilization metrics. The redirected network traffic targets ports allocated to the application-specific agents, where ports are allocated per application, and thus each agent can support WAF protection for multiple applications. Network traffic allowed through by the WAF is directed from the agent to the application via its private IP address.

Description

[Technical Field]

[0001] FIELD OF THE DISCLOSURE This disclosure relates generally to electrical digital data processing and security arrangements for protecting a computer, its components, programs, or data against unauthorized activity. [Background technology]

[0002] Attacks that target application layer processes are called application layer attacks. To protect applications against application layer attacks, the application and its application programming interfaces (APIs) can be secured through the deployment of an application firewall, or in the case of web applications, a web application firewall (WAF). For web applications running in a cloud environment, a cloud-based WAF can be deployed to protect against application layer attacks. Cloud applications differ from traditional software applications in that the applications are hosted in the cloud rather than locally and are accessible over the internet. Due to the growing trend toward cloud computing, applications are typically developed to be cloud-native or designed to run in a cloud environment. Cloud-native applications, which can include loosely coupled services / microservices, are containerized applications designed to run and be deployed to nodes in a cloud cluster managed by a container orchestration platform.

[0003] Container orchestration platforms generally provide functionality that facilitates the exposure of cloud applications either externally (i.e., accessible to entities outside the cluster) or internally (i.e., accessible to entities within the cluster). For example, a cloud application can be exposed externally through the allocation of a public Internet Protocol (IP) address by a cloud provider to a group of one or more containers of the cloud application. Network traffic originating from entities outside the cluster is then routed to the cloud application via the public IP address and load balanced across the cloud application's containers by a load balancer external to the cluster (e.g., a load balancer controlled by the cloud provider). If public exposure is not desired, the cloud application can be made accessible to entities within the cluster through the allocation of a private IP address to a group of one or more containers of the cloud application. Load balancing of network traffic originating from within the cluster can then be managed by the container orchestration platform itself. [Brief explanation of the drawings]

[0004] The disclosed embodiments may be better understood with reference to the accompanying drawings. [Figure 1] 1 illustrates an exemplary conceptual diagram of a dynamically scalable deployment of a WAF to secure applications running in a cloud environment. [Figure 2] 1 illustrates an exemplary conceptual diagram for dynamically scaling available deployed WAF instances to secure a cloud application based on observed conditions within the cluster on which the cloud application runs. [Figure 3]1 illustrates a flowchart of an example operation for performing a scalable WAF deployment for a cloud application running on a cluster. [Figure 4] 1 illustrates a flowchart of an example operation for dynamically scaling WAF instances available for inspecting network traffic for a cloud application across cluster nodes. [Figure 5] 1 illustrates a flowchart of an example operation for dynamically scaling WAF instances available for inspecting network traffic for a cloud application across cluster nodes. [Figure 6] 1 illustrates a flowchart of an example operation for dynamically deploying and scaling available WAF instances to secure cloud applications. [Figure 7] 1 illustrates a flowchart of an example operation for dynamically deploying a WAF to secure applications running on one or more nodes of a cluster in a cloud. [Figure 8] 1 illustrates a flowchart of an example operation for dynamically deploying and scaling WAF instances that specify applications for WAF protection. [Figure 9] 1 illustrates an exemplary computer system with a WAF deployment manager. DETAILED DESCRIPTION OF THE INVENTION

[0005] The following description includes example systems, methods, techniques, and program flows that embody aspects of the disclosure. However, it will be understood that the disclosure may be practiced without these specific details. For example, the disclosure references Transmission Control Protocol (TCP) ports in illustrative examples. Aspects of the disclosure may instead be applied to ports used for other transport layer protocols, such as User Datagram Protocol (UDP) ports. In other instances, well-known instruction instances, protocols, structures, and techniques have not been shown in detail so as not to obscure the description.

[0006] overview

[0007] We have developed an approach to dynamically deploy and scale a WAF across the nodes of a cloud cluster with minimal impact to the underlying infrastructure on which the containers of a cloud-native application (hereinafter, "cloud application" or "application") run. The scaling of active WAF instances for inspecting traffic directed to an application is automated based on observed conditions within the cluster, eliminating the need for customers to manually manage the scaling or distribution of WAF instances to effectively secure their applications. Using the solution described herein, a WAF is implemented and instantiated via an agent, where the agent runs on each node of the cloud cluster. By dynamically labeling each agent container to indicate the applications whose intercepted network traffic the WAF deployed via the agent should inspect based on observed conditions, such as network traffic volume and node resource utilization, the number of WAF instances available for each application can be dynamically scaled up or down to match the conditions of the cluster.

[0008] After detecting an externally exposed application, a replica configuration of the application is generated, modified to include a private IP address for accessing the application rather than a public IP address, so that the application is exposed internally within the cluster. The original configuration in which the application is exposed externally is updated so that network traffic sent to the application from an external source is redirected to agents running on nodes of the cluster and distributed across the agents. The agents to which network traffic will be redirected are selected, and a label designating the application can be added based on measured network traffic directed to the application and / or resource utilization across available nodes of the cloud cluster. For example, a higher load may prompt the selection and corresponding labeling of all available agents, so that network traffic can be distributed across nodes without overwhelming available resources, while a subset of agents may be selected and labeled if the application is experiencing lower traffic. Unique ports are allocated to the agents on which they can receive redirected network traffic from the application, where ports are allocated per application, so that the agents can distinguish between network traffic corresponding to different applications based on the combination of port number and label assigned to the agent. Network traffic that the WAF allows through can then be directed to the application from within the cluster via a private IP address that exposes the application internally but not externally.Dynamically scaling WAF instances contributes to resource utilization savings within a cluster because the number of available WAF instances to which network traffic destined for an application can be routed is correlated with the application load and resource utilization of the node on which the application runs. Resource utilization savings are further achieved as a result of utilizing one agent to provide WAF protection for multiple applications running on a node through allocation of ports and labels specific to different applications, as opposed to deploying additional agents for additional applications.

[0009] Illustrative Description

[0010] FIG. 1 illustrates an exemplary conceptual diagram of a dynamically scalable deployment of a WAF to secure applications running in a cloud environment. Two replicas of application 101 and application 103 are each deployed to cloud 108 and run on cluster 115. Applications 101 and 103 may be cloud-native applications. As used herein, "cloud-native application" and "cloud application" refer to containerized applications running in the cloud. Cloud 108 may be a public cloud, a private cloud, or a private cloud provided by a cloud service provider. Cluster 115 includes worker node 105A and worker node 105B. Worker nodes 105A and 105B may be physical or virtual machines that provide resources (e.g., container runtimes) for running containerized applications on cloud 108. A load balancer 116 external to cluster 115 distributes traffic among worker nodes 105A and 105B. The load balancer 116 may be an external load balancer controlled by a cloud service provider.

[0011] Cluster 115 further includes master node 125. Master node 125 includes components (e.g., control plane components) that manage the deployment and scheduling of applications 101 and 103, as well as the configuration of worker nodes 105A and 105B. Master node 125 also maintains a repository 126 of data for cluster 115, such as configuration files that specify the configuration of the deployment of applications 101 and 103 (e.g., number of replicas). WAF deployment manager 109 runs on master node 125. WAF deployment manager 109 manages the deployment and scaling of WAF instances within cluster 115, where WAFs are deployed via application security agents ("agents") running on each of worker nodes 105A and 105B. Specifically, agent 107A runs on worker node 105A, and agent 107B runs on worker node 105B. The agents 107A, 107B can communicate with the master node 125 via a container orchestration platform API 127 exposed by the master node 125 to the worker nodes 105A, 105B.

[0012] In this example, agents 107A and 107B are deployed as containerized applications to each of worker nodes 105A and 105B. Instances of applications 101 and 103 and agents 107A and 107B are packaged in their respective containers. On worker node 105A, applications 101 and 103 and agent 107A are packaged in containers 104A, 104B, and 104C, respectively. On worker node 105B, applications 101 and 103 and agent 107B are packaged in containers 104D, 104E, and 104F, respectively. Each of containers 104A-F contains program code for applications 101, 103, or agents 107A and 107B, libraries used by applications 101, 103, or agents 107A and 107B, and the like. The container orchestration platform manages the container orchestration of the containers 104A to 104I in which the applications 101 and 103 and the agents 107A and 107B are deployed.

[0013] WAF 131A is instantiated via agent 107A, and WAF 131B is instantiated via agent 107B. WAFs 131A, 131B may be implemented as part of the functionality of each of agents 107A, 107B (e.g., as a process running as part of each of agents 107A, 107B). WAFs 131A, 131B may inspect network traffic redirected from applications running in cluster 115 based on a WAF configuration 120 attached to (i.e., installed on or otherwise accessible to) agent 107A, 107B for each application to be secured. WAF configuration 120 indicates the applications that WAF 131A, 131B can secure and the corresponding rules or policies against which intercepted network traffic will be evaluated. Thus, each of WAFs 131A, 131B can support protection of multiple applications by determining the application to which network traffic is directed and selecting a corresponding set of rules or policies maintained within WAF configuration 120 to apply to inspect the network traffic.

[0014] 1 is annotated with a series of letters A-D. These letters represent stages of operation. While these stages are ordered for purposes of this example, these stages illustrate one example that is helpful in understanding the disclosure and should not be used to limit the scope of the claims. Subject matter within the scope of the claims may vary with respect to the order and portion of operations.

[0015] In phase A, based on detecting that application 101 is externally exposed, WAF deployment manager 109 generates modified configuration 111 for application 101 to expose application 101 internally within cluster 115. An externally exposed application is an application that receives network traffic directly from an external entity, such as based on a load balancer 116 that directs traffic to the application. Configuration 113 of the deployed instance of application 101 specifies that the type of application 101 is “external,” includes a public IP address through which application 101 can be accessed, and indicates that application 101 receives network traffic from the external entity. Configuration 113 further indicates that the received network traffic should be routed to a container labeled “appID_101,” which corresponds to containers 104A and 104D. WAF deployment manager 109 can detect that application 101 is externally exposed by identifying application 101 as running in cluster 115 and analyzing the type field, IP address field, etc. of configuration 113. WAF deployment manager 109 can retrieve configuration 113 for analysis from repository 126 maintained for cluster 115. WAF deployment manager 109 then generates modified configuration 111 by replicating configuration 113, but replacing the public IP address indicated in the address field with the private IP address allocated to application 101 to expose application 101 internally. As a result, application 101 is exposed both externally as specified by configuration 113 and internally as specified by modified configuration 111.

[0016] In Phase B, WAF deployment manager 109 configures entities in cluster 115 to redirect network traffic destined for application 101 to agents 107A, 107B. The network traffic is redirected to and distributed (e.g., internally load balanced) across agents 107A, 107B for inspection by respective ones of WAFs 131A, 131B. The operations occurring in Phase B are described, for clarity, as including two sub-phases: Phase B1 and Phase B2. However, the order of the sub-phases and / or the operations performed therein may vary between implementations.

[0017] In stage B1, the WAF deployment manager 109 allocates port 123 to the agents 107A, 107B to which traffic of the application 101 is delivered. The WAF deployment manager 109 allocates a port (e.g., a TCP port), shown as port number 30031 in FIG. 1 , to the agents 107A, 107B. The port 123 may be allocated to the IP addresses of the containers 104C, 104F corresponding to the agents 107A, 107B. The WAF deployment manager 109 allocates port 123 to the agents 107A, 107B such that the port number is specific to the application 101; i.e., the WAF deployment manager 109 allocates ports on a per-application basis, thereby enabling the agents 107A, 107B to identify the application to which data received on the port is intended.

[0018] In stage B2, WAF deployment manager 109 modifies configuration 113 to generate modified configuration 114 for externally exposed application 101, such that traffic destined for application 101 is redirected to agents 107A, 107B and targets port 123. WAF deployment manager 109 generates update 121 to configuration 113, which replaces the label and port associated with application 101's container with the label and port 123 assigned to the agent container. In modified configuration 114 resulting from the update, the label "appID_101" and targeted port associated with application 101 are replaced with the name of the label assigned to the agent container to which application 101's traffic is redirected, shown as "agent_app101," and port 123 as the target port. As a result of generating a modified configuration 114 that indicates port 123 and label corresponding to the deployed agent's container rather than application 101's container, load balanced traffic originating from outside cluster 115 with a destination address of application 101 is redirected to and distributed across (e.g., internally load balanced) a container with label "agent_app101" and target TCP port 30031.

[0019] In phase C, the WAF deployment manager 109 determines a set of one or more agents to which application 101's traffic should be redirected for WAF inspection and assigns labels to the corresponding containers that match the labels listed in the modified configuration 114. The WAF deployment manager 109 can determine the set of agents based on a WAF deployment policy ("policy") 106 to deploy and scale the WAFs that should be available for the applications running on the cluster 115. By labeling the containers that correspond to the agents on which the WAFs are implemented based on the policy 106, the WAF deployment manager 109 can scale the number of active WAF instances available to the application based on various criteria, such as node resource usage metrics, network metrics, etc. In this example, the policy 106 indicates that in the initial WAF deployment for the application, each of the agent containers should be labeled with a label corresponding to the application. Because the WAF deployment for application 101 is an initial deployment, the WAF deployment manager 109 assigns labels 119A and 119B to the respective containers 104C and 104F. The WAF deployment manager 109 can assign labels 119A, 119B by updating the configuration 133 of the agents 107A, 107B (e.g., by adding or updating the label field in the configuration file for the agents 107A, 107B) to indicate the label of the agent's container or containers 104C, 104F, respectively.

[0020] In stage D, WAF deployment manager 109 updates configuration 133 of agents 107A, 107B so that traffic received on port 123 and allowed to pass through the respective one of WAFs 131A, 131B is directed to application 101 via the private IP address indicated in modified configuration 111. In the update, configuration 133 indicates that data received by agent 107A, 107B on TCP port 30031 or port 123 should then be directed to the container labeled "appID_101" or container 104A, 104D via their private IP address. Two configurations have been generated for application 101, the first of which exposes application 101 externally and specifies that external traffic should be redirected to agents 107A, 107B, and the second of which exposes application 101 internally (i.e., modified configuration 114 and modified configuration 111, respectively), so that WAFs 131A, 131B act as "man-in-the-middle" deployed between the external exposure of application 101 and the internal exposure of application 101.

[0021] The modified configuration 114 for exposing application 101 externally indicates that traffic received from load balancer 116 should be directed to a container labeled "agent_app101." Because containers 104C and 104F have been labeled accordingly, traffic sent from entities outside cluster 115 that is destined for application 101 is redirected to agents 107A and 107B for inspection by their respective WAFs 131A and 131B. Agents 107A and 107B can distinguish between intercepted traffic having different destination addresses (i.e., the IP addresses of applications 101 and 103) because the redirected network traffic for each application is received on a port that is distinct for the destination application. For example, redirected application 101 traffic targets TCP port 30031, while redirected application 103 traffic targets a different port. Thus, upon receiving redirected traffic for inspection, WAFs 131A, 131B can determine which of the rules, policies, etc. maintained for different applications in WAF configuration 120 to apply based on the port to which the traffic was delivered. By maintaining multiple sets of WAF rules or policies for securing different applications running in cluster 115 that can be selectively applied to evaluate intercepted traffic, each of agents 107A, 107B can support deployment of a single WAF instance for protection of multiple applications per WAF.

[0022] 2 illustrates an exemplary conceptual diagram for dynamically scaling available deployed WAF instances to secure cloud applications based on observed conditions within the cluster on which the cloud applications execute. Figure 2 illustrates cluster 115 of FIG. 1, including worker nodes 105A and 105B and master node 125, on which agents 107A and 107B are deployed. In this example, WAFs 131A and 131B secure both application 101 and application 103 based on evaluating incoming network traffic against rules, policies, etc., set forth in WAF configuration 120 corresponding to the application to which the traffic is destined. As shown in FIG. 1, agents 107A and 107B are designated to receive redirected network traffic from application 101 on TCP port 30031 based on labeling with labels 119A and 119B. Agents 107A, 107B are further labeled with respective labels 219A and 219B shown as "agent_app103" to indicate that traffic for application 103 will be redirected to agents 107A, 107B and targeted to TCP port 30036. As with application 101, configuration 213 indicating labels 219A, 219B and TCP port 30036 specifies that application 103 is exposed externally, and modified configuration 211 generated based on configuration 213, as described with reference to FIG. 1, further exposes application 103 internally.

[0023] 2 is annotated with a series of letters A-C. These letters represent stages of operation. While these stages are ordered for purposes of this example, these stages illustrate one example that is helpful in understanding the disclosure and should not be used to limit the scope of the claims. Subject matter within the scope of the claims may vary with respect to the order and portion of operations.

[0024] In stage A, the WAF deployment manager obtains cluster metrics 229 from the agents 107A, 107B. The agents 107A, 107B may monitor network traffic and / or resource utilization (e.g., memory and central processing unit (CPU) utilization) of the worker nodes 105A, 105B and collect related metrics. The cluster metrics 229, including the network metrics and / or node resource utilization metrics collected by the agents 107A, 107B, may be reported to the WAF deployment manager 109 periodically, such as at scheduled time increments, upon update events (e.g., node addition / failure events) to the cluster 115, or may be requested by the WAF deployment manager 109. The cluster metrics 229 may include a node identifier (ID) and an application ID to indicate the node and / or application to which the collected metrics correspond.

[0025] In phase B, WAF deployment manager 109 evaluates cluster metrics 229 based on policy 106 to determine whether the number of WAF instances for application 101 or application 103 should be modified to match the conditions of cluster 115. In this example, policy 106 indicates that the WAF instances available to the application should be scaled up to match high network traffic, such as when any of the network metrics corresponding to the application or the resource utilization metrics of the node on which the application runs exceed a threshold. Policy 106 further indicates that the WAF instances available to the application should be scaled down based on low network traffic or low resource utilization of the node on which the application runs, such as when any of the network metrics or resource utilization metrics belonging to the application are below a minimum allocation value. WAF deployment manager 109 can evaluate the metrics collected for each application based on policy 106 to determine whether the active WAF instances in cluster 115 should be “rebalanced” through labeling to redistribute network traffic among nodes. The policy 106 may also indicate an increment in the number of WAF instances to add or remove based on satisfaction of the policy, such as based on the degree to which collected metrics exceed or fall below a threshold indicated in the policy 106.

[0026] In phase C, WAF deployment manager 109 determines that the WAF instances available for application 103 should be reduced and removes label 219B from container 104F. WAF deployment manager 109 may determine that the WAF instances for application 103 should be scaled down based on, for example, that application 103 is receiving low network traffic and that worker node 105B is approaching its maximum allocated CPU or memory utilization. Accordingly, WAF deployment manager 109 removes label 219B from container 104F, so that agent 107B no longer points to application 103. As a result, application 103's traffic is no longer redirected to WAF 131B running on agent 107B for inspection. WAF deployment manager 109 can remove label 219B by generating an update to the configuration of agents 107A and 107B to remove the label "agent_app103" from container 104F. Thus, the WAF deployment manager 109 can dynamically scale the number of WAF instances deployed via agents running on nodes of the cluster 115 that are available to secure the application according to the collected metrics with minimal to no impact on the infrastructure of the cluster 115 or other applications running on the cluster 115.

[0027] 3-5 illustrate a flowchart of an exemplary operation for automated deployment and scaling of active WAF instances for cloud applications running on a cluster based on the cluster's monitored state. The exemplary operation is described with reference to a WAF deployment manager for consistency with previous figures. The names chosen for the program code are not intended to limit the scope of the claims. The structure and organization of the program may vary depending on the platform, programmer / architect preferences, programming language, etc. Furthermore, the names of code units (e.g., programs, modules, methods, functions, etc.) may vary for the same reasons and may be arbitrary.

[0028] FIG. 3 illustrates a flowchart of an example operation for performing a scalable WAF deployment for a cloud application running on a cluster. The WAF deployment is said to be scalable because WAF instances for inspecting network traffic destined for the cloud application being secured can be made available or unavailable based on labeling the container in which the WAF is implemented, rather than redeploying the application and / or existing agents running on one or more nodes of the cluster. The description of FIG. 3 assumes that an agent capable of implementing the WAF is deployed on each of one or more nodes of the cluster that can execute the application. In addition to securing the application via the WAF, the agent deployed on the node can monitor network traffic and node resource utilization and collect relevant network metrics and node resource utilization metrics during the execution of the application running on the cluster.

[0029] In block 301, the WAF deployment manager identifies an externally exposed cloud application associated with a first deployment configuration. The WAF deployment manager may identify a cloud application as externally exposed (i.e., to a load balancer external to the cluster) based on analyzing configuration files accessible to the WAF deployment manager that indicate the exposure of applications running on the cluster. For example, an application may be externally exposed based on the allocation of a public IP address by a cloud provider that manages the load balancer. The WAF deployment manager may analyze type fields, IP address fields, etc., of one or more configuration files that define deployment configurations for applications running on the cluster and identify an externally exposed cloud application based on the configuration file having a field indicating a type of “external,” a public IP address, etc.

[0030] In block 303, the WAF deployment manager generates a further configuration for the deployment of the cloud application to expose the cloud application internally within the cluster. The WAF deployment manager can copy a configuration file indicating the external exposure of the cloud application, allocate a private IP address for the cloud application, and replace the public IP address with the private IP address in the resulting further configuration file. The duplication of the first configuration file to generate the further configuration file results in two IP addresses at which the cloud application is exposed: a public IP address that exposes the cloud application's containers to entities outside the cluster, and a private IP address that exposes the cloud application's containers to entities within the cluster.

[0031] In block 305, the WAF deployment manager allocates ports specific to the cloud application to one or more containers of agents running on nodes of the cluster. The agents may be deployed as containerized applications associated with their own IP addresses to expose the agents internally. The WAF deployment manager allocates ports on the agent IP addresses specific to the cloud application, thereby allocating ports to agent containers on a per-application basis.

[0032] In block 307, the WAF deployment manager updates the agent's configuration to redirect traffic delivered to the port to the cloud application via the private IP address allocated to the cloud application. The WAF deployment manager can generate an update to the agent's configuration to specify that network traffic received on the allocated port should be redirected to the cloud application via the cloud application's private IP address indicated in the configuration for exposing the cloud application internally. For example, the update to the agent configuration can indicate the allocated port as the port on which the agent is exposed within the cluster. The update to the agent configuration can also specify a container packaging the cloud application as the destination of outgoing network traffic based on the cloud application's private IP address and / or an application-specific label assigned to the agent. The WAF deployment manager can also create one or more iptables rules for network traffic received on the port to direct traffic to the cloud application via its private IP address.

[0033] In block 309, the WAF deployment manager assigns a label corresponding to the cloud application to one or more containers of the agent. A label is a cloud application-specific label that can be added or attached (e.g., as an attribute or other container metadata) to a container that packages the agent. Labels can be used within a cluster to identify or distinguish among containers based on their type / content, such as to identify the application packaged in the container. Application / agent deployment configurations can also utilize labels to control the containers to which network traffic is routed, such as to identify a subset of containers associated with an IP address to which network traffic should be directed. Thus, labeling agents facilitates identifying a set or subset of agents running on nodes of a cluster and instantiating a WAF to which network traffic destined for the cloud application should be redirected for inspection by the WAF. The WAF deployment manager maintains rules, policies, etc. for assigning labels and can assign cloud application-specific labels to one or more agent containers based on the rules or policies (e.g., by updating an agent configuration file). For example, labels can be assigned to each of the agent containers in a cluster by default, or upon initial identification of externally exposed applications and subsequent WAF deployment. As further described in FIG. 4, labels can be dynamically redistributed to increase or decrease the number of WAF instances that should be available to inspect application traffic across the nodes of the cluster to match observed network traffic volume and / or node resource utilization.

[0034] In block 311, the WAF deployment manager modifies the first application configuration to redirect network traffic destined for the cloud application to one or more agents associated with a label corresponding to the cloud application. The WAF deployment manager can generate an update to a configuration file for the deployment of the cloud application specifying that network traffic originating from outside the cluster, having a destination address corresponding to the cloud application, should be redirected to a container having a label corresponding to the cloud application and targeting an allocated port (e.g., based on updating / adding label and target port fields, which can be replaced with values ​​associated with the application's container). As a result, the agent effectively intercepts network traffic sent to the cloud application for inspection by the WAF instantiated for the cloud application. Because different ports and labels are allocated and assigned to agents for different applications, upon receiving the redirected network traffic, the agent and corresponding WAF implementation can then determine the associated application based on the port number to which the traffic was delivered and the container labeling. The WAF can then apply policies, rules, etc. defined for the cloud application and maintained by the agent for network traffic inspection accordingly.

[0035] 4-5 illustrate a flowchart of an exemplary operation for dynamically scaling among WAF instances available for inspection of network traffic of a cloud application (hereinafter, "application") across cluster nodes. The exemplary operation assumes that a WAF is instantiated to secure the application via an agent running on each of one or more nodes of the cluster on which the application executes. A WAF may be instantiated for an application via each agent, based on which each agent implements the functionality of the WAF and maintains WAF rules, policies, etc. that specify or correspond to the application. The agents are further configured to intercept network traffic destined for the application for inspection by the respective WAF, as described with reference to FIG. 3.

[0036] In block 401, the WAF deployment manager obtains node resource usage metrics and network metrics collected by agents. During application execution in the cloud, the agents can monitor network traffic sent to the application and resource usage (e.g., CPU and memory usage) by cluster nodes. The WAF deployment manager can periodically poll for or receive updates from the agents to obtain the collected node resource usage metrics and network metrics (e.g., bandwidth, congestion, latency, etc.). Retrieval of the collected metrics by the WAF deployment manager may be performed according to a schedule and / or upon an update within the cluster that triggers a collection event, such as a node failure event. Based on the application's identifier, the WAF deployment manager can determine metrics related to the application among the obtained metrics, such as network metrics collected based on application traffic and resource usage metrics for the node on which the application is currently deployed.

[0037] In block 403, the WAF deployment manager evaluates the obtained metrics against one or more criteria for modifying the number of WAF instances to secure the application. Evaluation of the collected metrics can be performed upon collecting the metrics or periodically after a defined time increment, number of collection events, etc. Modifying the number of WAF instances for an application refers to increasing or decreasing the number of agents across nodes in the cluster that instantiate WAFs that designate the application via labeling each agent's container with an application-specific label. If an application experiences high network traffic and / or is running on a node that is approaching or exceeding its maximum allocated resource utilization, more agents / WAFs may be designated for the application, so that network traffic destined for the application can be distributed across more WAFs for inspection, preventing bottlenecks. If an application experiences lower network traffic and / or is running on a node that is not near capacity to conserve resource utilization by consolidating network traffic to a minimal number of active nodes, fewer agents / WAFs may be designated for the application. The criteria may include distinguishable criteria for both increasing and decreasing the number of agents / WAFs that assign an application based on thresholds for maximum or minimum values ​​of network metrics and node resource utilization metrics. For example, the criteria may indicate that the number of agents / WAFs that assign an application should be increased if the resource utilization of one or more nodes on which the application executes and / or the amount of network traffic received by the application (e.g., in terms of bandwidth, congestion, latency, etc.) exceeds at least a first threshold.The criteria may further indicate that the number of agents / WAFs assigning the application should be reduced if the resource utilization of one or more nodes on which the application executes and / or the amount of network traffic received by the application is below at least a first minimum value.

[0038] In block 405, the WAF deployment manager determines whether at least a first one of the criteria is met. The WAF deployment manager can determine that the first one of the criteria is met if one or more of the collected metrics is above a threshold corresponding to a maximum value or below a threshold corresponding to a minimum value. If none of the criteria is met, operations continue at block 401. If at least a first criterion is met, operations continue at block 407.

[0039] In block 407, the WAF deployment manager determines whether the number of WAF instances specifying the application should be increased or decreased. This determination can be made based on which criteria are met based on an evaluation of the obtained metrics. For example, it can be determined that the number of WAF instances specifying the application should be increased if the obtained metrics exceed a threshold corresponding to a maximum value, or decreased if the obtained metrics are below a minimum allocation value. If the number of WAF instances should be increased, operations continue to transition point A, which continues to block 509 of FIG. 5. If the number of WAF instances should be decreased, operations continue to transition point C, which continues to block 510 of FIG. 5.

[0040] In block 509, the WAF deployment manager determines the number of additional agents and respective WAF instances to assign to the application. The WAF deployment manager can maintain additional criteria, rules, etc. for determining how many additional WAFs should be made available to the application based on the obtained metrics exceeding one or more thresholds. For example, the additional criteria can indicate that one additional WAF instance should be made available by default and / or can indicate the number of additional instances based on the degree to which the obtained metrics met the initial criteria (e.g., exceeded one or more thresholds). As an example, the additional criteria can indicate the quantity of additional WAFs to be made available when the obtained metrics that exceeded the thresholds are 1-10% above the threshold, 11-20% above the threshold, etc.

[0041] In block 511, the WAF deployment manager determines whether one or more nodes should be added or activated in the cluster. The WAF deployment manager may determine that additional nodes should be added or activated to accommodate the scale-up of WAFs that specify the application. For example, if the number of currently active nodes is less than the sum of nodes whose corresponding agents / WAFs already specify the application and the determined number of additional WAF instances that should specify the application, the WAF deployment manager may determine that additional nodes should be added or activated to accommodate the scale-up. As an example, if a cluster includes five nodes and respective agents / WAFs running on them, and four of the agents / WAFs already specify the application, additional nodes should be added or activated if the determined number of additional WAF instances is two or more. If a node should be added, operations continue to block 513. If no additional nodes need to be added, operations continue to block 515.

[0042] In block 513, the determined number of nodes with deployed agents are added or activated in the cluster. The WAF deployment manager can communicate commands or requests to the cloud service provider (e.g., via an API provided by the cloud service provider) to provision additional nodes, deploy agents on new nodes, or change the status of idle nodes that already have agents deployed to active / available. The WAF deployment manager can also request permission (e.g., from an administrator) before adding additional nodes to the cluster or changing the status of idle nodes to active / available.

[0043] In block 515, the WAF deployment manager adds application-specific labels to the additional agent containers, up to the determined number of additional WAF instances that should specify the application. The application-specific labels may also be included in the configuration indicating the application's public exposure as values ​​of the label field specifying that network traffic sent to an IP address associated with the application should be directed to a correspondingly labeled container. Thus, the application-specific labels added to the additional agent containers should match the labels indicated in the application configuration, such that network traffic having the application's public IP address as a destination address is redirected to the agent containers with the indicated labels. The labels may be added to the agent containers through the generation of an update to the agent's configuration, where the update may include one or more container IDs to specify the containers to which the labels should be added. Operation continues to transition point B, which continues to block 401 of FIG. 4.

[0044] In block 510, the WAF deployment manager determines the number of agents and respective WAF instances from which the application's designation should be removed. Removing the application's designation from a WAF instance may include making the WAF unavailable to the application, removing an application-specific label from the corresponding agent's container, or idling the node on which the WAF and corresponding agent run. The WAF deployment manager may maintain additional criteria, rules, etc. for determining how many WAFs should be disabled for an application based on the obtained metrics not meeting one or more minimum values. For example, the additional criteria may indicate that one WAF instance should be disabled by default and / or indicate the number of instances to be disabled based on the degree to which the obtained metrics met the initial criteria (e.g., were below one or more minimum values). As an example, the additional criteria may indicate the number of WAFs to be disabled when a metric that was below a threshold is 1-10% below the threshold, 11-20% below the threshold, etc.

[0045] In block 512, the WAF deployment manager determines whether one or more nodes in the cluster should be idled. The WAF deployment manager may determine that a node should be idled to accommodate the scaling down of the WAF that specifies the application if the node no longer needs to remain active upon removing the application designation from the WAF / agent running on the node. The scaling down of the application may accompany the scaling down of the WAF that specifies the application. For example, if the application and agent are the only containerized applications running on the node and both the application and the WAF are to be scaled down, the WAF deployment manager may determine that the node should be idled as part of reducing the number of WAFs available to the application to conserve resources in the cluster. If the node should be idled, operations continue to block 514. If the node should not be idled, operations continue to block 516.

[0046] In block 514, the WAF deployment manager indicates that the determined number of nodes should be set to idle. The WAF deployment manager can communicate a command or request to the cloud service provider (e.g., via an API provided by the cloud service provider) identifying the nodes and changing their status from active / available to idle. Setting the node's status to idle also makes the WAF instantiated via the agent running on the node unavailable to applications.

[0047] At block 516, the WAF deployment manager removes labels corresponding to the application from containers on agents running on nodes that are not set to idle, up to the number of remaining WAF instances from which the application designation should be removed. Labels can be removed from agent containers through the generation of an update to the agent's configuration, where the update can include one or more container IDs to specify the containers from which the label should be removed. The update can also indicate IDs associated with the applications associated with the labels to identify the labels to be removed, because an agent container can hold multiple labels corresponding to different applications. Operation continues to transition point D, which continues to block 401 of FIG. 4.

[0048] 6-8 are flowcharts describing innovative technologies in broader / different terms in an attempt to explain the shortcomings of the language used to describe new technologies. These flowcharts do not refer to specific entities because there are numerous implementations for organizing and developing program code and various options for deployment on different hardware and / or virtualization.

[0049] 6 illustrates a flowchart of an example operation for dynamically deploying and scaling available WAF instances to secure a cloud application. At block 601, an externally exposed cloud application running on one or more nodes of a cloud cluster is identified. The cloud application has a first configuration.

[0050] At block 603, the first configuration is modified to redirect network traffic destined for the cloud application to one or more agents on a first port allocated to the one or more agents. Each of the agents executes on a respective node of the one or more nodes and instantiates a WAF that is available for the cloud application. A label designating the cloud application can be associated with a container of at least a subset of the agents, wherein the labeling of the subset of agents designates that the WAF instantiated on each of the subset of agents is available for the cloud application. At block 605, it is determined whether a first metric of the plurality of metrics collected by the agents satisfies a first criterion for modifying the number of agents for which a WAF is available for the cloud application.

[0051] At block 607, based on a determination that the first metric satisfies the first criterion, the number of agents on which the WAF is available for the cloud application is modified. The number of agents can be modified by adding a label specifying the cloud application to a subset of the agents and associating it with the agent's container to increase the number of agents, or by removing the label from at least a first of the subset of agents' containers to decrease the number of agents. Alternatively or additionally, the number of agents can be modified by adding a node to the cluster on which the agent is deployed and labeled to specify the application to increase the number of agents, or by changing the status of a first of the one or more nodes from active to idle to decrease the number of agents.

[0052] 7 illustrates a flowchart of an example operation for dynamically deploying a WAF to secure an application running on one or more nodes of a cluster in a cloud. At block 701, based on a determination that the application is publicly exposed, a first configuration is generated for the application to expose the application internally within the cluster. The first configuration is generated based at least in part on a second configuration for the application that exposes the application externally. The first configuration may include a public network address allocated to the application. The second configuration may be generated based on copying the first configuration and replacing the public network address with a private network address allocated to the application.

[0053] At block 703, at least a first agent of the plurality of agents instantiating a WAF for securing the application is selected based at least in part on an association of a label corresponding to the application with the first agent. Each agent of the plurality of agents executes on a respective node of the one or more nodes. At block 705, the first configuration is modified to redirect network traffic destined for the application to the first agent. The first configuration may be modified to indicate a first port and label allocated for a network address associated with the plurality of agents as a destination for external network traffic. At block 707, the configuration of the first agent is modified to direct network traffic to the application based at least in part on the network address of the application indicated in the second configuration. The configuration of the first agent may be modified to indicate a private network address of the application indicated in the second configuration.

[0054] 8 illustrates a flowchart of an example operation for dynamically deploying and scaling WAF instances that designate applications for WAF protection. At block 801, based on an identification of an externally exposed application, a first configuration of the application is modified to redirect network traffic destined for the application to one or more agents. Each of the one or more agents executes on a respective node of one or more nodes of a cloud cluster on which the application executes. Each of the agents also instantiates a WAF and designates the application for WAF protection. At least a subset of the agents may be labeled with a label corresponding to the application, where labeling the subset of agents designates the application for WAF protection by the subset of agents.

[0055] At block 803, it is determined whether a first metric of the plurality of metrics collected by the agents satisfies a first criterion for increasing or decreasing the number of agents that designate the application for WAF protection. The determination of whether the first metric satisfies the first criterion may be based on whether the first metric exceeds a maximum value of the first metric and / or is below a minimum value of the first metric. At block 805, based on the determination that the first metric satisfies the first criterion, the number of agents that designate the application for WAF protection is increased or decreased. The number of agents that designate the application for WAF protection may be increased based at least in part on labeling at least a first agent in addition to a subset of agents with a label corresponding to the application. The number of agents that designate the application for WAF protection may be decreased based at least in part on removing a label corresponding to the application from at least a first agent of the subset of agents.

[0056] Variations

[0057] The flowcharts are provided to aid in understanding the examples and are not intended to limit the scope of the claims. The flowcharts illustrate example operations that may vary within the scope of the claims. Additional operations may be performed, fewer operations may be performed, operations may be performed in parallel, or operations may be performed in a different order. For example, the operations illustrated in blocks 307 and 309 may be performed in parallel or simultaneously. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by program code. The program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable machine or device.

[0058] As will be appreciated, aspects of the disclosure may be embodied as a system, a method, or program code / instructions stored on one or more machine-readable mediums. Accordingly, aspects may take the form of hardware, software (including firmware, resident software, microcode, etc.), or a combination of software and hardware aspects, all of which may be generally referred to herein as a "circuit," "module," or "system." Functionality presented in the exemplary illustrations as individual modules / units may be differently organized according to any one of platform (operating system and / or hardware), application ecosystem, interface, programmer preference, programming language, administrator preference, etc.

[0059] Any combination of one or more machine-readable media may be utilized. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable storage medium may be, for example, but not limited to, a system, apparatus, or device that employs any one or combination of electronic, magnetic, optical, electromagnetic, infrared, or semiconductor technologies to store program code. More specific examples (a non-exhaustive list) of machine-readable storage media include portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the context of this document, a machine-readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable storage medium is not a machine-readable signal medium.

[0060] A machine-readable signal medium may include a propagated data signal with machine-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A machine-readable signal medium is not a machine-readable storage medium and may be any machine-readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0061] The program code embodied in the machine-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

[0062] The program code / instructions may further be stored on a machine-readable medium that can instruct a machine to function in a particular manner, whereby the instructions stored on the machine-readable medium create an article of manufacture that includes instructions that implement the functions / acts defined in one or more blocks of the flowcharts and / or block diagrams.

[0063] FIG. 9 illustrates an exemplary computer system with a WAF deployment manager. The computer system includes a processor 901 (possibly including multiple processors, multiple cores, multiple nodes, and / or implementing multithreading). The computer system includes a memory 907. The memory 907 may be system memory or any one or more of the possible implementations of machine-readable media already described above. The computer system further includes a bus 903 and a network interface 905. The system further includes a WAF deployment manager 911. The WAF deployment manager 911 manages dynamic WAF deployment and scaling across one or more nodes of a cloud cluster, as described herein. Any one of the previously described functions may be implemented partially (or entirely) in hardware and / or on the processor 901. For example, the functions may be implemented in an application-specific integrated circuit, in logic implemented in the processor 901, in a coprocessor on a peripheral device or card, etc. Additionally, an implementation may include fewer or additional components not shown in FIG. 9 (e.g., a video card, an audio card, additional network interfaces, peripheral devices, etc.). The processor 901 and the network interface 905 are coupled to a bus 903. Although shown as being coupled to the bus 903, the memory 907 may also be coupled to the processor 901.

[0064] While aspects of the disclosure are described with reference to various implementations and applications, it will be understood that these aspects are exemplary and that the scope of the claims is not limited thereto. In general, the techniques for dynamically scalable WAF deployment described herein can be implemented in equipment consistent with any one or more hardware systems. Many variations, modifications, additions, and improvements are possible.

[0065] For components, operations, or structures described herein as a single instance, multiple instances may be provided. Finally, boundaries between various components, operations, and data stores are somewhat arbitrary, and particular operations are illustrated in the context of specific exemplary configurations. Other allocations of functionality are contemplated and may fall within the scope of the disclosure. In general, structures and functions presented as separate components in exemplary configurations may be implemented as combined structures or components. Similarly, structures and functions presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements may fall within the scope of the disclosure.

[0066] term

[0067] This description uses abbreviations related to cloud technology for efficiency and ease of explanation. When referring to a "cloud," this description refers to a cloud service provider's resources. For example, a cloud can encompass a cloud service provider's servers, virtual machines, and storage devices. The terms "cloud destination" and "cloud source" refer to an entity that has a network address that can be used as an endpoint for a network connection. The entity may be a physical device (e.g., a server) or a virtual entity (e.g., a virtual server or virtual storage device). In more general terms, a cloud service provider resource accessible to a customer is a resource owned / managed by a cloud service provider entity that is accessible via a network connection. Often, access is pursuant to an application programming interface or software development kit provided by the cloud service provider.

[0068] The use of the phrase "at least one of" before a list with the conjunction "and" should not be treated as an exhaustive list and should not be construed as a list of categories with one item from each category unless specifically stated otherwise. A clause stating "at least one of A, B, and C" can be infringed by only one of the listed items, by more than one of the listed items, and by one or more of the listed items and another unlisted item.

Claims

1. A method comprising: Identifying, by a processor in a computer system, an externally exposed cloud application running on one or more nodes of a cloud cluster, the cloud application having a first configuration, with one or more agents running on each of the one or more nodes and associated with each of the one or more containers; modifying, by the processor, the first configuration to redirect network traffic destined for the cloud application to the one or more agents on a first port allocated to the agents for the cloud application, each of the agents instantiating a web application firewall, the web application firewall being made available for the cloud application based on labeling of containers among the containers of at least a subset of the agents with a label that specifies the cloud application; determining, by the processor, whether a first metric of a plurality of metrics collected by the agents satisfies a first criterion for modifying the number of agents for which the web application firewall is available for the cloud application; modifying, by the processor, the number of agents on which the web application firewall is available for the cloud application based on determining that the first metric satisfies the first criterion, wherein modifying the number of agents includes modifying assignment of the label that designates the cloud application across the containers of the agents; A method comprising:

2. 2. The method of claim 1 , wherein the first criterion includes a threshold corresponding to a maximum value of the first metric, determining whether the first metric satisfies the first criterion includes determining whether the first metric exceeds the threshold, and modifying the number of agents includes increasing the number of agents available to the web application firewall for the cloud application.

3. 2. The method of claim 1 , wherein the first criterion includes a minimum value of the first metric, determining whether the first metric satisfies the first criterion includes determining whether the first metric is below the minimum value, and modifying the number of agents includes reducing the number of agents available to the web application firewall for the cloud application.

4. generating, by the processor, a second configuration for the cloud application to expose the cloud application internally within the cloud cluster using a private network address based at least in part on copying the first configuration and replacing a public network address of the cloud application with a private network address assigned to the cloud application; modifying, by the processor, a configuration of the agent to direct network traffic allowed through the web application firewall to the cloud application via the private network address of the cloud application; The method of claim 1 further comprising:

5. 3. The method of claim 2, wherein increasing the number of agents includes associating the label with additional containers of the containers associated with agents in addition to the subset of agents, or adding nodes to the cloud cluster with additional agents deployed thereon and associating the label with the additional agent's container.

6. 4. The method of claim 3, wherein reducing the number of agents comprises removing the label from at least a first one of the containers of the subset of agents or changing the status of a first one of the one or more nodes from active to idle.

7. The method of claim 1, further comprising the step of: based on the processor identifying a second externally exposed cloud application running on the one or more nodes, modifying a configuration of the second cloud application to redirect network traffic destined for the second cloud application to the one or more agents on a second port assigned to the one or more agents, the second port being different from the first port.

8. 2. The method of claim 1, wherein the plurality of metrics comprises a metric indicative of at least one of: memory utilization of each of the one or more nodes; central processing unit (CPU) utilization of each of the one or more nodes; and an amount of network traffic directed to the cloud application.

9. 9. One or more non-transitory machine-readable media having stored thereon program code, the program code comprising machine instructions executable by a processor to perform the method of any one of claims 1 to 8.

10. 1. An apparatus comprising: a processor; A computer-readable medium having stored thereon instructions that cause the device to: based on an identification of an externally exposed application running in the cloud cluster, modifying a first configuration of the application to redirect network traffic destined for the application to one or more agents; each of the one or more agents executing in a respective container of one or more containers on a respective node of the one or more nodes of the cloud cluster; each of the agents instantiates a web application firewall, the web application firewall being available for protection of the application via labeling of containers among the containers of at least a subset of the agents with labels corresponding to the application; determining whether a first metric of a plurality of metrics collected by the agents meets a first criterion for increasing or decreasing the number of agents that designate the application for web application firewall protection; increasing or decreasing the number of agents that designate the application for web application firewall protection based on a determination that the first metric satisfies the first criterion and based on modifying an assignment of the agents to the container of the labels corresponding to the application. a computer-readable medium executable by the processor to cause the An apparatus comprising:

11. The device, generating a second configuration for the application based at least in part on the first configuration to internalize the application within the cloud cluster with a private network address allocated to the application; Modifying the agent's configuration to direct network traffic to the application via the application's private network address. The apparatus of claim 10 , further comprising instructions executable by the processor to cause it to:

12. the instructions executable by the processor to cause the device to determine whether the first metric satisfies the first criterion include instructions executable by the processor to cause the device to determine whether the first metric exceeds a maximum value of the first metric; 11. The apparatus of claim 10, wherein the instructions executable by the processor to cause the apparatus to increase or decrease the number of agents comprise instructions executable by the processor to cause the apparatus to increase the number of agents that designate the application for web application firewall protection based at least in part on labeling a further one of the containers corresponding to a first agent with the label corresponding to the application in addition to the subset of agents.

13. the instructions executable by the processor to cause the device to determine whether the first metric satisfies the first criterion include instructions executable by the processor to cause the device to determine whether the first metric is below a minimum value of the first metric; 11. The apparatus of claim 10, wherein the instructions executable by the processor to cause the apparatus to increase or decrease the number of agents comprise instructions executable by the processor to cause the apparatus to decrease the number of agents that designate the application for web application firewall protection based at least in part on removing the label corresponding to the application from at least a first one of the containers corresponding to the subset of the agents.

14. 11. The apparatus of claim 10, wherein the instructions executable by the processor to cause the apparatus to modify the first configuration of the application comprise instructions executable by the processor to cause the apparatus to modify the first configuration to redirect network traffic destined for the application to the agent on a first port allocated to the agent for the application.

15. 15. The apparatus of claim 14, further comprising instructions executable by the processor to cause the apparatus to, based on an identification of a second application running on the one or more externally exposed nodes, modify a second configuration of the second application to redirect network traffic directed to the second application to the agent on a second port allocated to the agent for the second application, the second port being different from the first port.

Images