Firewall Policy Inheritance for Auto-Scaled Application Instances
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data centers, virtual computing instances (VCIs) face security vulnerabilities during registration with firewalls due to the time-consuming process of retrieving firewall policies, leading to unprotected states or delayed availability, especially with auto-scaling scenarios where VCIs are frequently spawned and terminated.
Innovation Solution
A method where a new VCI instantly applies security policies inherited from a parent VCI by detecting its cloned status, allowing the firewall to associate the same policies without retrieving them from a policy manager, thus reducing latency and ensuring immediate protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the firewall retrieves security policies from the policy manager during the registration process, then the VCI receives proper security policy enforcement, but the registration process takes time causing the VCI to be unprotected or unavailable during this period
Solution Approach 1:
The patent applies preliminary action by pre-fetching security policies for VCIs that are about to be spawned based on auto-scaling predictions. The system predicts when new VCIs will be created and retrieves their security policies in advance from the policy manager, so that when the VCIs are actually created, the policies are already available and can be immediately applied without registration delays.
Solution Approach 2:
The patent uses copying by creating a copy of the security policy association between the parent VCI and the child VCI. When a new VCI is spawned from a parent VCI, the system copies the parent's VCI ID and registration ID into the child's configuration file, allowing the child VCI to inherit security policies without going through the complete registration process with the policy manager.
2Productivity
If the VCI handles application requests without protection during registration, then the VCI is immediately available, but security vulnerabilities arise during the unprotected state
Solution Approach 1:
The system performs preliminary action by retrieving and caching security policies before the VCI becomes operational. This ensures that when the VCI starts handling application requests, the security policies are already in place and the VCI is protected from the moment it becomes available, eliminating the security vulnerability window.
3Reliability
If the firewall communicates with the policy manager for each new VCI registration, then accurate security policies are applied, but the process complexity and time increase
Solution Approach 1:
The patent applies copying by duplicating the parent VCI's registration information (VCI ID and registration ID) into the child VCI's configuration file. This allows the child VCI to inherit security policies without initiating a new communication sequence with the policy manager, thereby reducing process complexity while maintaining policy accuracy through the copied parent's established policy associations.
Data Source
AI summary
The disclosure provides an approach for firewall policy management. Embodiments include receiving, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI. Embodiments include determining, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall. Embodiments include applying, at the firewall, based on the first identifier included in the registration request, the network policy associated with the second VCI to the first VCI. Additionally, embodiments include allowing or disallowing network activity for the first VCI based on the applied network security policy.