Microsegmentation Policy Enforcement Using Application Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security technologies struggle with complex and time-consuming network segmentation, leading to increased risk in cloud and data centers due to excessive access pathways, difficulty in crafting precise access rules, and limited visibility into application identities, making it challenging to effectively implement Zero Trust Network Access (ZTNA) and prevent lateral threats.
Innovation Solution
A two-stage validation process using local security agents on source and destination systems to enforce network communication policies based on machine learning, without requiring a backend system, and applying application fingerprints to distinguish permitted from prohibited applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network segmentation is implemented using legacy virtual firewalls, then security protection is improved, but cost and complexity increase significantly
Solution Approach 1:
The patent replaces legacy virtual firewalls with a software-based microsegmentation system that uses application fingerprints and distributed validation. Instead of relying on complex hardware or software firewalls, the invention uses lightweight agents running on host systems that automatically enforce security policies based on application identity and relationship, significantly reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent implements microsegmentation by dividing the network into fine-grained segments based on application relationships rather than traditional network zones. Each application or service is assigned a unique fingerprint, and access is controlled at the application level, creating numerous small security segments that are easier to manage than traditional large-scale network segmentation.
2Manufacturing precision
If manual crafting of access rules is performed, then policy precision is improved, but time consumption increases significantly
Solution Approach 1:
The patent implements self-service through automated policy generation. The system automatically collects network communication data, generates application fingerprints, and creates access control policies without human intervention. The validation engine automatically processes communication patterns and generates precise policies based on observed application relationships, eliminating the time-consuming manual rule crafting process while maintaining high precision.
Solution Approach 2:
The patent performs preliminary actions by automatically collecting and analyzing network communication data before policy enforcement. The system proactively gathers communication patterns, establishes baseline behavior, and pre-generates policies based on observed patterns, so that when actual access control is needed, the precise policies are already in place without requiring manual crafting at the moment of enforcement.
3Ease of operation
If traditional firewall rules are used, then network access control is simplified, but visibility into application identities is lost
Solution Approach 1:
The patent uses application fingerprints as unique identifiers that change or differentiate between various applications and services. Instead of relying on generic IP addresses and ports, each application receives a unique fingerprint that provides rich identity information. This fingerprint mechanism maintains the simplicity of access control while providing comprehensive application identity visibility, as the fingerprint serves as both the access control key and the identity indicator.
4Object-affected harmful factors
If fine-grained segmentation rules are created, then lateral threat movement is prevented, but rule management complexity increases
Solution Approach 1:
The patent replaces complex manual rule management with an automated validation engine that handles fine-grained segmentation. Instead of requiring administrators to manually create and maintain numerous access control rules, the system uses automated validation that collects communication data, generates fingerprints, and enforces policies through distributed agents. This substitution maintains effective lateral threat prevention while eliminating the complexity of manual rule management.
Data Source
AI summary
Systems and methods for microsegmentation include receiving network communication information that describes flows between hosts in a network and applications executed on the hosts; generating a network communication model based on the network communication information that labels flows; and providing polices to the hosts based on the network communication model where the policies cause performance a set of actions, locally at a host, on any of the flows based on corresponding labels. The labels are one of healthy and unhealthy. The set of actions include blocking, allowing, and allowing for a period of time before confirmation.