Tag-Based Firewall Configuration for Compute Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing network-based compute resources from malicious attacks is challenging due to the difficulty in accurately distinguishing between non-malicious and malicious network addresses, especially in cloud environments where hundreds or thousands of compute resources need to be protected, making manual configuration of firewalls impractical.
Innovation Solution
A machine-learning based approach is used to classify network addresses as malicious or non-malicious by analyzing network data traffic, with determined non-malicious addresses being associated with a tag that configures firewall applications, allowing access only to trusted addresses, thereby reducing the need for lengthy whitelists and improving security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration of firewalls is used to protect compute resources, then security control is achieved, but the complexity and time required to manage hundreds or thousands of compute resources becomes impractical
Solution Approach 1:
The patent segments the large set of compute resources into smaller clusters based on their network address patterns. By grouping compute resources that share similar trusted network addresses, the system reduces the complexity of managing individual firewall rules for each compute resource. Instead of configuring firewalls for thousands of individual resources, administrators can manage cluster-level configurations that automatically apply to multiple resources.
Solution Approach 2:
The patent creates a universal tagging system where a single tag can represent multiple trusted network addresses across different compute resources. This tag-based approach provides multi-functionality by enabling a single configuration element (the tag) to serve multiple purposes: identifying trusted addresses, grouping compute resources, and applying firewall rules uniformly across clusters. This universal tagging mechanism simplifies the overall firewall configuration process.
2Reliability
If lengthy whitelists of non-malicious addresses are maintained, then security coverage is improved, but storage and processing requirements increase
Solution Approach 1:
The patent merges multiple individual network address entries into consolidated tag representations. By combining the trusted network addresses associated with multiple compute resources into a single tag, the system reduces the total quantity of data that needs to be stored and processed. This merging approach maintains comprehensive security coverage while significantly reducing the storage footprint compared to maintaining separate whitelist entries for each compute resource.
Solution Approach 2:
The patent uses tag templates that can be copied and applied across multiple compute resources. Instead of storing and processing lengthy individual whitelists for each resource, the system creates a standardized tag template containing trusted address patterns that can be replicated and applied universally. This copying mechanism reduces storage requirements while maintaining consistent security coverage across all compute resources.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments described herein are directed to securing network-based compute resources. The foregoing may be achieved by determining a tag representative of non-malicious network addresses. The tag is determined by analyzing network data traffic received by a plurality of compute resources. Machine-learning based techniques may be used to automatically classify each network address that communicates with a particular compute resource as being malicious or non-malicious. Determined non-malicious network addresses for a particular compute resource are automatically associated with a tag. The tag is used to configure a firewall application to prevent access to a corresponding compute resource by malicious network addresses not represented by the tag. The number of non-malicious network addresses associated with a tag may be expanded by clustering compute resources having a similar set of network addresses that communicate therewith. The non-malicious network addresses determined for the clustered compute resources are combined and associated with a single tag.