利索-全球专利检索

  1. Login
  2. Sign Up

Search Results

14 records (took 0.012 seconds)

    Enforcing a Segmentation Policy Using Cryptographic Proof of Identity
    3.
    发明申请
    Enforcing a Segmentation Policy Using Cryptographic Proof of Identity 有权

    公开(公告)号：US20220103361A1

    公开(公告)日：2022-03-31

    申请号：US17398814

    申请日：2021-08-10

    Applicant: Illumio, Inc.

    Inventor： Paul J. Kirner ,  Matthew K. Glenn ,  Mukesh Gupta ,  Anish Vinodkumar Desai

    IPC: H04L9/32 ,  H04L29/06

    Abstract: A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.

    Enforcing a segmentation policy using cryptographic proof of identity
    5.
    发明授权
    Enforcing a segmentation policy using cryptographic proof of identity 有权

    公开(公告)号：US11121875B2

    公开(公告)日：2021-09-14

    申请号：US15789921

    申请日：2017-10-20

    Applicant: Illumio, Inc.

    Inventor： Paul J. Kirner ,  Matthew K. Glenn ,  Mukesh Gupta ,  Anish Vinodkumar Desai

    IPC: H04L29/06 ,  H04L9/32

    Abstract: A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.

    Optimizing rules for configuring a firewall in a segmented computer network
    7.
    发明授权
    Optimizing rules for configuring a firewall in a segmented computer network 有权

    公开(公告)号：US11451514B2

    公开(公告)日：2022-09-20

    申请号：US16239492

    申请日：2019-01-03

    Applicant: Illumio, Inc.

    Inventor： Daniel Richard Cook ,  Anish Vinodkumar Desai

    IPC: H04L9/40 ,  G06F9/50 ,  H04L41/0823

    Abstract: An enforcement module receives management instructions from a segmentation server for enforcing a segmentation policy. The management instructions include one or more rules specifying one or more groups of workloads that a workload executing on the operating system instance is permitted to communicate with according to certain communication constraints, and membership information specifying workload identifiers for workloads in each of the groups. An optimization module processes the management instructions to reduce the number of rules and the number of workload groups to which the rules apply, thereby simplifying the firewall configuration. The enforcement module then configures a firewall according to the optimized rules to enforce the segmentation policy. The optimization process beneficially improves performance of the firewall and thereby enables more efficient enforcement of the segmentation policy utilizing fewer computing resources.

    Enforcing a Segmentation Policy Using Cryptographic Proof of Identity
    8.
    发明申请
    Enforcing a Segmentation Policy Using Cryptographic Proof of Identity 审中-公开

    公开(公告)号：US20190123905A1

    公开(公告)日：2019-04-25

    申请号：US15789921

    申请日：2017-10-20

    Applicant: Illumio, Inc.

    Inventor： Paul J. Kirner ,  Matthew K. Glenn ,  Mukesh Gupta ,  Anish Vinodkumar Desai

    IPC: H04L9/32 ,  H04L29/06

    Abstract: A segmentation server defines a segmentation policy and distributes the segmentation policy to be enforced by a plurality of operating system (OS) instances. The segmentation policy includes rules controlling which workloads executing on the OS instances can communicate with other workloads and controlling how the workloads may communicate. When a connection between two OS instances is requested, each OS instance provides an identity and a cryptographic proof of the identity. The OS instances each authenticate the identity received from the other OS instance, and once authenticated, determines based on the authenticated identities if the rules permit the communication. If the rules permit the communication, the OS instances obtain session parameters that enable the OS instances to validate integrity of the messages communicated between the workloads and optionally encrypt the messages.

    ENFORCING A SEGMENTATION POLICY IN CO-EXISTENCE WITH A SYSTEM FIREWALL
    10.
    发明申请
    ENFORCING A SEGMENTATION POLICY IN CO-EXISTENCE WITH A SYSTEM FIREWALL 有权

    公开(公告)号：US20220255899A1

    公开(公告)日：2022-08-11

    申请号：US17730062

    申请日：2022-04-26

    Applicant: Illumio, Inc.

    Inventor： Daniel Richard Cook ,  Anish Vinodkumar Desai ,  Thomas Michael McCormick

    IPC: H04L9/40 ,  G06F9/38 ,  H04L41/0803 ,  H04L43/04 ,  G06F9/448

    Abstract: A segmentation firewall executing on a host enforces a segmentation policy. In a co-existence mode, the segmentation firewall operates in co-existence with a system firewall that enforces a security policy. The segmentation firewall is configured to either drop packets that do not match any permissive rule or pass packets that match a permissive rule to the system firewall to enable the system firewall to determine whether to drop or accept the passed packets. To enable efficient operation of the segmentation firewall when operating in co-existence with the system firewall, the segmentation firewall may include a plurality of rule chains and may be configured to exit a chain and bypass remaining rule chains upon an input packet matching a permissive rule of the segmentation policy.

Patent Agency Ranking