Intent-based networking with improved correspondence between intent and security posture

1 . A computer-implemented method for configuring a communication network based on a given intent, the intent comprising at least the providing of a given form of communication, the method comprising:

determining from the given intent by a given orchestration engine a candidate network configuration that, when implemented, causes the given intent to be realized;

determining from the intent and/or from the candidate network configuration one or more changes to the security posture of the network that result from the candidate network configuration;

determining based on at least one given criterion whether there is sufficient correspondence between the intent and the changes to the security posture;

in response to determining that this correspondence is not sufficient, determining at least one amendment to the given intent such that, when a new candidate network configuration is determined by the orchestration engine based on the amendment, there is a better correspondence between the amended intent and the resulting changes to the security posture of the network; and

implementing the new candidate configuration in the communication network.

2 . The method of claim 1 , wherein at least one amendment to the given intent comprises an explicit intent to cause at least one chosen change to the security posture from the determined changes.

3 . The method of claim 1 , wherein at least one amendment to the given intent is chosen to reduce or eliminate a change to the security posture compared to the candidate network configuration.

4 . The method of claim 3 , wherein at least one change to the security posture comprises the granting, to a defined scope of client machines and/or people, access to at least one network resource; and wherein the reducing of the change comprises reducing the scope of machines and/or people, and/or the amount of network resources to which access is granted.

5 . The method of claim 1 , wherein the determining whether there is sufficient correspondence between the intent and the changes to the security posture comprises:

checking, for at least one individual change to the security posture, whether this individual change fits a predetermined policy; and, when this is the case,

determining that an explicit intent to cause this individual change is required for sufficient correspondence between intent and changes to the security posture; or

determining that the individual change must be reduced or eliminated for sufficient correspondence between intent and changes to the security posture.

6 . The method of claim 5 , wherein at least one change that fits the predetermined policy comprises the granting of public access to at least one resource in the network.

7 . The method of claim 1 , wherein the evaluating of changes to the security posture, and/or the determining of the amendment, is based at least in part on a security policy that governs the determining of the candidate network configuration from the given intent.

8 . The method of claim 1 , wherein at least one amendment to the given intent is queried from a trained machine learning model.

9 . The method of claim 1 , wherein the determining at least one amendment to the given intent comprises:

determining, for a plurality of candidate amendments, the resulting new correspondences between the intent and the changes to the security posture; and

choosing a candidate amendment with the best new correspondence between the intent and the changes to the security posture as the amendment.

10 . The method of claim 1 , further comprising before implementing the new candidate configuration in the communication network, prompting a network operator for confirmation of the amended intent that gives rise to this new candidate configuration.

11 . The method of claim 10 , wherein multiple new candidate configurations are determined based on different candidate amendments, and the network operator is prompted to choose one candidate amendment.

12 . The method of claim 11 , wherein the multiple new candidate configurations represent different trade-offs between a scope of desired functionality and a security posture of the network.

13 . A non-transitory computer-readable storage medium having stored thereon machine-readable instructions that, when executed by one or more computers and/or compute instances, cause the one or more computers and/or compute instances to configure a communication network based on a given intent, the intent comprising at least the providing of a given form of communication, the instructions comprising:

determining from the given intent by a given orchestration engine a candidate network configuration that, when implemented, causes the given intent to be realized;

determining from the intent and/or from the candidate network configuration one or more changes to the security posture of the network that result from the candidate network configuration;

determining based on at least one given criterion whether there is sufficient correspondence between the intent and the changes to the security posture;

in response to determining that this correspondence is not sufficient, determining at least one amendment to the given intent such that, when a new candidate network configuration is determined by the orchestration engine based on the amendment, there is a better correspondence between the amended intent and the resulting changes to the security posture of the network; and

implementing the new candidate configuration in the communication network.