Context aware microsegmentation
Context aware microservice networks and contextual security policies for microservice networks are provided herein. In some embodiments, a system includes a plurality of microservices, each of the plurality of microservices having a plurality of distributed microservice components. At least a portion of the distributed microservice components execute on different physical or virtual servers in a data center or a cloud. The system also includes a plurality of logical security boundaries, with each of the plurality of logical security boundaries being created by a plurality of enforcement points positioned in association with the plurality of distributed microservice components. Each of plurality of microservices is bounded by one of the plurality of logical security boundaries.
1. A method for context aware security policy enforcement, the method comprising:
receiving, by a first enforcement point, network traffic sent to and from a first virtual machine, the first virtual machine providing a first microservice component;
selecting, by the first enforcement point, a first contextual security policy using attributes of the first virtual machine;
receiving, by a second enforcement point, network traffic sent to and from a second virtual machine, the second virtual machine providing a second microservice component;
selecting, by the second enforcement point, a second contextual security policy using attributes of the second virtual machine;
receiving, by a third enforcement point, network traffic sent to and from a third virtual machine, the third virtual machine providing a third microservice component, the first, the second, and the third virtual machines collectively providing a microservice, the microservice comprising the first, the second, and the third microservice components;
selecting, by the third enforcement point, a third contextual security policy using attributes of the third virtual machine; and
controlling, by the first, the second, and the third enforcement points, network traffic to and from the respective first, the second, and the third virtual machines using the respective first, the second, and the third contextual security policies, such that the first, the second, and the third virtual machines are logically partitioned together into one logical subnetwork, the controlling including:
applying a first set of security rules to the network traffic into and out of the logical subnetwork, the first set of security rules determined using at least one of the first, the second, and the third contextual security policies; and
applying a second set of security rules to the network traffic within the logical subnetwork, the second set of security rules determined using one or more of the first, the second, and the third contextual security policies.
2. The method according to claim 1 , further comprising comparing the attributes of the first, the second, and the third virtual machines to security policies stored in a security policy database of a data center.
3. The method according to claim 1 , wherein the attributes of the first, the second, and the third virtual machines comprise a location of a data center where the first, the second, and the third virtual machines reside.
4. The method according to claim 1 , further comprising rejecting network traffic that violates at least one of the first and the second sets of security rules.
5. The method according to claim 1 , wherein the first virtual machine within the logical subnetwork is subject to different local security requirements, the different local security requirements manifesting in the first contextual security policy.
6. The method according to claim 5 , wherein the first virtual machine is located in a first country and the second and the third virtual machines are located in a second country, the first country being subject to a first set of security requirements and the second country being subject to a second set of security requirements, the first set of security requirements manifesting in the first contextual security policy, and the second set of security requirements manifesting in the second and the third contextual security policies.
7. The method of claim 1 , wherein at least two of the first, the second, and the third virtual machines are physically collocated in a data center.
8. The method of claim 1 , wherein at least one of the first, the second, and the third enforcement points is a virtual machine.
9. The method of claim 1 further comprising:
inspecting the received network traffic for malicious behavior.
10. The method of claim 9 , wherein the inspecting comprises:
performing stateful inspection of the received network traffic.
11. The method of claim 1 further comprising:
measuring network traffic associated with one of the first, the second, and the third virtual machines; and
determining that the measured network traffic is indicative of malicious behavior.
12. The method of claim 11 , wherein the determining includes:
comparing the measured network traffic to traffic rules, the traffic rules being included in at least one of the first, the second, and the third contextual security policies.
13. The method of claim 11 further comprising:
providing a warning about the malicious behavior when the malicious behavior is determined.
14. The method of claim 1 further comprising:
quarantining at least one of the first, the second, and the third virtual machines when network traffic associated with a respective one of the at least one of the first, the second, and the third virtual machines violates one or more of the first and the second sets of security rules.