Distributed network connection policy management
View Patent ↗A connection policy for a communications network has a local connection policy indicating which paths between a given one of the nodes (computer A, router A, host 898 ) and others of the nodes (computers B, C, filters B 1 , B 2 , C 1 , C 2 , hosts 890, 892 ) are allowable paths, by a symbolic expression of ranges endpoint addresses and other local connection policies in respect of other nodes. It is implemented in a distributed manner by determining, for the given node, which of the allowable paths, are dual authorized as allowable by the other local connection policy relating to the other node at the other end of that path, by Boolean operations on the symbolic expressions. For a given message for a given path between two of the nodes having their own local connection policies, both of these nodes determine whether the given path is currently dual authorized. This can provide reassurance that changes in versions of the connection policy won't transiently open a risk of undetected unwanted communication.
1. A method of implementing a connection policy for a given node in a network, the method comprising:
receiving, by the given node, a new version of an application;
determining, by the given node, a connection policy for the new version of the application;
determining, based on the connection policy, allowable paths for the new version of the application to addresses known to the given node; and
determining, by the given node, that one of the allowable paths for the new version of the application between the given node and another node is dual authorized in response to a determination that the path is also indicated as being allowable by the another node.
2. The method of claim 1 , wherein the connection policy comprises rules, and the method further comprises:
removing one of the allowable paths by removing one of the rules from the connection policy.
3. The method of claim 1 , further comprising:
adding a path to the allowable paths by adding a new rule to the connection policy.
4. The method of claim 1 , wherein determining the connection policy for the new version of the application comprises evaluating a symbolic expression of ranges of endpoint addresses using information associated with the given node.
5. The method of claim 4 , wherein determining that one of the allowable paths is dual authorized comprises carrying out a Boolean AND of the symbolic expression for the connection policy of the given node and a symbolic expression for the connection policy of the another node.
6. The method of claim 1 , further comprising: changing the connection policy of the given node to allow a connection of the dual authorized path for the new version of the application; and blocking a connection for an old version of the application in response to the allowance of the connection for the new version of the application.
7. A computer device comprising a processor; and a non-transitory computer readable medium storing instructions to cause the processor to: receive a new version of an application, determine a connection policy for the new version of the application, determine, based on the connection policy, allowable paths for the new version of the application to addresses known to the computer device, and determine that one of the allowable paths for the new version of the application between the computer device and another device is dual authorized in response to a determination that the path is also indicated as being allowable by the another node.
8. The computer device of claim 7 , wherein the connection policy comprises rules, and
wherein the instructions are to cause the processor to remove one of the allowable paths by removing one of the rules from the connection policy.
9. The computer device of claim 7 , wherein the instructions are to cause the processor to add a path to the allowable paths by adding a new rule to the connection policy.
10. The computer device of claim 7 , wherein, to determine the connection policy for the new version of the application, the instructions are to cause the processor to evaluate a symbolic expression of ranges of endpoint addresses using information associated with the computer device.
11. The computer device of claim 10 , wherein, to determine the connection policy for the new version of the application, the instructions are to cause the processor to carry out a Boolean AND of the symbolic expression for the connection policy of the computer device and a symbolic expression for the connection policy of the another device to obtain an expression for the dual authorized path as a function of node addresses.
12. The computer device of claim 11 , wherein the instructions are to cause the processor to substitute an address of the another node into the expression for the dual authorized path.
13. The computer device of claim 7 , wherein the instructions are to cause the processor to: change the connection policy of the given node to allow a connection of the dual authorized path for the new version of the application; and block a connection for an old version of the application in response to the allowance of the connection for the new version of the application.
14. A non-transitory computer readable medium storing instructions to implement a connection policy of a given node in a network, wherein the connection policy indicates which paths between the given node and other nodes in the network are allowable paths, wherein the instructions when executed by a processor of the given node cause the processor of the given node to: receive a new version of an application; obtain based on the new version of the application, a connection policy for another node in the network; and determine whether one of the allowable paths between the given node and the another node is dual authorized in response to a determination that the path is also indicated as being allowable by the connection policy of the another node.
15. The non-transitory computer readable medium of claim 14 , wherein the connection policy comprising rules, and
wherein the instructions are to cause the processor to remove one of the allowable paths by removing one of the rules from the connection policy.
16. The non-transitory computer readable medium of claim 14 , wherein the instructions are to cause the processor to add a path to the allowable paths by adding a new rule to the connection policy.
17. The non-transitory computer readable medium of claim 14 , wherein the instructions are further to cause the processor to determine the connection policy for the given node by evaluating a symbolic expression of ranges of endpoint addresses using information associated with the given node.
18. The non-transitory computer readable medium of claim 17 , wherein, to determine whether one of the allowable paths is dual authorized, the instructions are to cause the processor to carry out a Boolean AND of the symbolic expression for the connection policy of the given node and a symbolic expression for the connection policy of the another node to obtain an expression for the dual authorized path as a function of node addresses.
19. The non-transitory computer readable medium of claim 18 , wherein the instructions are to cause the processor to substitute an address of the another node into the expression for the dual authorized path.
20. The non-transitory computer readable medium of claim 14 , wherein the instructions are to cause the processor to: change the connection policy of the given node to allow a connection of the dual authorized path for the new version of the application; and block a connection for an old version of the application in response to the allowance of the connection for the new version of the application.