Context engine model
Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines, each host computer in these embodiments executes a context engine and one or more attribute-based service engines. Through the GI agents of a host's machines, the context engine of that host in some embodiments collects contextual attributes associated with network and/or process events on the machines, and provides the contextual attributes to the service engines to use to identify service rules for processing.
1. A host computer comprising:
a plurality of machines;
a plurality of service engines to enforce different sets of attribute-based service rules on the data message flows; and
a context engine to collect contextual attributes for data message flows sent by the machines, and to provide sets of contextual attributes to service engines by (i) receiving identifiers associated with the data message flows from service engines requesting sets of contextual attributes for the data message flows from the context engine, and (ii) providing sets of contextual attributes associated with the identifiers to the service engines, wherein each of a plurality of sets of contextual attributes comprises one or more attributes other than layer 2 (L2), layer 3 (L3) and layer 4 (L4) data-message header values, and at least one set of contextual attributes for at least one particular data message flow comprises an application identifier (AppID) that specifies a type of traffic contained in the particular data message flow,
said service engines using the sets of contextual attributes provided by the context engine to identify and enforce a set of one or more attribute-based service rules for the data message flows.
2. The host computer of claim 1 further comprising a deep packet inspection engine for analyzing the data messages of the particular data message flow and generating the AppID based on the analysis.
3. The host computer of claim 1 , wherein at least one set of contextual attributes for at least one particular data message flow comprises a threat level associated with an application that is a source of the particular data message flow.
4. The host computer of claim 3 further comprising a threat detecting engine for analyzing a set of parameters relating to a process that is a source of the particular data message flow, and generating the threat level based on the analysis.
5. The host computer of claim 4 , wherein the threat detecting engine forwards at least one parameter to an external process executing outside of the host computer and receives an analysis parameter from the external process in order to generate the threat level.
6. The host computer of claim 1 , wherein each of a plurality of sets of contextual attributes is associated with a different data message flow and comprises a user identifier associated with its associated data message flow.
7. The host computer of claim 6 , wherein the user identifiers are group identifiers.
8. The host computer of claim 7 , wherein the group identifiers are group identifiers in an active directory.
9. The host computer of claim 6 , wherein at least one user identifier identifies an individual user.
10. The host computer of claim 1 , wherein each of a plurality of machines is a virtual machine (VM).
11. The host computer of claim 1 , wherein each of a plurality of machines is a container.
12. The host computer of claim 1 , wherein the service engines include at least two of the following: firewall engine, load balancing engine, encryption engine, and process control engine.
13. A non-transitory machine readable medium storing a context engine for execution by at least one processing unit of a host computer that executes a plurality of machines and a plurality of service engines that enforce different sets of attribute-based service rules on data message flows associated with the machines, the context engine comprising sets of instructions for:
collecting contextual attributes for data message flows sent by the machines; and
providing sets of contextual attributes to service engines by (i) receiving identifiers associated with the data message flows from service engines requesting sets of contextual attributes for the data message flows from the context engine, and (ii) providing sets of contextual attributes associated with the identifiers to the service engines, wherein each of a plurality of sets of contextual attributes comprises one or more attributes other than layer 2 (L2), layer 3 (L3) and layer 4 (L4) data-message header values, and at least one set of contextual attributes for at least one particular data message flow comprises an application identifier (AppID) that specifies a type of traffic contained in the particular data message flow, said service engines using the sets of contextual attributes provided by the context engine to identify and enforce a set of one or more attribute-based service rules for the data message flows.
14. The non-transitory machine readable medium of claim 13 , wherein a deep packet inspection engine executing on the host computer analyzes the data messages of the particular data message flow and generates the AppID based on the analysis.
15. The non-transitory machine readable medium of claim 13 , wherein a threat detecting engine analyzes a set of parameters relating to a process that is a source of the particular data message flow, and generates a threat level based on the analysis.
16. The non-transitory machine readable medium of claim 13 , wherein the service engines include at least two of the following: firewall engine, load balancing engine, encryption engine, and process control engine.