Automated enforcement of security policies in cloud and hybrid infrastructure environments
To prevent un-authorized accesses to data and resources available in workloads on an organization's or enterprise's computer network, various improvements to automated computer network security processes to enable them to enforce network security policies using native network security mechanisms to control communications to and/or from workload units of applications running on different nodes within hybrid computer network infrastructures having both traditional hardware resources and virtual resources provided by private and public cloud infrastructure services.
1. In a computer network comprised of plurality of interconnected computing nodes, each node running at least one work load unit of an application workload and at least one network security mechanism for controlling data flows to the interconnected computing nodes of the computer network, a computer implemented method for enforcing a plurality of security policies for the computer network using the network security mechanism, the method executing on or more computers in communication with the network and comprising:
for each of at least one infrastructure resources of an infrastructure service provider,
assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider, each attribute comprising a key and value for the key using information, and
selecting the infrastructure resource as a member of in one or more logical groups using the one or more attributes; and
computing a configuration for the at least one network security mechanism using the plurality of security policies and the infrastructure resources that are members of each of the logical groups to which each of the plurality of security policies applies;
wherein assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider comprises obtaining a predefined list of attributes to which an owner of the infrastructure resource has access and, for each attribute on the list, checking whether the attribute is mapped to a property or tag received from an infrastructure service provider, and whether, using the information from the infrastructure service provider, the infrastructure resource satisfies the resource property or tag.
2. In a computer network comprised of plurality of interconnected computing nodes, each node running at least one work load unit of an application workload and at least one network security mechanism for controlling data flows to the interconnected computing nodes of the computer network, a computer implemented method for enforcing a plurality of security policies for the computer network using the network security mechanism, the method executing on or more computers in communication with the network and comprising:
for each of at least one infrastructure resources of an infrastructure service provider,
assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider, each attribute comprising a key and value for the key using information, and
selecting the infrastructure resource as a member of in one or more logical groups using the one or more attributes; and
computing a configuration for the at least one network security mechanism using the plurality of security policies and the infrastructure resources that are members of each of the logical groups to which each the plurality of security policies applies;
wherein assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider comprises determining whether the infrastructure resource is allowed to use the attribute before being assigned the attribute.
3. The method of claim 2 , wherein assigning one or more attributes to the infrastructure resource further comprises requesting permission for the infrastructure resource to use the attribute.
4. In a computer network comprised of a plurality of interconnected computing nodes, each node running at least one work load unit of an application workload and at least one network security mechanism for controlling data flows to the interconnected computing nodes of the computer network, a computer implemented method for enforcing a plurality of security policies for the computer network using the network security mechanism, the method executing on or more computers in communication with the network and comprising:
for each of at least one infrastructure resources of an infrastructure service provider,
assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider, each attribute comprising a key and value for the key using information, and
selecting the infrastructure source as a member of in one or more logical groups using the one or more attributes; and
computing a configuration for at least one network security mechanism using the plurality of security policies and the infrastructure resources that are members of each of the logical groups to which each the plurality of security policies applies;
wherein assigning one or more attributes to the infrastructure resource comprises determining whether the infrastructure resource is constrained by a constraint rule from using an attribute before being assigned the attribute.
5. The method of claim 1 , wherein each of the security policies specifies a plurality of rules specified with logical objects.
6. In a computer network comprised of plurality of interconnected computing nodes, each node running at least one work load unit of an application workload and at least one network security mechanism for controlling data flows to the interconnected computing nodes of the computer network, a computer implemented method for enforcing a plurality of security policies for the computer network using the network security mechanism, the method executing on or more computers in communication with the network and comprising:
for each of at least one infrastructure resources of an infrastructure service provider,
assigning one or more attributes to the infrastructure resource using information from the infrastructure service provider, each attribute comprising a key and value for the key using information, and
selecting the infrastructure resource as a member of in one or more logical groups using the one or more attributes; and
computing a configuration for the at least one network security mechanism using the plurality of security policies and the infrastructure resources that are members of each of the logical groups to which each the plurality of security policies applies;
wherein each of the at least two of the workloads is running on a virtual computer hosted on a different one of a plurality of different infrastructure service providers, and wherein the at least one security mechanism includes a native security mechanism on each of the plurality infrastructure service providers.
7. In an enterprise computer network comprised of plurality of interconnected computing nodes and a plurality of infrastructure resources used by a plurality of organizations within the enterprise, each node running at least one work load unit of an application workload, a computer implemented method for enforcing a plurality of enterprise-level security policies for the computer network while permitting organizations within the enterprise to deploy security policies, the method comprising:
in response to receiving a proposed security policy created by one of the plurality of organizations and containing a plurality of proposed rules, checking each proposed rule against each rule in a constraint policy that specifies rules for the one of the plurality organizations that has created the proposed rule; and
ignoring rules determined to be not allowed and enforcing the rules determined to be allowed by the constraint policy, wherein enforcing comprises computing a configuration for at least one security mechanism using the allowed rules;
wherein the proposed security policy targets at least one logical group and is specified using logical objects, the logical group containing as members infrastructure resources selected from the plurality of infrastructure resources using attributes assigned to the infrastructure resources; and
wherein the constraint policy defines a scope of infrastructure resources to which the rules within the constraint policy apply.
8. The method of claim 7 , further comprising getting the logical group that is the target of the proposed security policy and the scope of infrastructure resources for the constraint policy and checking for violations between members of the logical group and members of the infrastructure resources scope.
9. The method of claim 8 , wherein checking a proposed rule comprises determining whether all resources within the logical group are within the scope of infrastructure resources of an allow rule in the constraint policy.
10. The method of claim 9 , wherein checking a proposed rule further comprises determining whether the proposed rule and the allow rule of the constraint policy rule have the same direction and protocol for communications.
11. The method of claim 9 , wherein checking a proposed rule further comprises getting a target logical group for the proposed rule and a target resource scope for the allow rule and determining whether all of the infrastructure resources within the target logical group of the proposed rule are contained within the infrastructure resources scope of the allow rule.
12. The method of claim 8 , wherein checking a proposed rule comprises determining whether any resources within the logical group for the security policy are within the scope of infrastructure resources of a block rule.
13. The method of claim 12 , wherein checking a proposed rule comprises determining whether any resources within the logical group for the security policy are within the scope of infrastructure resources of a block rule occurs after determining whether all resources within the logical group are within the scope of infrastructure resources of an allow rule in the constraint policy.
14. The method of claim 12 wherein checking a proposed rule further comprises getting a target logical group for the proposed rule and a target resource scope for the block rule and determining whether any of the infrastructure resources within the target logical group of the proposed rule are contained within the infrastructure resources scope of the block rule.
15. In an enterprise computer network used by a plurality of organizations within the enterprise and comprised of a of interconnected computing nodes and a plurality of infrastructure resources, each node running at least one work load unit of an application workload, a computer implemented method for enforcing a plurality of enterprise-level security policies for the computer network while permitting organizations within the enterprise to deploy security policies, the method executing on or more computers and comprising:
storing a constraint policy applicable to the organization, the constraint policy comprising a plurality of rules and defining a scope of infrastructure resources to which the rules within the constraint policy apply; and
checking a security policy created by one of the plurality of organizations for compliance with the constraint policy, the security policy containing a plurality of rules targeting at least one, predefined logical group containing as a member at least one of the plurality of infrastructure resources assigned an attribute used do select the at least one of the plurality of infrastructure resources as a member of the logical group;
wherein checking comprises comparing each rule in the security policy against each rule in the constraint policy and storing information identifying rules that do not comply.
16. The method of claim 15 , further comprising getting the logical group that is the target of the security policy and the scope of infrastructure resources for the constraint policy and checking for violations between members of the logical group and members of the scope of infrastructure resources.
17. The method of claim 15 , wherein checking a proposed rule comprises determining whether all resources within the logical group are within the scope of infrastructure resources of an allow rule in the constraint policy.
18. The method of claim 17 , wherein checking a proposed rule further comprises determining whether the proposed rule and the allow rule of the constraint policy rule have the same direction and protocol for communications.
19. The method of claim 17 , wherein checking a proposed rule further comprises getting a target logical group for the proposed rule and a target resource scope for the allow rule and determining whether all of the infrastructure resources within the target logical group of the proposed rule are contained within the infrastructure resources scope of the allow rule.
20. The method of claim 15 , wherein checking a proposed rule comprises determining whether any resources within the logical group for the security policy are within the scope of infrastructure resources of a block rule.
21. The method of claim 20 , wherein checking a proposed rule comprises determining whether any resources within the logical group for the security policy are within the scope of infrastructure resources of a block rule occurs after determining whether all resources within the logical group are within the scope of infrastructure resources of an allow rule in the constraint policy.
22. The method of claim 20 wherein checking a proposed rule further comprises getting a target logical group for the proposed rule and a target resource scope for the block rule and determining whether any of the infrastructure resources within the target logical group of the proposed rule are contained within the infrastructure resources scope of the block rule.
23. The method of claim 1 , wherein assignment of the one or more attributes is based on an infrastructure tag received from an infrastructure service provider for the infrastructure resource.
24. The method of claim 1 , wherein the assignment of one or more of the one or more attributes is based on a property of the infrastructure resource.
25. The method of claim 1 , further comprising, for each of the at least one infrastructure resources, assigning an attribute to the infrastructure resource based on membership in at least one logical group.
26. The method of claim 1 , wherein computing a configuration is based on the security policies defined for each of the logical groups and the attributes of the infrastructure resources that are members of the logical groups.