Patent ID: 11936621
Assignee: THE BANK OF NEW YORK MELLON
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A method comprising:
obtaining, by a processor, a first set of firewall rules of a first firewall for a first instance of a distributed application, wherein a first set of services of a plurality of services of the first instance of the distributed application are executed on a first plurality of computers, wherein each firewall rule of the first set of firewall rules comprises a respective IP address and a respective port number of a respective port over which network traffic directed to a respective service at the respective IP address and the respective port number is to be communicated;
obtaining, by the processor, a second set of firewall rules of a second firewall for a second instance of the distributed application, wherein a second set of services of a plurality of services of the second instance of the distributed application are executed on a second plurality of computers, wherein each firewall rule of the second set of firewall rules comprises a respective IP address and a respective port number of a respective port over which network traffic directed to a respective service at the respective IP address and the respective port number is to be communicated;
obtaining, by the processor, a mapping of IP addresses to identifiers of services from amongst the first set of services and the second set of services;
determining, by the processor, based on the first set of firewall rules and the second set of firewall rules and the mapping, respectively, (i) a first set of IP addresses authorized to communicate with the first set of services and a first set of port numbers of respective first ports over which communications between a respective IP address from the first set of IP addresses and a respective service from the first set of services are transmitted, and (ii) a second set of IP addresses authorized to communicate with the second set of services and a second set of port numbers of respective second ports over which communications between a respective IP address from the second set of IP addresses and a respective service from the second set of services are transmitted;
generating, by the processor, first connectivity data and second connectivity data indicating, for each of the first set of IP addresses and each of the second set of IP addresses, respectively, a respective port number from the first set of port numbers over which communications between a respective IP address from the first set of IP addresses and a respective service from the first set of services are transmitted, and a respective port number from the second set of port numbers over which communications between a respective IP address from the second set of IP addresses and a respective service from the second set of services are transmitted; and
generating, by the processor, first comparison data based on a first comparison of the first connectivity data and the second connectivity data, wherein the first comparison data indicates whether firewall drift is detected for at least one of the first set of firewall rules or the second set of firewall rules.