Patent ID: 11909766
Assignee: ILLUMIO, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method for managing a segmentation policy, the method comprising:
obtaining a segmentation policy comprising a set of rules for controlling traffic between workloads;
detecting a plurality of protected workloads that are members of a secure enclave protected by an enclave protection device such that traffic between the protected workloads and external workloads outside the secure enclave pass through the enclave protection device;
determining, from the segmentation policy, a set of cross-boundary rules pertaining to traffic between at least one of the protected workloads and at least one of the external workloads, wherein determining the set of cross-boundary rules comprises:
identifying a source label set and a destination label set specified by a segmentation rule of the segmentation policy;
identifying a first workload having the source label set and a second workload having the destination label set;
determining whether the first and second workloads are protected workloads or external workloads; and
responsive to either the first workload being a protected workload and the second workload being an external workload or the first workload being an external workload and the second workload being a protected workload, including the segmentation rule in the set of cross-boundary rules;

generating, from the set of cross-boundary rules, a configuration for the enclave protection device that causes the enclave protection device to permit the traffic meeting the set of cross-boundary rules, wherein generating the configuration for the enclave protection device comprises:
identifying, in the cross-boundary rules, a set of duplicate rules;
combining the duplicate rules into a combined rule; and
replacing the duplicate rules with the combined rule in the cross-boundary rules, the configuration for the enclave protection device being based on the combined rule; and

distributing the configuration to the enclave protection device to enable enforcement of the cross-boundary rules.