Patent ID: 11924165
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 17:
18. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
deploying a security entity to a new application container into a path of application layer network traffic in a container environment for securing all network traffic types, wherein the security entity is transparently inserted into the path of all application layer network traffic for ingress, egress, and east-west flows without modification of the flows and without using a sidecar container or IP tables by performing the following:
generating a new network namespace associated with the security entity on a node in the container environment; and
moving a side interface of the node to the new network namespace associated with the security entity and create a new pair of interfaces between the new network namespace and a network namespace associated with the application container, wherein the new pair of interfaces between the new network namespace associated with the security entity and the network namespace associated with the application container facilitate performing inline security in the container environment to detect and prevent threats traveling between namespace boundaries; and

monitoring all traffic to and from the application container using the security entity to enforce a security policy.