Abstract:
Some embodiments include methods comprising: writing entries in a forwarding table of a switch through an application programming interface (API) of the switch, such that first data packets from a first host and directed to a second host are forwarded by the switch to an enforcement point; receiving the first data packets; forwarding the first data packets to the enforcement point using the forwarding table; determining whether the first data packets violate a high-level security policy using a low-level rule set; configuring the forwarding table through the API such that second data packets are forwarded by the switch to the second host, in response to determining the first data packets do not violate the security policy; configuring the forwarding table through the API such that the second data packets are dropped or forwarded to a security function by the switch, in response to the determining.

Description:
FIELD OF THE INVENTION 
       [0001]    The present technology is generally directed to computer security, and more specifically, but not by way of limitation, to computer network security. 
       SUMMARY 
       [0002]    Some embodiments include methods comprising: writing, by a policy engine, entries in a forwarding table of a switch through an application programming interface (API) of the switch, such that first data packets from a first host and directed to a second host are forwarded by the switch to an enforcement point; receiving, by the switch, the first data packets; forwarding, by the switch, the first data packets to the enforcement point using the forwarding table; determining, by the enforcement point, whether the first data packets violate a high-level security policy using a low-level rule set; configuring, by the enforcement point, the forwarding table through the API such that second data packets are forwarded by the switch to the second host, in response to determining the first data packets do not violate the security policy; configuring, by the enforcement point, the forwarding table through the API such that the second data packets are dropped or forwarded to a security function by the switch, in response to determining the first data packets violate the security policy; receiving, by the switch, second data packets; and selectively dropping or forwarding the second data packets, by the switch, in accordance with the configuration. 
         [0003]    Various embodiments include systems comprising: a data network; a plurality of hosts communicatively coupled to the data network; a switch communicatively coupled to the data network, including a forwarding table and an application programming interface (API); an enforcement point communicatively coupled to the data network; and a policy engine communicatively coupled to the data network, wherein the system performs a method comprising: writing, by the policy engine, entries in the forwarding table of the switch through the application programming interface (API), such that first data packets from a first host and directed to a second host are forwarded by the switch to the enforcement point; receiving, by the switch, the first data packets; forwarding, by the switch, the first data packets to the enforcement point using the forwarding table; determining, by the enforcement point, whether the first data packets violate a high-level security policy using a low-level rule set; configuring, by the enforcement point, the forwarding table through the API such that second data packets are forwarded by the switch to the second host, in response to determining the first data packets do not violate the security policy; configuring, by the enforcement point, the forwarding table through the API such that the second data packets are dropped or forwarded to a security function by the switch, in response to determining the first data packets violate the security policy; receiving, by the switch, second data packets; and selectively dropping or forwarding the second data packets, by the switch, in accordance with the configuration. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0004]      FIG. 1  is a simplified block diagram illustrating a system according to some embodiments. 
           [0005]      FIG. 2  is a simplified block diagram illustrating another system in accordance with some embodiments. 
           [0006]      FIG. 3  is a simplified flowchart of an example method of the present technology according to various embodiments. 
           [0007]      FIG. 4  illustrates an example computer system in accordance with various embodiments. 
       
    
    
     DETAILED DESCRIPTION 
       [0008]    An exemplary system according to the present technology operates when new connections are being made, by pushing the decision regarding the connection to a higher level for inspection, and evaluating the new connections for allowance. These new connections are implemented by the switch in each server/rack. A switch has a forwarding table, which implements a rule. In an exemplary system, all initial traffic between nodes that have not communicated before is to not communicate without first forwarding to distributed security processor. This is the default rule and provides the basic level of security, since the distributed security processor has to approve all connections. 
         [0009]    An exemplary system may use an enforcement point (EP) operating in the switch or associated with the switch, which sends communications to the distributed security processor. This communication may be via a tunneling system, for example, a Virtual Extensible Local Area Network (VXLAN). The distributed security processor checks the policy, validates expected protocol behavior, and after approving the communication, forwards the first several packets to the intended recipient node. Next, the distributed security processor programs the switch to allow future communications from the first port to the second port (also referred to or alternatively may be: a node, a communication node, a virtual machine, a container, and a host). Additionally, the sender and recipient in this and all other examples may be on the same server controlled by the same switch, different servers controlled by the same switch, or may be on different servers controlled by different switches. 
         [0010]    In an exemplary system according to the present technology, the initial forwarding table includes a default routing rule to first send all communications to the distributed security processor, which is later rewritten to allow communications directly controlled by the switch without intervention by the distributed security processor. Certain information in a packet header will prompt a re-forwarding to the distributed security processor. For example, if a Transmission Control Protocol (TCP) header includes information relating to setting up and/or tearing down a connection, then the distributed security processor is consulted to review the communication, and distributed security processor approval is required. For example, a TCP header including SYN, FIN, and/or RST, relating to the setting up or tearing down of connections, might require the distributed security processor approval. Actions of the distributed security processor may be logged to allow review and enforcement, as well as policy revision. 
         [0011]      FIG. 1  is a block diagram illustrating system  100  according to an example embodiment. System  100  may be a cloud server environment, which may be a public cloud, private cloud, an intranet, or any other appropriate network. System  100  includes a policy engine  190 , which may enable an Information Technology (IT) or security administrator to implement security policies in system  100 . These policies may include, for example, prohibitions against high value assets from communicating with high risk assets, or production machines from communicating with test/development machines. These policies may also include failover policies, or any other appropriate prohibition, limitation or policy. 
         [0012]    Policy engine  190  may communicate bilaterally with distributed security processor  180 , which may operate to implement the policies. Additionally, policy engine  190  may communicate bilaterally with switch  125  via Application Programming Interface (API)  135  associated with switch  125  to implement the policies. API  135  includes a set of routines, protocols, and/or tools for building software applications for switch  125 . API  135  may express a software component in terms of its operations, inputs, outputs, and underlying types. Alternatively or additionally, API  135  may be a software development kit (SDK or “devkit”), which includes a set of software development tools that allows the creation of applications for switch  135 . Distributed security processor  180  may communicate computer executable instructions to API  135 . System  100  may include many assets  140 - 145 , with a similar or different structure from each other. Each of assets  140 - 145  may be coupled to some or all of the other of assets  140 - 145  in system  100  via network  110 . At least some of assets  140 - 145  may also be coupled via network  110  to the internet, an intranet, or any other appropriate network. 
         [0013]    In some embodiments, assets  140 - 145  are at least one of a virtual machine (VM), physical host, workload, server, cloud-based virtual machine, client, workload, enforcement target, and the like. Each of assets  140 - 145  is communicatively coupled with switch  125 , which may operate to control communications into and out of assets  140 - 145 , and between assets  140 - 145 . For example, one or more of assets  140 - 145  include a VM. The virtual machines may operate as part of a hypervisor. Alternatively, different virtual machine systems may be used, for example, containers. 
         [0014]    In operation, policy engine  190  communicates with API  135 , to program forwarding table  160  of switch  125 . The initial programming is the default programming, and indicates to forward any communication which has not previously been approved by distributed security processor  180  (which is all communications in the initial default situation) to distributed security processor  180 . Next, asset  140  may attempt to communicate, by communication  150 , to virtual machine (VM)  143 . Switch  125  checks forwarding table  160  prior to allowing the communication, and since no approval indication exists there, switch  125  forwards the packets to distributed security processor  180  via tunnel  170 . Tunnel  170  may be through a fabric of the data center of system  100 , and may be a VXLAN communication path. 
         [0015]    In some embodiments, policy engine  190  communicates with API  135 , to program forwarding table  160  of switch  125 . The initial programming is the default programming, and indicates to forward communication requiring processing by distributed security processor  180  (which is all communications in the initial default situation) to distributed security processor  180 . Next, asset  140  may attempt to communicate, by communication  150 , to virtual machine (VM)  143  using a protocol defined within the security policy applied to switch  125 . Switch  125  checks forwarding table  160  prior to allowing the communication, and since no approval indication exists there, switch  125  forwards the packets to distributed security processor  180  via tunnel  170 . Tunnel  170  may be through a fabric of the data center of system  100 , and may be a VXLAN communication path. In this manner, it is possible for an administrator to ‘tune’ the traffic types requiring security processing within the network. 
         [0016]    In various embodiments, the next step is for distributed security processor  180  to perform security checks on the communication and the sender and recipient nodes against policy provided by policy engine  190 . The following step is, if the connection is approved, to forward the communication to VM  143 , and to program a forwarding entry in forwarding table  160  of switch  125  for communications between asset  140  and asset  143 . In this manner, subsequent communications between asset  140  and asset  143  may be handled by switch  125  without the assistance of distributed security processor  180 , thereby optimizing communication and reducing resource load. However, some trigger events will cause the forwarding table to revert to a default position for a particular routing instruction, or for all routing instructions. The trigger event is also referred to herein as a condition, and may relate to a packet header, and/or changing of a connection between nodes. 
         [0017]    If distributed security processor  180  performs a security check on the initial communication and the sender and recipient nodes against policy, and determines that the communication is prohibited or suspect in any manner, distributed security processor  180  may redirect the communication to a honeypot, redirect the communication to a tarpit, drop the packets, and may forward the packets without writing to forwarding table  160 , so that future packets are also routed to distributed security processor  180 , thereby providing inspection, logging, and security information to an IT administrator or security expert. 
         [0018]    In an exemplary embodiment illustrated in  FIG. 2 , a physical programmable switch—for example, a merchant silicon (or custom ASIC) networking switch—for low-level packet forwarding, may be utilized. In this exemplary embodiment, the forwarding table is initially blank, and as in the previously described exemplary embodiment illustrated in  FIG. 1 , the nodes do not need to be on the same switch. 
         [0019]      FIG. 2  is a block diagram illustrating system  200  according to an example embodiment. System  200  may be a cloud server environment, which may be a public cloud, private cloud, an intranet, or any other appropriate network. System  200  includes policy engine  190 , which may enable an IT or security administrator to implement security policies in system  200 . Policy engine  190  may communicate bilaterally with distributed security processor  180 , which may operate to implement the policies. Additionally, policy engine  190  may communicate bilaterally with a switch  225 . 
         [0020]    Distributed security processor  180  may communicate computer executable instructions to API  235 . System  200  may include assets  240 - 245 , with a similar or different structure from each other. At least some of assets  240 - 245  may be coupled to some or all of the other of assets  240 - 245  in system  200  via network  110 . At least some of assets  240 - 245  may also be coupled via network  110  to the internet, an intranet, or any other appropriate network. 
         [0021]    Each of assets  240 - 245  is communicatively coupled to switch  225 , which may operate to control communications into and out of workloads  240 - 245 , and between workloads  240 - 245 . At least some of assets  240 - 245  may include one or more virtual machines. The virtual machines may operate as part of a hypervisor. Alternatively, different virtual machine systems may be used, for example containers. Additionally, at least one of assets  240 - 245  may include honeypot and/or tarpit virtual machines. A honeypot and a tarpit may operate as described above and herein. 
         [0022]    Switch  225  may include Application Programming Interface (API)  235  to implement the policies by programming forwarding table  260 . API  235  includes a set of routines, protocols, and/or tools for building software applications for switch  225 . API  235  may express a software component in terms of its operations, inputs, outputs, and underlying types. Alternatively or additionally, API  235  may be a software development kit (SDK or “devkit”), which includes a set of software development tools that allows the creation of applications for switch  225 . Switch  225  may also include enforcement point  280 , which communicates bilaterally through the fabric of system  200  with distributed security processor  180 . 
         [0023]    In operation, policy engine  190  communicates to switch  225 , to program forwarding table  260  of switch  225 . The initial programming is the default programming, and indicates to forward any communication which has not previously been approved by distributed security processor  180  (which is all communications in the initial default situation) to distributed security processor  180 . Next, asset  140  may attempt to communicate, by communication  150 , to asset  143 . Switch  225  checks forwarding table  260  prior to allowing the communication, and since no approval indication exists there, switch  225  forwards the packets to enforcement point  280  via a fabric  270 . Enforcement point  280  also exists virtually on switch  225 . 
         [0024]    In various embodiments, the next step is for enforcement point  280  to perform first security checks on the communication and the sender and recipient nodes against policy provided by distributed security processor  180  and policy engine  190 . The following step is, if the connection is approved, to forward the communication to asset  143 , and program via API  235  a forwarding entry in forwarding table  260  of switch  225  for communications between asset  140  and asset  143 . In this manner, subsequent communications between asset  140  and asset  143  may be handled by switch  225  without the assistance of enforcement point  280 , thereby optimizing communication and reducing resource load. However, some trigger events will cause the forwarding table to revert to a default position for a particular routing instruction, or for all routing instructions. The trigger event is also referred to herein as a condition, and may relate to a packet header, and/or changing of a connection between nodes. 
         [0025]    If enforcement point  280  performs security checks on the initial communication and the sender and recipient nodes against policy and determines that the communication is prohibited or suspect in any manner, or even if the decision requires additional resources or a second level of security, enforcement point  280  may redirect the communication to distributed security processor  180  over the fabric  270  for a further determination on the acceptability of the communication between asset  140  and asset  143 . 
         [0026]    Distributed security processor  180  performs these second, higher level security checks on the communication and the sender and recipient nodes against policy provided by policy engine  190 . Additionally, security processor  180  may check the communication to ensure that protocol sessions are set up according to documented standards. This advantageously reduces the aperture for protocol attacks and ensures protocol relationships (e.g., above TCP such as between OSI layers  5 - 7 ) are established correctly. If distributed security processor  180  performs security checks on the initial communication and the sender and recipient nodes against policy and determines if the communication is prohibited or suspect in any manner, then distributed security processor  180  may redirect the communication to a honeypot, redirect the communication to a tarpit, may drop the packets, may forward the packets without writing to forwarding table  260 , so that future packets are also routed to distributed security processor  180 , thereby providing inspection, logging, and security information to an IT administrator or security expert. 
         [0027]    If distributed security processor  180  performs these second, higher level security checks on the communication and the sender and recipient nodes and approves the connection, then distributed security processor  180  may forward the communication to VM  143 , either directly, or by instructing enforcement point  280  to forward the communication to VM  143 . Additionally, distributed security processor  180  may direct enforcement point  280  to program, via API  235 , the forwarding entry in forwarding table  260  of switch  225  for communications between asset  140  and asset  143 . In this manner, subsequent communications between asset  140  and asset  143  may be handled by switch  225  without the assistance of enforcement point  280 , thereby optimizing communication and reducing resource load. In still another alternative, distributed security processor  180  may authorize enforcement point  280  to handle communications of this type for new, future connections, or even to not program forwarding table  260  for this connection, so that new, future communications are monitored at an intermediate level of security. 
         [0028]    As discussed previously, some trigger events will cause the forwarding table to revert to a default position for a particular routing instruction, or for all routing instructions. The trigger event is also referred to herein as a condition, and may relate to a packet header, and/or changing of a connection between nodes. 
         [0029]    In exemplary embodiments of the present technology, the initiation of communications between nodes is an event requiring higher scrutiny, and this policy is implemented by having the default forwarding table include no entry. The communication is forwarded to an EP directly, to an EPI directly, or to an EP via an EPI, across a tunnel or a fabric of a network. The EP and/or EPI checks policy, and may determine to allow the communication, in which case an EPI may be programmed, and the forwarding table is updated to enable the communication between the nodes. This policy is applied to future communications, unless a trigger condition is met. A distinction between the model of system  100  ( FIG. 1 ) and the model of system  200  ( FIG. 2 ) is that small changes, for example, flag changes, may be handled by an EPI without involving the EP, thus improving efficiency. In all cases, logging may be sent across the fabric to the EP and/or the policy engine, and/or another user interface or reporting module. 
         [0030]    The switches described above, including switch  125  and switch  225 , may be in the physical environment. In alternative exemplary embodiments, the switch may be a virtual switch. 
         [0031]    Various exemplary embodiments of the present invention may enable the management of table resources on a switch for optimization. For example, if a switch is running out of free space, then connections can be aggregated in the forwarding table, or connections may be pushed to other resources for confirmation. 
         [0032]    In some embodiments, switch  225  is a hardware switch and at least one of assets  240 - 245  is a physical host. In various embodiments, switch  225  is a virtual switch and at least one of assets  240 - 245  is a virtual machine. 
         [0033]      FIG. 3  is a flowchart of an example method  300  for enforcing security policies for communicating between nodes of a switched network. Optional steps are shown with dashed lines. The method of  FIG. 3  includes optional operation  305 , which indicates to receive packets being communicated from a first node of the switched network to a second node of the switched network. From operation  305 , the method proceeds to operation  310 , which indicates to evaluate a policy to determine a forwarding decision for packets being communicated from the first node to the second node. From operation  310 , the method proceeds to operation  315 , which indicates to program a rewritable forwarding table of a switch based on the forwarding decision. From operation  315 , the method proceeds to optional operation  320 , which indicates to forward the packets from the first node to the second node. This step is optional since the prior non-optional steps  310  and  315  may be initiated at a start-up or other appropriate time, for instance a policy update, without the communication of packets. From operation  320 , the method proceeds to operation  325 , which indicates to enable future packets being communicated from the first node to the second node to be forwarded to the second node without the evaluating of the policy to determine the forwarding decision. In still further variations of the method, the policy may prohibit the communication being sought between the first and second nodes, in which case the communication may be dropped, logged, honey-potted, tarpitted, or all of the above. 
         [0034]      FIG. 4  illustrates an exemplary computer system  400  that may be used to implement some embodiments of the present disclosure. The computer system  400  of  FIG. 4  may be implemented in the contexts of the likes of computing systems, networks, servers, or combinations thereof. The computer system  400  of  FIG. 4  includes one or more processor unit(s)  410  and main memory  420 . Main memory  420  stores, in part, instructions and data for execution by processor unit(s)  410 . Main memory  420  stores the executable code when in operation, in this example. The computer system  400  of  FIG. 4  further includes a mass data storage  430 , portable storage device  440 , output devices  450 , user input devices  460 , a graphics display system  470 , and peripheral devices  480 . 
         [0035]    The components shown in  FIG. 4  are depicted as being connected via a single bus  490 . The components may be connected through one or more data transport means. Processor unit(s)  410  and main memory  420  are connected via a local microprocessor bus, and the mass data storage  430 , peripheral devices  480 , portable storage device  440 , and graphics display system  470  are connected via one or more input/output (I/O) buses. 
         [0036]    Mass data storage  430 , which can be implemented with a magnetic disk drive, solid state drive, or an optical disk drive, is a non-volatile storage device for storing data and instructions for use by processor unit(s)  410 . Mass data storage  430  stores the system software for implementing embodiments of the present disclosure for purposes of loading that software into main memory  420 . 
         [0037]    Portable storage device  440  operates in conjunction with a portable non-volatile storage medium, such as a flash drive, floppy disk, compact disk, digital video disc, or Universal Serial Bus (USB) storage device, to input and output data and code to and from the computer system  400  of  FIG. 4 . The system software for implementing embodiments of the present disclosure is stored on such a portable medium and input to the computer system  400  via the portable storage device  440 . 
         [0038]    User input devices  460  can provide a portion of a user interface. User input devices  460  may include one or more microphones, an alphanumeric keypad, such as a keyboard, for inputting alphanumeric and other information, or a pointing device, such as a mouse, a trackball, stylus, or cursor direction keys. User input devices  460  can also include a touchscreen. Additionally, the computer system  400  as shown in  FIG. 4  includes output devices  450 . Suitable output devices  450  include speakers, printers, network interfaces, and monitors. 
         [0039]    Graphics display system  470  includes a liquid crystal display (LCD) or other suitable display device. Graphics display system  470  is configurable to receive textual and graphical information and processes the information for output to the display device. 
         [0040]    Peripheral devices  480  may include any type of computer support device that adds additional functionality to the computer system. 
         [0041]    The components provided in the computer system  400  of  FIG. 4  are those typically found in computer systems that may be suitable for use with embodiments of the present disclosure and are intended to represent a broad category of such computer components that are well known in the art. Thus, the computer system  400  of  FIG. 4  can be a personal computer (PC), hand held computer system, telephone, mobile computer system, workstation, tablet, phablet, mobile phone, server, minicomputer, mainframe computer, wearable, or any other computer system. The computer may also include different bus configurations, networked platforms, multi-processor platforms, and the like. Various operating systems may be used including UNIX, LINUX, WINDOWS, MAC OS, PALM OS, QNX ANDROID, IOS, CHROME, TIZEN, and other suitable operating systems. 
         [0042]    The processing for various embodiments may be implemented in software that is cloud-based. In some embodiments, the computer system  400  is implemented as a cloud-based computing environment, such as a virtual machine operating within a computing cloud. In other embodiments, the computer system  400  may itself include a cloud-based computing environment, where the functionalities of the computer system  400  are executed in a distributed fashion. Thus, the computer system  400 , when configured as a computing cloud, may include pluralities of computing devices in various forms, as will be described in greater detail below. 
         [0043]    In general, a cloud-based computing environment is a resource that typically combines the computational power of a large grouping of processors (such as within web servers) and/or that combines the storage capacity of a large grouping of computer memories or storage devices. Systems that provide cloud-based resources may be utilized exclusively by their owners or such systems may be accessible to outside users who deploy applications within the computing infrastructure to obtain the benefit of large computational or storage resources. 
         [0044]    The cloud may be formed, for example, by a network of web servers that include a plurality of computing devices, such as the computer system  400 , with each server (or at least a plurality thereof) providing processor and/or storage resources. These servers may manage workloads provided by multiple users (e.g., cloud resource customers or other users). Typically, each user places workload demands upon the cloud that vary in real-time, sometimes dramatically. The nature and extent of these variations typically depends on the type of business associated with the user. 
         [0045]    The present technology is described above with reference to example embodiments. Therefore, other variations upon the example embodiments are intended to be covered by the present disclosure.