Infrastructure-agnostic network-level visibility and policy enforcement for containers
US10805166B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 24, 2019 |
| Grant date | Oct 13, 2020 |
| Priority date | — |
| Expiry date | Sep 24, 2039 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L43/028
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
An enforcement mechanism on an operating system instance enforces a segmentation policy on a container. A configuration generation module executing in a host namespace of the operating system instance receives management instructions from a segmentation server for enforcing the segmentation policy on a container. The configuration generation module executes in the host namespace to configure a traffic control and monitoring module in a container namespace associated with the container. The traffic control and monitoring module in the container namespace controls and monitors communications to and from the container in accordance with its configuration. By executing a configuration generation module in the host namespace to configure traffic control and monitoring module in the container namespace, the enforcement mechanism beneficially enables robust and lightweight enforcement in a manner that is agnostic to different containerization protocols.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.