US 12,438,774 B2
Multi-layered policy management
Jun Du, Cupertino, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on May 3, 2023, as Appl. No. 18/142,799.
Application 18/142,799 is a continuation of application No. 16/731,678, filed on Dec. 31, 2019, granted, now 11,689,573.
Claims priority of provisional application 62/787,190, filed on Dec. 31, 2018.
Prior Publication US 2023/0275928 A1, Aug. 31, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G16Y 30/10 (2020.01); H04L 41/0631 (2022.01); H04L 41/0853 (2022.01); H04L 41/0894 (2022.01); H04L 41/22 (2022.01); H04L 67/12 (2022.01)
CPC H04L 41/0853 (2013.01) [G16Y 30/10 (2020.01); H04L 41/0631 (2013.01); H04L 41/0894 (2022.05); H04L 41/22 (2013.01); H04L 63/104 (2013.01); H04L 63/105 (2013.01); H04L 63/20 (2013.01); H04L 67/12 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system comprising:
a multi-level policy management engine configured to generate a multi-level policy for a network environment, wherein the multi-level policy includes a first policy at a low level of abstraction and a second policy at a high level of abstraction, and wherein the second policy at the high level of abstraction references an action to take if a particular activity is attempted by a device included in the network environment;
an Internet Protocol (IP) endpoint discovery and classification engine configured to:
discover, in the network environment, an Internet of Things (IoT) device which does not match at least one of the first or second policies, and classify the IoT device to make at least one of the first or second policies applicable to the IoT device, including by identifying that the IoT device does not have at least one of the first or second policies as an applicable policy, determining that the IoT device has violated at least one of the first or second policies, and in response, make the at least one of the first or second policies that has been violated applicable to the IoT device; and
a multi-level policy compliance detection engine configured to apply a set of multi-level policies to the IoT device based on the classification of the IoT device.