Abstract: A system includes a host network entity associated with a computing network. The host network entity may establish a first connection with a client network entity via a provisioner account in response to a connection request from a client network entity. The host network entity may receive a digital certificate from the client network entity via the first connection. The digital certificate may include an instruction set with a first instruction to generate an operator account for the client network entity. The host network entity may perform a validation of the digital certificate and the instruction set based on a public key associated with a certificate authority that is trusted by the host network entity, and responsive to the validation, the host network entity may generate the operator account based on the first instruction and establish a second connection with the client network entity via the operator account.

Abstract: Techniques are described for performing packet level data centric protection enforcement. Instead of being restricted to perimeter-based security and defining and creating rules that are difficult to maintain, techniques described herein allow users to create data-centric, intent-based policies that are enforced at different enforcement points within one or more networks. In some examples, a method comprises receiving a packet at an enforcement point (EP) within one or more networks that include a plurality of enforcement points (EPs); accessing enforcement data that indicates allowed communications between the EP and one or more other EPs, wherein the data are generated from a policy that specifies how traffic flows the one or more networks and a determination of possible data movements between at least two of EPs in the plurality of EPs; and enforcing the flow of the packet at the EP based on the data.