Internal controls engine and reporting of events generated by a network or associated applications

• US 10,699,026 B2
• Filed: 08/30/2018
• Issued: 06/30/2020
• Est. Priority Date: 06/02/2015
• Status: Active Grant

• Current Assignee: Altr Solutions, Inc.
• Original Assignee: Altr Solutions, Inc.
• Inventors: Goldfarb, Scott Nathaniel, Struttmann, Christopher Edward, Beecham, James Douglas, Martin, Gordon Earl
• Primary Examiner(s): Plecha, Thaddeus J
• Application Number:
  US16/117,859
• Publication Number:
  US 20190018975A1
• Time in Patent Office: 670 Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Provided is a process including: obtaining, with a network controls engine, network traffic, wherein: the network traffic is sent across the network between source computing devices and destination computing devices; at least one of the source or destination computing devices are on a network carrying the network traffic; and the network has a plurality of computing devices causing the network traffic and which are assigned addresses on the network; applying, with the network controls engine, a plurality of rules to the network traffic to identify rules with criteria satisfied by the network traffic; and causing, with the network controls engine, one or more actions prescribed by one or more identified rules with criteria satisfied by the network traffic.

Claims

1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with one or more processors, with a network controller, a current state of a network, wherein;

the network has a plurality of computing devices accessed by a plurality of users;

the network is configured to provide network connectivity defined by a network graph;

the network graph includes vertices corresponding to the users or computing devices;

the network graph includes edges between respective pairs of the vertices and specifying permitted network communications between the users or computing devices corresponding to the respective pairs of vertices; and

the network controller is operative to effectuate changes to the network graph by enforcing, and removing or adding permitted pair-wise connections between the users or computing devices;

causing, with one or more processors, with the network controller, a graphical user interface to be presented that depicts at least part of the network graph, the graphical user interface comprising a first region by which a dropped icon in the region indicates network connections are to be permitted, a second region within the graphic user interface by which a dropped icon in the region indicates network connections are to be prohibited, and user-inputs by which a user requests changes to the network graph, wherein the user-inputs include a drag and drop input by which a user selects an icon representing a vertex, selects another icon representing another vertex, and moves the icon representing the other vertex into a given region of the graphical user interface that indicates an edge between the vertex and the other vertex in the network graph is to be modified;

receiving, with one or more processors, with the network controller, a request input via the graphical user interface to modify the network graph; and

in response to the request, modifying, with one or more processors, with the network controller, the network graph and enforcing the modification.

2. The medium of claim 1, wherein:

the network is a packet-based network configured to perform packet forwarding and routing across multiple hops between pairs of the computing devices; and

the graphical user interface is a web-based graphical user interface or a native application graphical user interface presented on the network controller or on another computing device by which the network controller is accessed.

3. The medium of claim 1, wherein:

prior to the request, the network graph specifies that a given pair of computing devices are prohibited from communicating with one another via the network;

the request specifies that the given pair of computing devices are to be permitted to communicate with one another via the network;

modifying the network graph comprises adding an edge or modifying an attribute of an edge between a vertex representing one of the given pair of computing devices and another vertex representing another one of the given pair of computing devices; and

enforcing the modification comprises sending an instruction that causes a network switch to modify an IPTable or forwarding table to permit the given pair of computing devices to communicate.

4. The medium of claim 1, wherein enforcing the modification comprises:

modifying, or causing modifying of, an IPTable rule on a virtual-private network (VPN) server through which network traffic flows to an extent permitted by the network graph between computing devices corresponding to at least two vertices.

5. The medium of claim 1, wherein enforcing the modification comprises:

configuring a rule applied to network traffic by a userspace program registered in an operating system to make packet routing decisions as an NFQUEUE controller.

6. The medium of claim 5, wherein:

the operating system is an operating system of a virtual private network server.

7. The medium of claim 5, wherein:

the operating system is an operating system of a computing device corresponding to a vertex to which the modification applies.

8. The medium of claim 1, wherein enforcing the modification comprises:

modifying or creating, or causing modifying or creating of, a rule or other policy of a third-party application to define or control access to a network-connectable resource via an application-program interface of the third-party application.

9. The medium of claim 1, wherein enforcing the modification comprises:

modifying or creating a rule or policy accessible to, or created by, a third-party application to define or control access to a network element forward table.

10. The medium of claim 1, wherein enforcing the modification comprises:

modifying, or causing modifying of, a forwarding table by which a virtual-private network local area network service (VPLS) communicates at least some packets.

11. The medium of claim 1, wherein enforcing the modification comprises:

modifying, or causing modifying of, a Multiprotocol Label Switching (MPLS) setting that specifies a path between computing devices.

12. The medium of claim 1, wherein the operations comprise:

storing the modification in a cryptographically tamper-evident, immutable data store.

13. The medium of claim 1, wherein the operations comprise:

determining that a user or computing device corresponding to a vertex is attempting to access another vertex for which access is prohibited by the network graph; and

in response, prevent the attempted access and logging the attempt to a cryptographically tamper-evident, immutable data store.

14. The medium of claim 1, wherein:

the graphical user interface comprises an input by which a group of edges of the network graph are selected concurrently for a given modification.

15. The medium of claim 1, wherein:

the graphical user interface is a graphical user interface by which software defined networking settings or software defined access for controlling network routing and rules are configured.

16. The medium of claim 1, wherein at least one computing device among the plurality of computing devices of the network is configured to selectively forward packets through the network by performing operations comprising:

receiving a first packet along a multi-hop route through the network;

accessing a first rule configured by a command from the network controller;

determining based on the first rule to not forward the first packet to a computing device to which the packet is addressed by a value in a header of the first packet;

receiving a second packet along a multi-hop route through the network;

accessing a second rule configured by a command from the network controller; and

determining based on the second rule to forward the second packet to a computing device to which the packet is addressed by a value in a header of the second packet.

17. A method, comprising:

obtaining, with a computer system, with a network controller, a current state of a network, wherein;

the network has a plurality of computing devices accessed by a plurality of users;

the network is configured to provide network connectivity defined by a network graph;

the network graph includes vertices corresponding to the users or computing devices;

the network graph includes edges between respective pairs of the vertices and specifying permitted network communications between the users or computing devices corresponding to the respective pairs of vertices; and

the network controller is operative to effectuate changes to the network graph by enforcing, and removing or adding permitted pair-wise connections between the users or computing devices;

causing, with the computer system, with the network controller, a graphical user interface to be presented that depicts at least part of the network graph, the graphical user interface comprising a first region by which a dropped icon in the region indicates network connections are to be permitted, a second region within the graphic user interface by which a dropped icon in the region indicates network connections are to be prohibited, and user-inputs by which a user requests changes to the network graph, wherein the user-inputs include a drag and drop input by which a user selects an icon representing a vertex, selects another icon representing another vertex, and moves the icon representing the other vertex into a given region of the graphical user interface that indicates an edge between the vertex and the other vertex in the network graph is to be modified;

receiving, with the computer system, with the network controller, a request input via the graphical user interface to modify the network graph; and

in response to the request, modifying, with the computer system, with the network controller, the network graph and enforcing the modification.

18. The method of claim 17, wherein:

the network is a packet-based network configured to perform packet forwarding and routing across multiple hops between pairs of the computing devices; and

the graphical user interface is a web-based graphical user interface or a native application graphical user interface presented on the network controller or on another computing device by which the network controller is accessed.

19. The method of claim 17, wherein:

prior to the request, the network graph specifies that a given pair of computing devices are prohibited from communicating with one another via the network;

the request specifies that the given pair of computing devices are to be permitted to communicate with one another via the network;

modifying the network graph comprises adding an edge or modifying an attribute of an edge between a vertex representing one of the given pair of computing devices and another vertex representing another one of the given pair of computing devices; and

enforcing the modification comprises sending an instruction that causes a network switch to modify an IPTable or forwarding table to permit the given pair of computing devices to communicate.

20. The method of claim 17, wherein enforcing the modification comprises:

modifying, or causing modifying of, an IPTable rule on a virtual-private network (VPN) server through which network traffic flows to an extent permitted by the network graph between computing devices corresponding to at least two vertices.

21. The method of claim 17, wherein enforcing the modification comprises:

configuring a rule applied to network traffic by a userspace program registered in an operating system to make packet routing decisions as an NFQUEUE controller.

22. The method of claim 21, wherein:

the operating system is an operating system of a virtual private network server.

23. The method of claim 21, wherein:

the operating system is an operating system of a computing device corresponding to a vertex to which the modification applies.

24. The method of claim 17, wherein enforcing the modification comprises:

modifying or creating, or causing modifying or creating of, a rule or other policy of a third-party application to define or control access to a network-connectable resource via an application-program interface of the third-party application.

25. The method of claim 17, wherein enforcing the modification comprises:

modifying or creating a rule or policy accessible to, or created by, a third-party application to define or control access to a network element forward table.

26. The method of claim 17, wherein enforcing the modification comprises:

modifying, or causing modifying of, a forwarding table by which a virtual-private network local area network service (VPLS) communicates at least some packets.

27. The method of claim 17, wherein enforcing the modification comprises:

modifying, or causing modifying of, a Multiprotocol Label Switching (MPLS) setting that specifies a path between computing devices.

28. The method of claim 17, comprising:

storing the modification in a cryptographically tamper-evident, immutable data store.

29. The method of claim 17, comprising:

determining that a user or computing device corresponding to a vertex is attempting to access another vertex for which access is prohibited by the network graph; and

in response, prevent the attempted access and logging the attempt to a cryptographically tamper-evident, immutable data store.

30. The method of claim 29, wherein:

the graphical user interface comprises an input by which a group of edges of the network graph are selected concurrently for a given modification.

31. The method of claim 17, wherein:

the graphical user interface is a graphical user interface by which software defined networking settings or software defined access for controlling network routing and rules are configured.

32. The method of claim 17, wherein at least one computing device among the plurality of computing devices of the network is configured to selectively forward packets through the network by performing operations comprising:

receiving a first packet along a multi-hop route through the network;

accessing a first rule configured by a command from the network controller;

determining based on the first rule to not forward the first packet to a computing device to which the packet is addressed by a value in a header of the first packet;

receiving a second packet along a multi-hop route through the network;

accessing a second rule configured by a command from the network controller; and

determining based on the second rule to forward the second packet to a computing device to which the packet is addressed by a value in a header of the second packet.