Systems and methods for creating and modifying access control lists

• US 10,728,251 B2
• Filed: 09/18/2017
• Issued: 07/28/2020
• Est. Priority Date: 09/05/2014
• Status: Active Grant

• Current Assignee: Catbird Networks, Inc.
• Original Assignee: Catbird Networks, Inc.
• Inventors: Rieke, Malcolm, Dennis, James Sebastian
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US15/707,989
• Publication Number:
  US 20180069865A1
• Time in Patent Office: 1,044 Days
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the present disclosure can present information on services hosted and used by various assets on a network, and allow users to control access to such services. In particular, embodiments of the disclosure may be used to present one or more services hosted by a network asset, and control access to such services by other network assets based on user input.

Claims

1. A computer-implemented method comprising:

collecting, by a computer system, data from a plurality of different types of sources on a network;

identifying, by the computer system based on the collected data, one or more services provided by a host network asset for use by a client network asset over the network into one or more respective logic zones for association with respective control policies; and

presenting to a user interface, a graphical representation that includes representations of;

the host network asset, the client network asset, the one or more services, and a flow information graph visually indicating a security vulnerability associated with one or more of the host network asset and the client network asset and with the one or more respective logic zones.

2. The method of claim 1, wherein presenting the graphical representation includes displaying which of the one or more services have been previously used by the client network asset and which of the one or more services have not been previously used by the client network asset.

3. The method of claim 1, wherein presenting the graphical representation includes presenting a flow information graph that depicts the host network asset, the client network asset, connections between the host network asset and the client network asset, services that are permitted to be accessed between the host network asset and the client network asset, and services that are not permitted to be accessed between the host network asset and the client network asset.

4. The method of claim 3, wherein the flow information graph visually indicates one or more of:

an attribute of the host network asset, an attribute of the client network asset, and an attribute of a connection between the host network asset and the client network asset.

5. The method of claim 4, wherein the flow information graph further depicts:

network data associated with one or more of host network asset and the client network asset; and

a system operational attribute associated with one or more of the host network asset and the client network asset.

6. The method of claim 3, wherein the flow information graph depicts connections between the host network asset and the client network asset using selectable directional flow lines.

7. The method of claim 6, wherein the flow lines indicate a type of the source of the collected data used to identify the connection.

8. The method of claim 3, wherein presenting the flow information graph includes:

visually indicating the identified security vulnerability in the flow information graph.

9. The method of claim 1, further comprising:

receiving, by the computer system via the user interface, input from a user that includes;

a selection of a service from the one or more services;

a selection permitting or rejecting access to the selected service by the client network asset; and

a selection of a second client network asset, wherein the second client network asset uses services from one of the host network asset and a second host network asset; and

in response to the input from the user, modifying access to the selected service by the client network asset over the network;

wherein the input from the user includes an annotation associated with the selected service, and wherein presenting the graphical representation includes displaying the annotation for the selected service.

10. The method of claim 9, wherein modifying access to the selected service includes restricting access by the client network asset to all services provided by the host network asset.

11. The method of claim 9, wherein modifying access to the selected service includes allowing access by the client network asset to all services provided by the host network asset.

12. The method of claim 9, wherein modifying access to the selected service includes selectively restricting access by a plurality of client network assets to all services provided by the host network asset based on a common attribute of each of the plurality of client network assets.

13. The method of claim 9, wherein modifying access to the selected service includes selectively allowing access by a plurality of client network assets to all services provided by the host network asset based on a common attribute of each of the plurality of client network assets.

14. The method of claim 1, wherein the collected data is obtained from a source selected from the group consisting of:

a NETFLOW IPFIX collector, a network tap, a router, a switch, a firewall, an intrusion detection system, an intrusion protection system, and combinations thereof.

17. The method of claim 1, wherein the input from the user includes a selection of one or more of:

network flow associated with the host asset and an attribute associated with the host asset.

18. The method of claim 1, wherein the control policies comprise a security technical control policy.

19. The method of claim 1, wherein the control policies comprise a logic zone membership policy.

20. The method of claim 1, wherein environmental events associated with one logic zone of the one or more respective logic zones are monitored in light of all of the control policies associated with the respective one or more logic zones.

15. A tangible, non-transitory computer-readable medium storing instructions that, when executed, cause a computer system to:

collect data from a plurality of different types of sources on a network;

identify, based on the collected data, one or more services provided by a host network asset for use by a client network asset over the network into one or more respective logic zones for association with respective control policies; and

present to a user interface, a graphical representation that includes representations of;

the host network asset, the client network asset, the one or more services, and a flow information graph visually indicating a security vulnerability associated with one or more of the host network asset and the client network asset and with the one or more respective logic zones.

16. A computer system comprising:

a processor; and

memory in communication with the processor and storing instructions that, when executed by the processor, cause the computer system to;

collect data from a plurality of different types of sources on a network;

identify, based on the collected data, one or more services provided by a host network asset for use by a client network asset over the network into one or more respective logic zones for association with respective control policies;

present to a user interface, a graphical representation that includes representations of;

the host network asset, the client network asset, the one or more services, and a flow information graph visually indicating a security vulnerability associated with one or more of the host network asset and the client network asset and with the one or more respective logic zones.