Method and system for communicating data to and from network security devices

• US 20030217292A1
• Filed: 03/24/2003
• Published: 11/20/2003
• Est. Priority Date: 04/04/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hirsh, Amir, Dejoras Mendoza, Kristine, Steiger, John Thomas, Schafrik, Robert Edward Jr.
• Granted Patent: US 7,484,097 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system for transmitting data from a computer network security device for monitoring at least one computer network node to an operations center for monitoring at least the computer network security device and to the computer network security device from the operations center in a managed computer network security system including at least the computer network security device and operations center, including establishing security information associated with the at least one computer network security device. The established security information is used to authenticate data transmissions from the computer network security device to the operations center. The established security information is used to authenticate data transmission to the computer network security device from the operations center.

Claims

1. A method for transmitting data from a computer network security device for monitoring at least one computer network node to an operations center for monitoring at least said computer network security device and to said computer network security device from said operations center in a managed computer network security system including at least said computer network security device and operations center, said method comprising:

establishing security information associated with said at least one computer network security device;

using said established security information to authenticate data transmissions from said computer network security device to said operations center; and

,

using said established security information to authenticate data transmission to said computer network security device from said operations center.

2. The method of claim 1, wherein said security information comprises a security key.

3. The method of claim 1, wherein said security information comprises a public/private key pairing.

4. The method of claim 1, wherein said establishing comprises generating a seed value.

5. The method of claim 1, wherein said establishing comprises generating a security key pairing.

6. The method of claim 5, further comprising communicating at least a portion of said key pairing to said operations center.

7. The method of claim 6, further comprising communicating an identification of said at least one computer network security device with said at least portion of said key pairing.

8. The method of claim 7, further comprising enrolling said communicated at least portion of said key pairing at said operations center.

9. The method of claim 7, further comprising checking if said key pairing has expired.

10. The method of claim 9, further comprising verifying a signature using said communicated at least portion of said key pairing has not expired.

11. The method of claim 10, further comprising querying a database using said communicated at least portion of said key pairing or communicated identification if said signature is verified.

12. The method of claim 11, further comprising overwriting at least a portion of data in said database if said querying returns data indicative of said computer network security device.

13. The method of claim 11, further comprising adding data to said database using said communicated at least portion of said key pairing.

14. The method of claim 13, wherein said adding data further uses said communicated computer network device identification.

15. The method of claim 1, further comprising gathering security log data to be transmitted from said computer network security device to said operations center.

16. The method of claim 15, wherein said using said established security information to authenticate data transmissions from said computer network security device to said operations center comprises creating a security signature using said security information.

17. The method of claim 16, wherein said using said established security information to authenticate data transmissions from said computer network security device to said operations center further comprises transmitting said gathered data and signature from said computer network security device.

18. The method of claim 17, wherein said using said established security information to authenticate data transmissions from said computer network security device to said operations center further comprises determining whether a timestamp associated with said signature has expired.

19. The method of claim 18, wherein said using said established security information to authenticate data transmissions from said computer network security device to said operations center further comprises querying a database for said established security information.

20. The method of claim 19, wherein said using said established security information to authenticate data transmissions from said computer network security device to said operations center further comprises validating said signature using said established security information.

21. The method of claim 20, storing said transmitted data if said signature is validated.

22. The method of claim 1, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center comprises said computer network security device generating a signature using said established security information.

23. The method of claim 22, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises transmitting said signature to said operation center.

24. The method of claim 23, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises determining whether a timestamp associated with said signature has expired.

25. The method of claim 24, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises querying a database for said established security information.

26. The method of claim 25, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises gathering data for transmission to said computer network security device.

27. The method of claim 26, further comprising establishing security information associated with said operations center.

28. The method of claim 27, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises signing said gathered data using security information associated with said operations center.

29. The method of claim 28, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises transmitting said signed gathered data to said computer network security device.

30. The method of claim 29, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises checking said security information associated with said operations center using said transmitted, signed, gathered data.

31. The method of claim 30, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises determining whether a timestamp associated with said transmitted, signed, gathered data has expired.

32. The method of claim 31, wherein said using said established security information to authenticate data transmission to said computer network security device from said operations center further comprises validating said transmitted data using said transmitted, signed, gathered data.

33. A computer program product embodied on one or more computer-readable storage mediums and for transmitting data from a computer network security device for monitoring at least one computer network node to an operations center for monitoring at least said computer network security device and to said computer network security device from said operations center in a managed computer network security system including at least said computer network security device and operations center, the computer program product comprising:

code for establishing security information associated with said at least one computer network security device;

code for using said established security information to authenticate data transmissions from said computer network security device to said operations center; and

,

code for using said established security information to authenticate data transmission to said computer network security device from said operations center.

34. A computer network security device for monitoring at least one computer network node and transmitting data to an operations center for monitoring at least said computer network security device and receiving data from said operations center in a managed computer network security system including at least said computer network security device and operations center, said device comprising:

code for transmitting security information associated with said at least one computer network security device to said operations center;

code for using said established security information to authenticate data transmissions from said computer network security device to said operations center; and

,

code for using said established security information to authenticate data transmission to said computer network security device from said operations center.

35. An operations center for monitoring at least one network security device in a managed computer network security system including at least said computer network security device and operations center, said center comprising:

code for receiving security information associated with said at least one computer network security device from said network security device;

code for using said established security information to authenticate data transmissions from said computer network security device to said operations center; and

,

code for using said established security information to authenticate data transmission to said computer network security device from said operations center.