Method and apparatus for managing a firewall
First Claim
1. A method for generating a configuration file for at least one firewall in a network, said network including a plurality of interconnected hosts, said method comprising the steps of:
- utilizing a model definition language to produce an entity relationship model representing a security policy for said network; and
translating said entity relationship model into said firewall configuration file.
2 Assignments
0 Petitions
Accused Products
Abstract
A method and apparatus are disclosed for managing a firewall. The disclosed firewall manager facilitates the generation of a security policy for a particular network environment, and automatically generates the firewall-specific configuration files from the security policy simultaneously for multiple gateways. The security policy is separated from the vendor-specific rule syntax and semantics and from the actual network topology. Thus, the security administrator can focus on designing an appropriate policy without worrying about firewall rule complexity, rule ordering, and other low-level configuration issues. In addition, the administrator can maintain a consistent policy in the presence of intranet topology changes. The disclosed firewall manager utilizes a model definition language (MDL) and an associated parser to produce an entity relationship model. A model compiler translates the entity-relationship model into the appropriate firewall configuration files. The entity-relationship model provides a framework for representing both the firewall-independent security policy, and the network topology. The security policy is expressed in terms of “roles,” which are used to define network capabilities of sending and receiving services. A role may be assumed by different hosts or host-groups in the network. A visualization and debugging tool is provided to transform the firewall-specific configuration files into a graphical representation of the current policy on the actual topology, allowing the viability of a chosen policy to be evaluated. A role-group may be closed to prevent the inheritance of roles.
-
Citations
22 Claims
-
1. A method for generating a configuration file for at least one firewall in a network, said network including a plurality of interconnected hosts, said method comprising the steps of:
-
utilizing a model definition language to produce an entity relationship model representing a security policy for said network; and
translating said entity relationship model into said firewall configuration file. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method of producing an entity-relationship model representing the security policy for a network, said network including a plurality of hosts, said method comprising the steps of:
-
receiving a definition for one or more role entities that further define allowed services and a direction in which a service can be executed;
receiving a model of a topology of said network that partitions said network into one or more zones, connected by means of one or more gateways, each of said gateways having a gateway-interface for each adjacent zone;
receiving an assignment of said hosts to one or more zones; and
generating said entity-relationship model from said received definitions, model and assignments. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18, 19, 20)
-
-
21. A firewall manager for generating a configuration file for a firewall in a network, said network including a plurality of interconnected hosts, comprising:
-
a parser utilizing a model definition language to produce an entity relationship model representing a security policy for said network; and
a compiler for translating said entity relationship model into said firewall configuration file.
-
-
22. A parser for producing an entity-relationship model representing the security policy for a network, said network including a plurality of hosts, said parser comprising:
-
a memory for storing computer-readable code; and
a processor operatively coupled to said memory, said processor configured to execute said computer-readable code, said computer-readable code configuring said processor to;
receive a definition for one or more role entities that further define allowed services and a direction in which a service can be executed;
receive a model of a topology of said network by partitioning said network into one or more zones, connected by means of one or more gateways, each of said gateways having a gateway-interface for each adjacent zone;
receive an assignment of said hosts to one or more zones; and
generate said entity-relationship model from said received definitions, model and assignments.
-
Specification