SYSTEMS AND METHODS FOR DISTRIBUTED SECURITY POLICY MANAGEMENT

• US 20070199044A1
• Filed: 04/19/2006
• Published: 08/23/2007
• Est. Priority Date: 02/17/2006
• Status: Abandoned Application

• Current Assignee: Locknet, Inc.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Hughes, William
• Application Number:
  US11/379,371
• Publication Number:
  US 20070199044A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In an embodiment, a system for distributed security policy management is described. The system may include, a security policy server, a network server at a client network and one or more client workstations on the client network. In an embodiment, the security policy server is configured to receive updates to one or more security policies and distribute security policy objects to one or more network servers. In another embodiment, the network server is configured to receive security policy objects and distribute the security policy objects to the one or more client workstations. In a further embodiment, methods for maintaining security policies for one or more client networks are described.

Claims

1. An apparatus for distributing security policy objects to one or more client networks, the apparatus comprising:

a security object server configured to retrieve one or more security policy objects and modify the one or more security policy objects;

a software data store to store one or more security policy objects; and

a client policy management module coupled to the security object server to receive updates to the one or more security policy servers and to send instructions to the security object server, the instructions intended to modify the one or more security policy objects using the update.

2. The apparatus of claim 1, further comprising:

a server management module to receive updates to the one or more security policy objects.

3. The apparatus of claim 2, wherein the updates to the one or more security policy objects are software updates to the one or more security policy objects.

4. The apparatus of claim 2, wherein the updates to the one or more security policy objects are updates to the one or more security policies that have equal applicability to one or more client networks.

5. The apparatus of claim 1, wherein the one or more security policy objects include installable software packages which, when received by a client workstation, are configured to be installed on the client workstation without any intervention by a user.

6. The apparatus of claim 5, wherein the one or more security policy objects are executed as trusted software applications and act as an intermediary between a software application and one or more hardware devices on the client workstation.

7. The apparatus of claim 1, wherein the security object server is configured to distribute the one or more security policy objects to a network server on a client network.

8. The apparatus of claim 7, wherein the one or more security policy objects are distributed based on a schedule indicative of a service level agreement for the client network.

9. An apparatus for providing security policy objects to one or more client workstations comprising:

an authentication module to receive one or more network access requests from one or more client workstations;

an object data store to store one or more security policy objects; and

an object distribution module to retrieve and distribute the one or more security policy objects to the one or more client workstations.

10. The apparatus of claim 9, further comprising a domain server, the domain server to provide domain services to the one or more client workstations.

11. The apparatus of claim 10, wherein the domain server is configured to manage all security-related aspects of a user and their domain interactions.

12. The apparatus of claim 9, wherein the one or more security policy objects are received from a security policy server.

13. The apparatus of claim 9, wherein the one or more security policy objects are received on a schedule indicative of a service level agreement.

14. A method of providing security policy objects to a subscriber, the method comprising:

receiving, from an agent of a subscribed network, an update to at least one security policy setting for at least one user on the subscribed network;

updating and storing a security policy object using the received update; and

sending the updated security policy object to a network server on the subscribed network.

15. The method of claim 14, wherein the updated security policy object is sent on a schedule indicative of a subscription level of the subscribed network.

16. The method of claim 14, wherein the updated security policy object is sent on a regular schedule.

17. The method of claim 14, wherein the updated security policy object is sent immediately following the update.

18. The method of claim 14, wherein the network server includes the following software modules:

authentication module, object data store and an object distribution module.

19. The method of claim 14, wherein the object distribution module is configured to distribute the updated security policy object to one or more client workstations based on the at least one security policy.

20. A method of delivering security policy objects to client workstations, the security policy objects individually configured to implement a unique security level, the method comprising:

receiving a request from a client workstation at a network server;

determining if the client workstation is an allowed client workstation;

sending an authentication request to the client workstation if the client workstation is not an allowed client workstation;

sending a security policy object to the client workstation if the client workstation is an allowed client workstation; and

installing the security policy object on the client workstation.

21. The method of claim 20, wherein the authentication request is configured to validate the user of the client workstation.

22. The method of claim 21, further comprising sending the security policy object is sent to the client workstation if the user is validated.

23. The method of claim 20, wherein the security policy object is an installable software packages which, when received by a client workstation, are configured to be installed on the client workstation without any intervention by a user.

24. The method of claim 23, wherein the security policy object is executed as trusted software applications and act as an intermediary between a software application and one or more hardware devices on the client workstation.

25. A method of updating security policy objects on a network services server, the method comprising:

maintaining in a data store one or more security software objects for a client network, each of the one or more security software objects configured to implement one or more security policies at a client workstation computer on the client network;

receiving updates to the one or more security policies;

updating the one or more security software objects such that the updated security software object is configured to implement the updated one or more security policies; and

periodically sending the updated one or more security software objects to a network services server at the client network, the network services server configured to distribute the one or more security software objects to one or more client workstations on the client network.

26. A system for distributed security policy management, the system comprising:

a security policy server coupled to a local network server across a network, the security policy server to maintain one or more security policy objects and to distribute the one or more security policy objects to the local network server as required;

the local network server, the local server comprising the following software modules;

an authentication module to receive one or more network access requests from one or more client workstations;

an object data store to locally store the one or more security policy objects; and

an object distribution module to retrieve and distribute the one or more security policy objects to the one or more client workstations.

27. The system of claim 26, wherein the local network server further comprises a domain server, the domain server to provide domain services to the one or more client workstations.

28. The system of claim 26, wherein the security policy server comprises the following software modules:

a security object server to distribute to the local network server the one or more security policy objects;

a software data store to maintain a data store of the one or more security policy objects; and

a client policy management to provide a user interface to an agent of the local network, the user interface to allow the agent to update one or more security policies in regards to the local network.