IP network vulnerability and policy compliance assessment by IP device analysis

• US 20080172716A1
• Filed: 09/12/2007
• Published: 07/17/2008
• Est. Priority Date: 09/12/2006
• Status: Abandoned Application

• Current Assignee: TT Government Solutions, Inc. (Perspecta, Inc.)
• Original Assignee: TT Government Solutions, Inc. (Perspecta, Inc.)
• Inventors: Talpade, Rajesh, Cheng, Yuu-Heng, Poylisher, Alexander, Narain, Sanjai
• Application Number:
  US11/900,674
• Publication Number:
  US 20080172716A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Customizable software provides assurances about the ability of an IP network to satisfy security, regulatory and availability requirements by comprehensive vulnerability and compliance assessment of IP networks through automated analysis of configurations of devices such as routers, switches, and firewalls. The solution comprises three main approaches for testing of IP device configurations to eliminate errors that result in vulnerabilities or requirements compliance issues. The first two fall in to the “static constraint validation” category since they do not change significantly for each IP network, while the last approach involves incorporation of each specific IP network'"'"'s policies/requirements. These approaches are complementary, and may be used together to satisfy all the properties described above. The first approach involves checking the configurations of devices for conformance to Best-Current-Practices provided by vendors (e.g. Cisco Network Security Policy) and organizations such as the NIST, NSA or CERT. Also this includes checks of compliance with regulations such as FISMA, SOX, HIPPA, PCI, etc. The second approach is where as one reads device configurations, one collects beliefs about network administrator intent. As each belief is collected, an inference engine checks whether the new belief is inconsistent with previously accumulated beliefs. The third approach addresses the multiple device/protocol issue by including an understanding of high-level service and security requirements about the specific IP network under test from the network administrators.

Claims

1. An IP network policy compliance assessment method comprising the steps of:

providing network device configurations;

checking device configurations for conformance to predetermined best-current-practices and/or regulatory compliance; and

assessing the results of said checking and providing an indication of the assessment.

2. An IP network policy compliance assessment method comprising the steps of:

reading IP network device configurations;

accumulating beliefs about network administrator intent; and

assessing whether each new belief is consistent with the previously accumulated beliefs.

3. An IP network policy compliance assessment method comprising the steps of:

combining network and security policies with rules;

combining network device configurations with the combined network and security policies and rules; and

providing outputs based on assessing network and security rules against the network device configurations.

4. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained using multi-device and multi-protocol configuration analysis.

5. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained using multi-level topology visualization.

6. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained using large IP topology visualization.

7. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained using diversity/fault-tolerance testing.

8. An IP network policy compliance assessment method as set forth in claim 7, wherein the outputs are obtained using network connectivity metric and trends.

9. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained by partitioning the IP network in a plurality of realms.

10. An IP network policy compliance assessment method as set forth in claim 9, wherein the realms are selected from the group consisting of internal, external and de-militarized realm.

11. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained using at least one analysis set.

12. An IP network policy compliance assessment method as set forth in claim 3, wherein the outputs are obtained using at least one assessment suite.

13. A system for IP network policy compliance assessment comprising:

configuration parsers receiving IP network configuration data for multiple device types and vendors for parsing real-time input from route-registries and route markers;

a relational database coupled to said configuration parsers using a vendor-neutral schema for multiple device types and vendors; and

assessment modules containing best-current-practices and/or regulatory compliance information for assessing IP network configuration.

14. A system for IP network policy compliance assessment as set forth in claim 13, wherein the network configuration data is automatically uploaded from an IP network.

15. A system for IP network policy compliance assessment as set forth in claim 13, wherein the network configuration is manually provided to said configuration parsers.

16. A system for IP network policy compliance assessment as set forth in claim 13, further comprising means for visually displaying the assessment.

17. A system for IP network policy compliance assessment as set forth in claim 13, wherein the assessment includes results and possible adjustments to be made to the network configuration.

18. A system for IP network policy compliance assessment as set forth in claim 13, wherein user input is provided to said assessment modules.