DATA STRUCTURE FOR POLICY-BASED REMEDIATION SELECTION

• US 20100257585A1
• Filed: 06/21/2010
• Published: 10/07/2010
• Est. Priority Date: 09/03/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Ojha, Sachchida Nand, Immordino, John Leonard, Bezilla, Daniel Bailey, Le Ogura, James
• Granted Patent: US 8,336,103 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A machine-actionable memory may include: one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID); and at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device.

Claims

1. A machine-actionable memory comprising:

one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID); and

at least one POL_ID field, the contents of which denotes an ID of at least one policy (POL_ID), the at-least-one policy respectively defining a condition violation of which is potentially indicative of unauthorized activity or manipulation of the device.

2. The memory of claim 1, wherein the data structure further includes:

one or more parameter fields, the contents of which denote present and one or more previous values of one or more parameters associated with the at-least-one policy.

3. The memory of claim 1, wherein the data structure further includes:

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID).

4. The memory of claim 1, wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation; and

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation.

5. The memory of claim 1, wherein the data structure further includes:

at least one CE_ID field, the contents of which denotes an ID of an asset (CE_ID) to which the remediation is to be applied.

6. The memory of claim 5, wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation;

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation; and

implementation of the remediation upon the at least one asset denoted by the contents of the at least one CE_ID field mitigates against a future excursion of the one or more parameter values outside the boundaries of the at least one policy.

7. The memory of claim 5, wherein the data structure for at least one of the one-or-more machine-actionable records includes:

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

two or more SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively;

two or more CE_ID fields, the contents of which denote two or more CE_ID fields; and

at least one of the following;

at least two P-55 links between the two or more POL_ID fields, respectively, and the two or more subsets,

at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

at least two R-SS links between the at-least-one R_ID field and the two or more subsets, respectively, and

at least two R-AS links between the at-least-one R_ID field and the two or more CE_ID fields, respectively.

8. The memory of claim 1, wherein the data structure for at least one of the one-or-more machine-actionable records includes:

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

at least two SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively; and

at least one of the following;

at least two P-SS links between the two or more POL_ID fields, respectively, and the two or more subsets,

at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

at least two R-55 links between the at-least-one R_ID field and the two or more subsets, respectively.