METHODS, SYSTEMS, AND COMPUTER PROGRAM PRODUCTS FOR MANAGING FIREWALL CHANGE REQUESTS IN A COMMUNICATION NETWORK

• US 20110154470A1
• Filed: 12/22/2009
• Published: 06/23/2011
• Est. Priority Date: 12/22/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Hiemstra, Shawn M., Luther, Kevin W., Grimes, Robert Preston
• Granted Patent: US 9,154,462 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of managing firewall change requests for a communication network includes providing a change request interface comprising a plurality of change request form types, each request form including an interface for entering requestor identification information, Internet Protocol (IP) address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change, receiving completed change request forms from at least one requestor, arranging the completed change request forms in a request queue, and presenting the request queue to at least one administrator responsible for implementing firewall changes in the communication network.

Claims

1. A method of managing firewall change requests for a communication network, comprising:

providing a change request interface comprising a plurality of change request form types, each request form comprising an interface for entering requestor identification information, Internet Protocol (IP) address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change;

receiving completed change request forms from at least one requestor;

arranging the completed change request forms in a request queue; and

presenting the request queue to at least one administrator responsible for implementing firewall changes in the communication network.

2. The method of claim 1, further comprising:

authenticating the at least one requestor using single sign on authentication.

3. The method of claim 1, wherein the request queue comprises at least one of the following types of information for each of the completed change request forms:

date information, time information, the requestor identification information, tester information, affected firewall information, and change request status information.

4. The method of claim 1, wherein the plurality of change request form types comprises at least one of the following request types:

a standard source to destination request, an IP address modification to existing firewall rules request, a File Transfer Protocol (FTP) account request, a custom request, a Network Address Translation (NAT) modification request, and a modification associated with a group of associated IP addresses.

5. The method of claim 1, further comprising:

receiving approval of at least one completed change request form by a security administrator responsible for authorizing firewall change requests.

6. The method of claim 1, further comprising:

sending notifications to the at least one requestor associated with each of the completed change request forms, respectively, wherein each notification comprises status information associated with the change request.

7. The method of claim 1, further comprising:

communicating with at least one firewall in the communication network regarding at least one of IP address information, policy information, and rule information.

8. The method of claim 1, further comprising:

maintaining a topology of the communication network and locations of firewalls therein; and

identifying, for each of the completed change request forms, firewalls affected by the change request based on the topology of the communication network.

9. The method of claim 8, further comprising:

defining a firewall in the topology of the communication of the communication network;

defining at least one segment in the topology of the communication network that the defined firewall protects; and

defining, for each of the at least one segment, a protection purpose.

10. The method of claim 1, further comprising:

receiving a request from the at least one requestor to unblock access to a Website responsive to the at least one requestor having been blocked from accessing the Website; and

presenting the unblock request to at least one administrator responsible for granting access to the Website.

11. The method of claim 1, further comprising:

defining a group of associated IP addresses;

wherein at least one of the complete change request form comprises the defined group of associated IP addresses.

12. The method of claim 11, wherein the defined group is defined by one of the at least one requestor for use in the one of the at least one requestor'"'"'s change request form.

13. The method of claim 11, wherein the defined group is defined by the at least one administrator for use by any of the at least one requestor in the at least one requestors'"'"' change forms.

14. The method of claim 1, further comprising:

generating at least one report based on the completed change request forms.

15. The method of claim 1, further comprising:

identifying at least one firewall protection zone in the communication network associated with the IP address information.

16. The method of claim 1, further comprising:

identifying at least one firewall rule associated with the received IP address information.

17. The method of claim 1, further comprising:

examining rules associated with at least one firewall in the communication network; and

determining whether the examined rules can be consolidated to reduce a number of the rules.

18. A system for managing firewall change requests in a communication network comprising:

a data processing system that is configured to provide a change request interface comprising a plurality of change request form types, each request form comprising an interface for entering requestor identification information, Internet Protocol (IP) address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change, to receive completed change request forms from at least one requestor, to arrange the completed change request forms in a request queue, and to present the request queue to at least one administrator responsible for implementing firewall changes in the communication network.

19. The system of claim 18, wherein the plurality of change request form types comprises at least one of the following request types:

a standard source to destination request, an IP address modification to existing firewall rules request, a File Transfer Protocol (FTP) account request, a custom request, a Network Address Translation (NAT) modification request, and a modification associated with a group of associated IP addresses.

20. A computer program product for managing firewall change requests in a communication network, comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to provide a change request interface comprising a plurality of change request form types, each request form comprising an interface for entering requestor identification information, Internet Protocol (IP) address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change;

computer readable program code configured to receive completed change request forms from at least one requestor;

computer readable program code configured to arrange the completed change request forms in a request queue; and

computer readable program code configured to present the request queue to at least one administrator responsible for implementing firewall changes in the communication network.