Automatically Recommending Firewall Rules During Enterprise Information Technology Transformation

• US 20140068698A1
• Filed: 08/31/2012
• Published: 03/06/2014
• Est. Priority Date: 08/31/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Burchfield, Nancy, Hang, Nathaniel, Hosn, Rafah A., Murray, James, Ramasamy, Harigovind V.
• Granted Patent: US 9,059,960 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques for automatically generating one or more rules during IT transformation for configuring one or more firewall interfaces in a post-transformation target environment. A method includes obtaining at least one communication pattern occurring in a pre-transformation source environment, and automatically generating one or more vendor-neutral rules for one or more intended firewall interfaces in a post-transformation target environment based on the at least one communication pattern occurring in the source environment and based on information derived from the target environment.

Claims

1. A method for automatically generating one or more rules during IT transformation for configuring one or more firewall interfaces in a post-transformation target environment, the method comprising:

obtaining at least one communication pattern occurring in a pre-transformation source environment; and

automatically generating one or more vendor-neutral rules for one or more intended firewall interfaces in a post-transformation target environment based on the at least one communication pattern occurring in the source environment and based on information derived from the target environment;

wherein at least one of the steps is carried out by a computer device.

2. The method of claim 1, comprising automatically converting the one or more vendor-neutral rules into one or more vendor-specific firewall rules for the target environment based on information derived from the target environment.

3. The method of claim 1, wherein obtaining at least one communication pattern comprises at least one of:

performing an analysis of one or more firewall configuration files associated with the source environment;

observing one or more run-time network flows at the source environment;

analyzing one or more configured dependencies at one or more servers running on the source environment;

analyzing one or more firewall log files; and

using manually provided information about one or more flows at the source environment.

4. The method of claim 1, wherein information derived from the target environment used for automatically generating one or more vendor-neutral firewall rules comprises at least one of:

firewall topology;

security zone topology;

security zone contents; and

a new internet protocol (IP) address and subnet information.

5. The method of claim 1, wherein obtaining at least one communication pattern comprises obtaining information pertaining to service ports.

6. The method of claim 1, wherein automatically generating one or more vendor-neutral rules comprises:

determining whether a communication pattern and/or one or more additional requirements from the target environment are relevant for the one or more firewall interfaces in the target environment; and

automatically generating one or more vendor-neutral per-interface rules for one or more intended interfaces in the target environment based on the at least one communication pattern occurring in the source environment and/or one or more additional requirements from the target environment that are determined relevant for each interface.

7. The method of claim 6, wherein automatically generating one or more vendor-neutral per-interface rules for one or more intended interfaces in the target environment comprises generating at least one transformed communication pattern by applying a source environment-target environment IP address or subnet mapping to the at least one communication pattern occurring in the source environment.

8. The method of claim 6, wherein automatically generating one or more vendor-neutral per-interface rules for one or more intended interfaces in the target environment comprises incorporating new communication and/or new security requirements from the target environment.

9. The method of claim 6, wherein automatically generating one or more vendor-neutral per-interface rules for one or more intended interfaces in the target environment comprises incorporating information pertaining to zone contents and firewall interfaces of the target environment.

10. The method of claim 6, wherein automatically generating one or more vendor-neutral per-interface rules for one or more intended interfaces in the target environment comprises applying heuristics and/or user-provided information to identify one or more service ports.

11. The method of claim 1, wherein only a subset of devices in the source environment are transformed.

12. The method of claim 1, wherein firewall and/or security zone topology in the target environment is partially or fully different from that of the source environment.

13. The method of claim 1, wherein one or more devices in the target environment are from a different vendor and/or model and/or platform from one or more devices in the source environment.

14. The method of claim 1, wherein one or more firewall devices are physical or virtual devices.

15. The method of claim 1, wherein one or more security requirements in the source environment differ from those in the target environment.

16. The method of claim 1, wherein one or more connectivity requirements in the source environment differ from those in the target environment.

17. The method of claim 1, wherein information derived from the target environment comprises already-implemented vendor-specific firewall rules in the target environment.

18. The method of claim 1, wherein automatically generating one or more vendor-neutral rules for one or more intended firewall interfaces in a target environment comprises accounting for one or more rules already implemented for the target environment'"'"'s firewalls and recommending additions, deletions, and/or updates to the one or more rules.

19. The method of claim 1, comprising automatically generating one or more vendor-specific firewall rules for a target environment during an enterprise information technology transformation activity.

20. The method of claim 19, wherein an enterprise information technology transformation activity comprises at least one of migration, consolidation, virtualization, data center relocation, and cloudification of at least one application or server or service from a source information technology infrastructure to a target information technology infrastructure.