SYSTEMS AND METHODS FOR THE RAPID DEPLOYMENT OF NETWORK SECURITY DEVICES

• US 20140115655A1
• Filed: 10/24/2012
• Published: 04/24/2014
• Est. Priority Date: 10/24/2012
• Status: Active Grant

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Wallen, Todd Alan, Marvais, Nick, Wang, Sin-Yaw, Bothwell, Lee W., McLaren, Shari Marlie, Klorese, Roger Brian Alan, Aguirre, Johnni M., Smith, William James, Wang, Yong, Zhang, Han
• Granted Patent: US 8,799,992 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/76 Adapting program code to run in a different environment; Porting
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0809 Plug-and-play configuration
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A configuration service comprises a deployment package and a production configuration for a network security device. One or more configuration parameters of the production configuration may be defined by an administrator of the network security device (e.g., the customer). The network security device may be preconfigured with a network address and identifier. The network security device may be configured to automatically request and apply the deployment package at deployment time by use of the preconfigured network address and identifier. The network security device may automatically request and apply the production configuration from the configuration service in response to applying the deployment package.

Claims

1. A configuration service, comprising:

a security module configured to associate an identifier of a network security device with a deployment package, wherein the deployment package comprises a credential, and wherein the security module is configured to provide the deployment package to a network security device in response to a request comprising the device identifier; and

a management module configured to associate the device identifier with a production configuration, the production configuration comprising a deployment-specific security policy comprising one or more deployment-specific configuration parameters for the network security device, wherein the management module is configured to provide the production configuration to the network security device in response to a request from the network device comprising the credential of the deployment package.

2. The configuration service of claim 1, wherein the deployment package further comprises one or more of a feature key configured to define one or more licensed features of the network security device, a network address of the management module, a certificate of the management module.

3. The configuration service of claim 1, wherein the deployment package is configured to configure the network security device to accept the production configuration from the management module.

4. The configuration service of claim 1, wherein the device identifier comprises a serial number.

5. The configuration service of claim 1, wherein the management module is configured to delete the production configuration associated with the network security device after a predetermined time period.

6. The configuration service of claim 1, further comprising a configuration wizard configured to provide for defining the production configuration, wherein the configuration wizard provides for specifying the one or more configuration parameters specific to the deployment of the network security device.

7. The configuration service of claim 1, wherein the network security device is configured to:

request the deployment package from the security module in response to the network security device powering on and/or being communicatively coupled to a network;

request the production configuration from the management server in response to applying the deployment package; and

apply the production configuration in response to receiving the production configuration from the management module.

8. The configuration service of claim 7, wherein the network security device comprises a machine-readable storage media that is preconfigured with a network address of the security module and a device identifier, and wherein the network security device is configured to request the deployment package from the security module in accordance with the preconfigured network address and device identifier.

9. The configuration service of claim 1, wherein requesting the production configuration comprises establishing a secure communication channel with the management server by use of a credential provided in the deployment package.

10. The configuration service of claim 1, wherein requesting the production configuration comprises establishing a secure communication channel with the management server by use of a credential provided in the deployment package.

11. The configuration service of claim 1, wherein the security module is configured to issue a notification to the administrator of the network security device in response to providing the deployment package to the network security device.

12. The configuration service of claim 1, wherein the management module is configured to issue an email to a predetermined recipient in response to providing the production configuration to the network security device.

13. A method for automatically configuring a network security device, comprising:

associating a network security device with a deployment package and a production configuration;

providing the deployment package to the network security device in response a request from the network security device, the request comprising an identifier of the network security device, wherein the deployment package comprises a feature key of the network security device; and

providing a production configuration to the network security device in response to a request from the network security device, the request comprising a credential of the deployment package, wherein the production configuration comprises a configuration of one or more security features of the network security device specified by the feature key.

14. The method of claim 13, wherein the deployment package comprises a username and password of the administrator account.

15. The method of claim 13, wherein the deployment package comprises a shared secret, and wherein providing the production configuration comprises establishing a secure connection between the management module and network security device by use of the shared secret.

16. The method of claim 13, wherein the deployment package comprises a public key certificate configured to provide for authenticating the management module.

17. The method of claim 13, further comprising generating the production configuration based on one or more configuration parameters provided by an administrator of the network security device.

18. The method of claim 13, further comprising activating the network security device, wherein activating comprises assigning a feature key to the network security device in accordance with one or more licensed features of the network security device.

19. A self-configuring network security device, comprising:

a machine-readable storage medium preconfigured with a network address of a security module and a device identifier;

a bootstrap module configured to apply a deployment package to the network security device, the deployment package received in response to a request directed to a security module at the preconfigured network address and comprising the preconfigured device identifier, the request in response to coupling the network security device to a network, wherein the deployment package comprises a network address of a management module and a credential, and wherein applying the deployment package comprises configuring an administrator account of the network security device; and

a production module configured to apply a production configuration to the network security device, the production configuration received in response to establishing a secure connection with the management module using the credential and the network address of the deployment package, wherein the configuration agent is configured to apply the production configuration using the administrator account.

20. The self-configuring network security device of claim 19, further comprising a rapid deployment module configured to transition a configuration state of the network security device from a factory default state to a deployment state in response to applying the deployment package and to transition the configuration state of the network security device from the deployment state to a production state in response to applying the production configuration.