SECURITY-CONNECTED FRAMEWORK

• US 20160205142A1
• Filed: 09/28/2014
• Published: 07/14/2016
• Est. Priority Date: 09/28/2013
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Arkin, Ofir
• Granted Patent: US 10,142,373 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 13/4265 on a point to point bus G06F13/4247, G06F13/4282 take precedence
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

In an example, a security-connected platform is provided on a data exchange layer (DXL), which provides messaging on a publish-subscribe model. The DXL provides a plurality of DXL endpoints connected via DXL brokers. In one case, DXL endpoints designated as producers are authorized to produce certain types of messages, including security-related messages such as object reputations. Other DXL endpoints are designated as consumers of those messages. A domain master may also be provided, and may be configured to provide physical and logical location services via an asset management engine.

Claims

1. A security controller apparatus for providing messaging services on a data exchange layer (DXL), comprising:

a network interface;

a DXL services engine operable for providing an application programming interface (API) for connecting to a DXL enterprise service bus (ESB) via the network interface; and

a domain security engine operable for;

subscribing to a DXL security topic;

detecting a security event via the DXL ESB; and

publishing a DXL security message via the DXL ESB configured for acting on the security event.

2. The apparatus of claim 1 wherein the domain security engine is further operable to operate as a security information and event manager (SIEM).

3. The apparatus of claim 2, wherein the domain security engine is further operable to subscribe to a SIEM topic via the DXL ESB.

4. The apparatus of claim 3, wherein the domain security engine is further operable to act as a SIEM topic producer via the DXL ESB.

5. The apparatus of claim 1, wherein the domain security engine is further operable for:

consolidating a plurality of DXL messages;

building a context-sensitive security policy; and

publishing the context-sensitive security policy via a DXL message.

6. The apparatus of claim 5, wherein building a context-sensitive security policy comprises assigning a location-independent security policy to a DXL endpoint, and publishing the assignment via a DXL message.

7. The apparatus of claim 5, wherein building a context-sensitive security policy comprises:

determining a device type for a DXL endpoint; and

reporting via a DXL message available network services for automatically attaching an intrusion prevention system policy to the device.

8. The apparatus of claim 5, wherein building a context-sensitive security policy comprises assigning a DXL endpoint a location-sensitive security policy, wherein location is a basis for assigning the DXL endpoint a trust level, and reporting the assignment via a DXL message.

9. The apparatus of claim 5, wherein building a context-sensitive security policy comprises assigning a criticality score to a DXL endpoint, and reporting the assignment via a DXL message.

10. The apparatus of any of claim 1, wherein the domain security engine is further operable for:

detecting an intrusion attempt; and

publishing characteristics of the intrusion attempt via a DXL message.

11. The apparatus of any of claim 1, wherein the domain security engine is further operable for providing application sandboxing, and reporting results of application sandboxing via a DXL message.

12. The apparatus of any of claim 1, wherein the domain security engine is further operable for:

detecting malicious command and control traffic from a DXL endpoint; and

providing a DXL push notification to the DXL endpoint configured to notify the DXL endpoint that it is infected.

13. The apparatus of any of claim 1, wherein the domain security engine is further operable for interoperating in real-time or near-real-time with a security information and event manager.

14. One or more computer-readable storage mediums having stored thereon executable instructions operable for providing a data exchange layer (DXL) domain security engine operable for:

communicatively coupling to a DXL enterprise security bus (ESB);

subscribing to a DXL security topic;

detecting a security event via the DXL ESB; and

publishing a DXL security message via the DXL ESB configured for acting on the security event.

15. The one or more computer-readable mediums of claim 14, wherein the domain security engine is further operable for:

consolidating a plurality of DXL messages;

building a context-sensitive security policy; and

publishing the context-sensitive security policy via a DXL message.

16. The one or more computer-readable mediums of claim 15, wherein building a context-sensitive security policy comprises assigning a location-independent security policy to a DXL endpoint, and publishing the assignment via a DXL message.

17. The one or more computer-readable mediums of claim 15, wherein building a context-sensitive security policy comprises:

determining a device type for a DXL endpoint; and

reporting via a DXL message available network services for automatically attaching an intrusion prevention system policy to the device.

18. The one or more computer-readable mediums of claim 15, wherein building a context-sensitive security policy comprises assigning a DXL endpoint a location-sensitive security policy, wherein location is a basis for assigning the DXL endpoint a trust level, and reporting the assignment via a DXL message.

19. The one or more computer-readable mediums of claim 15, wherein building a context-sensitive security policy comprises assigning a criticality score to a DXL endpoint, and reporting the assignment via a DXL message.

20. The one or more computer-readable mediums any of claim 14, wherein the domain security engine is further operable for:

detecting an intrusion attempt; and

publishing characteristics of the intrusion attempt via a DXL message.

21. The one or more computer-readable mediums any of claim 14, wherein the domain security engine is further operable for providing application sandboxing, and reporting results of application sandboxing via a DXL message.

22. The one or more computer-readable mediums any of claim 14, wherein the domain security engine is further operable for:

detecting malicious command and control traffic from a DXL endpoint; and

providing a DXL push notification to the DXL endpoint configured to notify the DXL endpoint that it is infected.

23. The one or more computer-readable mediums any of claim 14, wherein the domain security engine is further operable for interoperating in real-time or near-real-time with a security information and event manager.

24. A computer-implemented method for providing domain security on a data exchange layer (DXL), comprising:

communicatively coupling to a DXL enterprise security bus (ESB);

subscribing to a DXL security topic;

detecting a security event via the DXL ESB; and

publishing a DXL security message via the DXL ESB configured for acting on the security event.

25. The method of claim 24, further comprising:

consolidating a plurality of DXL messages;

building a context-sensitive security policy; and

publishing the context-sensitive security policy via a DXL message.