System, method and computer program product for rule based network security policies

• US 6,826,698 B1
• Filed: 09/15/2000
• Issued: 11/30/2004
• Est. Priority Date: 09/15/2000
• Status: Expired due to Term

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Minkin, Ilya, Balabine, Igor V., Eschelbeck, Gerhard
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US09/663,863
• Time in Patent Office: 1,537 Days
• Field of Search: 713/200-201, 713/153, 713/165-167, 709/223, 709/225, 709/232
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A system, method and computer program product are provided for affording network security features. A plurality of network objects are identified. Rule sets associated with one or more of the identified network objects are retrieved. Each rule set includes a plurality of policy rules that govern actions relating to the identified network objects. Overlapping policy rules of the rule sets are reconciled amongst the network objects. The reconciled rule sets are executed. A computer program product and a method are also provided for establishing network security. A plurality of network objects of a network and a plurality of rule sets are provided. The network objects are associated with the rule sets. The rule sets include a plurality of policy rules that govern actions relating to the identified network objects during operation of the network.

Claims

1. A method for providing network security features, comprising:

identifying a plurality of network objects;

retrieving rule sets associated with at least one of the identified network objects, the rule sets including a plurality of policy rules that govern actions relating to the identified network objects;

reconciling overlapping policy rules of the rule sets amongst the network objects; and

executing the reconciled rule sets;

wherein the rule sets are combined into a single rule set, and duplicate policy rules of the rule sets are removed;

wherein a user is notified of conflicting policy rules of the rule sets;

wherein included is a first graphical user interface that allows a user to associate the network objects with the rule sets, a second graphical user interface that allows the user to create associations of the rule sets and the network objects for a firewall, a third graphical user interface that is displayed upon selection of a network object, a fourth graphical user interface for creating and editing the rule sets, a fifth graphical user interface for configuring a new policy rule for being added to one of the rule sets, a sixth graphical user interface for adding a new network object, and a seventh graphical user interface for editing one of the network objects.

2. The method as recited in claim 1, wherein each policy rule of the reconciled rule sets includes a rule action selected from the group consisting of:

permitting an action relating to the identified network objects, denying an action relating to the identified network objects, and conditionally denying an action relating to the identified network objects.

3. The method as recited in claim 2, wherein an action relating to the identified network objects is permitted if no policy rules deny the action, at least one policy rule conditionally denies the action, and at least one policy rule permits the actions.

4. The method as recited in claim 2, wherein the policy rules denying the action are evaluated first, the policy rules conditionally denying the action are evaluated second, and the policy rules permitting the action are evaluated third.

5. The method as recited in claim 1, wherein an action relating to the identified network objects is denied if none of the policy rules permit the action.

6. The method as recited in claim 1, wherein an action relating to the identified network objects is denied if none of the policy rules match a request for the action.

7. The method as recited in claim 1, wherein the rule sets are associated with a particular network object.

8. The method as recited in claim 1, wherein a protocol configuration enforced by a related proxy is selected from a hierarchal list if an action is permitted by more than one rule.

9. A computer program product for providing network security features, comprising:

(a) computer code for identifying a plurality of network objects;

(b) computer code for retrieving rule sets associated with at least one of the identified network objects, the rule sets including a plurality of policy rules that govern actions relating to the identified network objects;

(c) computer code for reconciling overlapping policy rules of the rule sets amongst the network objects; and

(d) computer code for executing the reconciled rule sets;

wherein the rule sets are combined into a single rule set, and duplicate policy rules of the rule sets are removed;

wherein a user is notified of conflicting policy rules of the rule sets;

wherein included is a first graphical user interface that allows a user to associate the network objects with the rule sets, a second graphical user interface that allows the user to create associations of the rule sets and the network objects for a firewall, a third graphical user interface that is displayed upon selection of a network object, a fourth graphical user interface for creating and editing the rule sets, a fifth graphical user interface for configuring a new policy rule for being added to one of the rule sets, a sixth graphical user interface for adding a new network object, and a seventh graphical user interface for editing one of the network objects.

10. The computer program product as recited in claim 9, wherein each policy rule of the reconciled rule sets includes a rule action selected from the group consisting of:

permitting an action relating to the identified network objects, denying an action relating to the identified network objects, and conditionally denying an action relating to the identified network objects.

11. The computer program product as recited in claim 10, wherein an action relating to the identified network objects is permitted if no policy rules deny the action, at least one policy rule conditionally denies the action, and at least one policy rule permits the action.

12. The computer program product as recited in claim 10, wherein the policy rules denying the action are evaluated first, the policy rules conditionally denying the action are evaluated second, and the policy rules permitting the action are evaluated third.

13. The computer program product as recited in claim 9, wherein an action relating to the identified network objects is denied if none of the policy rules permit the action.

14. The computer program product as recited in claim 9, wherein an action relating to the identified network objects is denied if none of the policy rules match a request for the action.

15. The computer program product as recited in claim 9, wherein the rule sets are associated with a particular network object.

16. The computer program product as recited in claim 9, wherein a protocol configuration enforced by a related proxy is selected from a hierarchal list if an action is permitted by more than one rule.

17. A rule based network security system for providing network security features, comprising:

(a) logic for identifying a plurality of network objects;

(b) logic for retrieving rule sets associated with at least one of the identified network objects, the rule sets including a plurality of policy rules that govern actions relating to the identified network objects;

(c) logic for reconciling overlapping policy rules of the rule sets amongst the network objects; and

(d) logic for executing the reconciled rule sets;

wherein the rule sets are combined into a single rule set, and duplicate policy rules of the rule sets are removed;

wherein a user is notified of conflicting policy rules of the rule sets;

wherein included is a first graphical user interface that allows a user to associate the network objects with the rule sets, a second graphical user interface that allows the user to create associations of the rule sets and the network objects for a firewall, a third graphical user interface that is displayed upon selection of a network object, a fourth graphical user interface for creating and editing the rule sets, a fifth graphical user interface for configuring a new policy rule for being added to one of the rule sets, a sixth graphical user interface for adding a new network object, and a seventh graphical user interface for editing one of the network objects.

18. A method for establishing network security, comprising the steps of:

(a) providing a plurality of network objects of a network and a plurality of rule sets; and

(b) associating the network objects with the rule sets;

(c) wherein the rule sets include a plurality of policy rules that govern actions relating to the identified network objects during operation of the network;

wherein included is at least three graphical user interfaces selected from the group consisting of a first graphical user interface that allows a user to associate the network objects with the rule sets, a second graphical user interface that allows the user to create associations of the rule sets and the network objects for a firewall, a third graphical user interface that is displayed upon selection of a network object, a fourth graphical user interface for creating and editing the rule sets, a fifth graphical user interface for configuring a new policy rule for being added to one of the rule sets, a sixth graphical user interface for adding a new network object, and a seventh graphical user interface for editing one of the network objects.

19. The method as recited in claim 18, wherein each policy rule of the reconciled rule sets includes a rule action selected from the group consisting of:

permitting an action relating to the identified network objects, denying an action relating to the identified network objects, and conditionally denying an action relating to the identified network objects.

20. The method as recited in claim 19, wherein an action relating to the identified network objects is permitted if no policy rules deny the action, at least one policy rule conditionally denies the action, and at least one policy rule permits the action.

21. The method as recited in claim 18, wherein an action relating to the identified network objects is denied if none of the policy rules permit the action.

22. A computer program product for establishing network security, comprising:

(a) computer code for providing a plurality of network objects of a network and a plurality of rule sets; and

(b) computer code for associating the network objects with the rule sets;

(c) wherein the rule sets include a plurality of policy rules that govern actions relating to the identified network objects during operation of the network;

wherein a plurality of the rule sets are combined into a single rule set, and duplicate policy rules of the rule sets are removed;

wherein a user is notified of conflicting policy rules of the rule sets;

wherein included is a first graphical user interface that allows a user to associate the network objects with the rule sets, a second graphical user interface that allows the user to create associations of the rule sets and the network objects for a firewall, a third graphical user interface that is displayed upon selection of a network object, a fourth graphical use interface for creating and editing the rule sets, a fifth graphical user interface for configuring a new policy rule for being added to one of the rule sets, a sixth graphical user interface for adding a new network object, and a seventh graphical user interface for editing one of the network objects.

23. The computer program product as recited in claim 22, wherein each policy rule of the reconciled rule sets includes a rule action selected from the group consisting of:

permitting an action relating to the identified network objects, denying an action relating to the identified network objects, and conditionally denying an action relating to the identified network objects.

24. The computer program product as recited in claim 23, wherein an action relating to the identified network objects is permitted if no policy rules deny the action, at least one policy rule conditionally denies the action, and at least one policy rule permits the, action.

25. The computer program product as recited in claim 22, wherein an action relating to the identified network objects is denied if none of the policy rules permit the action.

26. A method for providing network security features, comprising the step of:

(a) identifying a plurality of network objects;

(b) retrieving rule sets associated with at least one of the identified network objects, the rule sets including a plurality of policy rules that govern actions relating to the identified network objects;

(c) reconciling overlapping policy rules of the rule sets amongst the network objects; and

(d) executing the reconciled rule sets;

wherein the rule sets are combined into a single rule set, and duplicate policy rules of the rule sets are removed;

wherein a user is notified of conflicting policy rules of the rule sets;

wherein included is a first graphical user interface that allows a user to associate the network objects with the rule sets, a second graphical user interface that allows the user to create associations of the rule sets and the network objects for a firewall, a third graphical user interface that is displayed upon selection of a network object, a fourth graphical user interface for creating and editing the rule sets, a fifth graphical user interface for configuring a new policy rule for being added to one of the rule sets, a sixth graphical user interface for adding a new network object, and a seventh graphical user interface for editing one of the network objects.