Method and apparatus for securely and dynamically modifying security policy configurations in a distributed system

• US 6,920,558 B2
• Filed: 05/22/2001
• Issued: 07/19/2005
• Est. Priority Date: 03/20/2001
• Status: Expired due to Term

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Niebuhr, Brian S., Whitmore, Brent S., Tally, Gregg W., Sames, David L.
• Primary Examiner(s): Barron, Gilberto
• Assistant Examiner(s): NOBAHAR, ABDULHAKIM
• Application Number:
  US09/863,145
• Publication Number:
  US 20020138726A1
• Time in Patent Office: 1,519 Days
• Field of Search: 713/166, 713/182, 713/201
• US Class Current: 713/166
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

One embodiment of the present invention provides a system for managing security policies in a distributed computing system. Security policies include, but are not limited to, a firewall policy, a policy for file access, a policy for application access, a policy for an encryption algorithm, a policy for audit trails, and a policy for activity logging. These security policies determine access rights to a computer application. The system operates by creating multiple security policies with individual security policies specifying a differing level of security for the distributed computing system. These security policies are then distributed to each computer in the distributed computing system. Next, a specific security policy is selected for use across the distributed computing system, and each computer in the distributed computing system is directed to use the specified security policy enforcing a selected security posture.

Claims

1. A method for managing security policies in a distributed computing system, wherein security policies determine access rights to a computer application, the method comprising:

creating a plurality of security policies, wherein each security policy specifies a level of security for the distributed computing system;

distributing the plurality of security policies to each computer in the distributed computing system;

selecting a specific security policy from the plurality of security policies for use across the distributed computing system; and

informing each computer in the distributed computing system to use the specific security policy;

wherein the plurality of security policies includes a default security policy, wherein the default security policy is selected by a computer within the distributed computing system if the specific security policy is defective;

wherein a host is provided including applications, a security posture interpreter, and a local policy database, the applications capable of registering with the security posture interpreter, whereupon registration, the security posture interpreter returns a current security policy to the applications.

2. The method of claim 1, wherein the level of security includes a specific security posture.

3. The method of claim 1, further comprising using secure communications for distributing the plurality of security policies to each computer in the distributed computing system.

4. The method of claim 1, further comprising signing each security policy in the plurality of security policies with a cryptographic signature to allow detection of unauthorized changes.

5. The method of claim 1, further comprising distributing the plurality of security policies from a computer in the distributed computing system to a subordinate computer.

6. The method of claim 1, wherein selecting the specific security policy for use includes selecting the specific security policy based on a security posture.

7. The method of claim 6, wherein informing each computer in the distributed computing system to use the specific security policy includes using secure communications for distributing the security posture indicator to each computer in the distributed computing system.

8. The method of claim 1, wherein the security posture interpreter includes a posture access agent, a posture registration agent, and a posture notification agent, whereupon notification of a Previously Presented security posture, the posture access agent determines a current security posture by accessing the current security policy within the local policy database, the posture access agent provides the current security posture to the posture notification agent, the posture registration agent provides access for the applications to register with the security posture interpreter, whereupon one of the applications registering with the posture registration agent, the application provides a call-back address so that the posture notification agent notifies the application when the current security posture changes.

9. The method of claim 8, whereupon the posture notification agent receiving notification that the current security policy has changed, the posture notification agent notifies the registered applications of the change in the current security posture.

10. The method of claim 9, wherein the local policy database includes a hierarchical data structure of directories and files, a top-level directory of the directories including a master policy with directories for a role authorization policy, an additional policy, and a security policy interpreter policy, the role authorization policy and additional policy including files which define the security policies for the role authorization policy and additional policy, each directory including multiple flies, where each file specifies the security policy for a particular security posture.

11. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for managing security policies in a distributed computing system, wherein security policies determine access rights to a computer application, the method comprising:

creating a plurality of security policies, wherein each security policy specifies a level of security for the distributed computing system;

distributing the plurality of security policies to each computer in the distributed computing system;

selecting a specific security policy from the plurality of security policies for use across the distributed computing system; and

informing each computer in the distributed computing system to use the specific security policy;

wherein the plurality of security policies includes a default security policy, wherein the default security policy is selected by a computer within the distributed computing system if the specific security policy is defective;

wherein a host is provided including applications, a security posture interpreter, and a local policy database, the applications capable of registering with the security posture interpreter, whereupon registration, the security posture interpreter returns a current security policy to the applications.

12. The computer-readable storage medium of claim 11, wherein the level of security includes a specific security posture.

13. The computer-readable storage medium of claim 11, wherein the method further comprises using secure communications for distributing the plurality of security policies to each computer in the distributed computing system.

14. The computer-readable storage medium of claim 11, wherein the method further comprises signing each security policy in the plurality of security policies with a cryptographic signature to allow detection of unauthorized changes.

15. The computer-readable storage medium of claim 11, wherein the method further comprises distributing the plurality of security policies from a computer in the distributed computing system to a subordinate computer.

16. The computer-readable storage medium of claim 11, wherein selecting the specific security policy far use includes selecting the specific security policy based on a security posture.

17. The computer-readable storage medium of claim 16, wherein informing each computer in the distributed computing system to use the specific security policy includes using secure communications for distributing the security posture to each computer in the distributed computing system.

18. An apparatus that facilitates managing security policies in a distributed computing system, wherein security policies determine access rights to a computer application, the apparatus comprising:

a creating mechanism configured to create a plurality of security policies, wherein each security policy specifies a level of security for the distributed computing system;

a distributing mechanism configured to distribute the plurality of security policies to each computer in the distributed computing system;

a selecting mechanism configured to select a specific security policy from the plurality of security policies for use across the distributed computing system; and

an informing mechanism configured to inform each computer in the distributed computing system to use the specific security policy;

wherein the plurality of security policies includes a default security policy, wherein the default security policy is selected by a computer within the distributed computing system if the specific security policy is defective;

wherein a host is provided including applications, a security posture interpreter, and a local policy database, the applications capable of registering with the security posture interpreter, whereupon registration, the security posture interpreter returns a current security policy to the applications.

19. The apparatus of claim 18, wherein the level of security includes a specific security posture.

20. The apparatus of claim 18, further comprising a secure communications mechanism that is configured to distribute the plurality of security policies to each computer in the distributed computing system.

21. The apparatus of claim 18, further comprising a signing mechanism that is configured to sign each security policy in the plurality of security policies with a cryptographic signature to allow detection of unauthorized changes.

22. The apparatus of claim 18, wherein the distributing mechanism is further configured to distribute the plurality of security policies from a computer in the distributed computing system to a subordinate computer.

23. The apparatus of claim 18, wherein the selecting mechanism includes a policy selecting mechanism that is configured to select the specific security policy based on the security posture.

24. The apparatus of claim 23, wherein the informing mechanism includes a secure communications mechanism for distributing the security posture to each computer in the distributed computing system.