System and method for providing network security

• US 7,832,006 B2
• Filed: 08/09/2005
• Issued: 11/09/2010
• Est. Priority Date: 08/09/2005
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chen, Zesen, Gonsalves, Brian A., Chou, Peter, Zhao, Yongdong, Taylor, Michael
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Nobahar; Abdulhakim
• Application Number:
  US11/200,249
• Publication Number:
  US 20070039047A1
• Time in Patent Office: 1,918 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present disclosure provides a system and method configured to manage and facilitate network security. When a lack of security in a communication network is detected by a security agent or when a remote device requests security, a security profile can be determined by a security manager based on the detection or the request and the available network equipment. The security profile may contain numerous executable security objects that are selected based on the security issue and parameters of the specific network device(s) that will be implementing the security feature. The system and method may include a plurality of executable security objects configured to provide security for operations associated with multiple network devices communication over the network.

Claims

1. A method of managing network security comprising:

storing a plurality of executable security objects configured to provide security for network devices via a security manager processor;

receiving, at the security manager processor from a security agent, an indication of at least one detected security issue for at least one network device, wherein the security agent detects the at least one security issue by receiving a request for operational security or by detecting at least one condition indicating that a security has fallen below a predetermined level;

polling via the security manager processor at least one other network device in response to the indication when the security manager processor determines that additional information is needed;

selecting, via the security manager processor, at least one executable security object from the plurality of executable security objects responsive to the indication to address the at least one detected security issue; and

initiating communication of the at least one executable security object to the at least one network device.

2. The method of claim 1, further comprising executing the at least one executable security object at the at least one network device to provide security for the at least one network device.

3. The method of claim 1, wherein the at least one network device is located at one of a customer site or a central office.

4. The method of claim 1, wherein the at least one executable security object provides one of a virtual private network connection, a firewall, intrusion detection, content filtering, anti-virus protection, intrusion prevention, operational feedback, a software inventory and secure communications.

5. The method of claim 1, further comprising detecting that the at least one executable security object has been received at the at least one network device.

6. The method of claim 1, further comprising detecting that the at least one executable security object is operable at the at least one network device.

7. The method of claim 1, further comprising selecting the at least one executable security object responsive to one of network parameters, network criteria, and a security threat.

8. The method of claim 1, wherein selecting the at least one executable security object is based at least in part on parameters of the at least one network device including one or more of physical location, an address, a device identifier, a device capability, a device feature, a security status, a security level, and a software revision indicator.

9. The method of claim 1, further comprising linking the plurality of executable security objects to security engines that can execute the executable security objects.

10. A network based security system comprising:

an interface operable to receive a signal from at least one network device configured to communicate data via a public communication network;

at least one processor coupled to the interface; and

a memory coupled to the at least one processor, the memory including instructions that, when executed by the at least one processor, cause the at least one processor to;

instruct a security agent to detect at least one security issue for the at least one network device by receipt of a request for operational security or by detection of at least one condition indicating that a security has fallen below a predetermined level; and

instruct a security manager communicatively coupled to the security agent to;

receive notice of the at least one security issue for the at least one network device from the security agent;

poll at least one other network device in response to the notice when the security manager determines that additional information is needed; and

provide at least one security feature to the at least one network device to address the at least one security issue.

11. The system of claim 10, wherein the security agent administrates implementation of the at least one security feature.

12. The system of claim 11, wherein providing the at least one security feature comprises at least one of identifying newly connected network devices, verifying security feature availability, parsing a security service profile from the security manager into a configuration useable by security devices, acknowledging receipt of security features, notifying the security manager of an implementation or notifying the security manager of a condition of the operational security.

13. The system of claim 10, wherein a first customer site is coupled to a first central office and a second customer site is coupled to a second central office, wherein the security manager provides a security feature to the first customer site and the second customer site to enable secure communications from the first customer site to the second customer site.

14. The system of claim 10, wherein a first customer site is coupled to the security agent, and wherein the security agent provides security for the first customer site.

15. A non-transitory computer readable medium comprising instructions executable by a processor to:

store a plurality of executable security objects at an operations center, the security objects configured to provide security for network devices;

receive an indication of at least one detected security issue for at least one network device from a security agent, wherein the security agent detects the at least one security issue via a request for operational security or by detection of at least one condition indicating that a security has fallen below a predetermined level;

poll at least one other network device in response to the indication when the processor determines that additional information is needed;

select at least one executable security object from the plurality of executable security objects responsive to the indication to address the at least one detected security issue;

send the selected at least one executable security object to the at least one network device.

16. The non-transitory computer readable medium of claim 15, further including instructions executable by the processor to provide one of a virtual private network connection, a firewall, intrusion detection, content filtering, anti-virus protection, intrusion prevention, and secure communications.

17. The non-transitory computer readable medium of claim 15, further including instructions executable by the processor to determine that the at least one executable security object is operable at the at least one network device.

18. The non-transitory computer readable medium of claim 15, further including instructions executable by the processor to:

create a security profile having at least two executable security objects; and

parse the security profile into device specific executable security objects.

19. The non-transitory computer readable medium of claim 15, further including instructions executable by the processor to receive an acknowledge receipt of the security object from the at least one network device.

20. The non-transitory computer readable medium of claim 15, wherein the security agent provides security for at least a first customer site.