Security system for a computer network having a security subsystem and a master system which monitors the integrity of a security subsystem

• US 8,261,347 B2
• Filed: 09/04/2008
• Issued: 09/04/2012
• Est. Priority Date: 01/25/2001
• Status: Active Grant

• Current Assignee: NTT Security (US) Inc. (Nippon Telegraph and Telephone Corporation)
• Original Assignee: Solutionary, Inc (Nippon Telegraph and Telephone Corporation)
• Inventors: Hrabik, Michael, Guilfoyle, Jeffrey J., Beaver, Edward Mac
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Jackson, Jenise E
• Application Number:
  US12/204,573
• Publication Number:
  US 20080320586A1
• Time in Patent Office: 1,461 Days
• Field of Search: 726 22- 25
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security system for a computer network that has a plurality of devices connected thereto comprises a security subsystem, a master system and a secure link. The security subsystem is connected to at least some of the devices in the network. The security subsystem is configured to monitor activities of the at least some devices on the network and detect attacks on the at least some devices. The master system monitors the integrity of the security subsystem and registers information pertaining to attacks detected by the security subsystem. The secure link is connected between the security subsystem and the master system. The master system monitors the integrity of the security subsystem and receives the information pertaining to the attacks through the secure link.

Claims

1. A security system for a computer network, the network having a plurality of devices connected thereto, at least some of the devices having security-related functions, the security system comprising:

(a) a security subsystem implemented on a first computer, the security subsystem being associated with at least some of the devices in the network which tests the integrity of the security-related functions;

(b) a master system implemented on a second computer which is different from the first computer, the master system monitoring the integrity of the security subsystem and receiving and storing results of the integrity testing of the devices having security-related functions; and

(c) a secure link connected between the security subsystem and the master system, the master system monitoring the integrity of the security subsystem and receiving the results of the integrity testing of the devices having security-related functions through the secure link.

2. The system of claim 1 wherein the secure link is defined by a virtual private network (VPN) tunnel.

3. The system of claim 1 wherein at least one of the devices having security-related functions is a firewall.

4. The system of claim 1 wherein at least one of the devices having security-related functions is a network intrusion detection system.

6. The system of claim 1 wherein the master system has no connection to the network other than via the secure link.

5. A security system for a computer network, the computer network having a plurality of devices connected thereto, the security system comprising:

(a) a security subsystem implemented on a first computer, the security subsystem being connected to at least some of the devices in the computer network, the security subsystem configured to monitor activities of the at least some devices on the computer network and detect attacks on the at least some devices, wherein the security system is on a first network;

(b) a master system implemented on a second computer which is different from the first computer, the master system monitoring the integrity of the security subsystem and registering information pertaining to attacks detected by the security subsystem, wherein the master system is on a second network that is different from the first network; and

(c) a first secure link connected between the security subsystem and the master system, the master system monitoring the integrity of the security subsystem and receiving the information pertaining to the attacks through the first secure link.

7. The system of claim 5 wherein the master system has no connection to the network other than via the first secure link.

8. The system of claim 5 wherein the master system does not take direction from the security subsystem.

9. The system of claim 5 further comprising:

(d) a second secure link connected between the master system and the network which enables data communication from the master system to the network for issuing instructions to the network devices.

10. The system of claim 5 wherein the master system is hierarchically independent from the security subsystem.

11. The system of claim 5 wherein the security subsystem is hierarchically subordinate to the master system.

12. The system of claim 5 wherein the first secure link is defined by a virtual private network (VPN) tunnel.

13. The system of claim 5 wherein the master system further comprises a pseudo-attack generator which generates attacks on the network, the security subsystem detecting such attacks when functioning properly, the master system comparing the pseudo-attacks made on the network to the attacks actually detected by the security subsystem, the master system thereby determining whether the integrity of the subsystem has been compromised.