Automatically generating rules for connection security
First Claim
1. A computer-readable storage device storing computer-executable instructions for controlling a computer system to create a firewall policy and a connection policy, the computer-executable instructions for performing steps comprising:
- providing security rules of a security policy of an enterprise;
automatically generating by the computer system firewall rules and connection rules from the provided security rules, the firewall rules and the connection rules being lower level rules than the security rules, the generated firewall rules for input into a firewall engine of enterprise computing devices and specifying addresses of computing devices that are authorized to send data to the enterprise computing devices and the generated connection rules for input into an Internet protocol security engine of the enterprise computing devices and specifying an authentication protocol for authenticating a computing device that sends data to the enterprise computing devices; and
distributing the firewall rules and the connection rules to the enterprise computing devices to implement the security policy of the enterprise.
1 Assignment
0 Petitions
Accused Products
Abstract
A method and system for creating security policies for firewall and connection policies in an integrated manner is provided. The security system provides a user interface through which a user can define a security rule that specifies both a firewall policy and a connection policy. After the security rule is specified, the security system automatically generates a firewall rule and a connection rule to implement the security rule. The security system provides the firewall rule to a firewall engine that is responsible for enforcing the firewall rules and provides the connection rule to an IPsec engine that is responsible for enforcing the connection rules.
-
Citations
11 Claims
-
1. A computer-readable storage device storing computer-executable instructions for controlling a computer system to create a firewall policy and a connection policy, the computer-executable instructions for performing steps comprising:
-
providing security rules of a security policy of an enterprise; automatically generating by the computer system firewall rules and connection rules from the provided security rules, the firewall rules and the connection rules being lower level rules than the security rules, the generated firewall rules for input into a firewall engine of enterprise computing devices and specifying addresses of computing devices that are authorized to send data to the enterprise computing devices and the generated connection rules for input into an Internet protocol security engine of the enterprise computing devices and specifying an authentication protocol for authenticating a computing device that sends data to the enterprise computing devices; and distributing the firewall rules and the connection rules to the enterprise computing devices to implement the security policy of the enterprise. - View Dependent Claims (2, 3, 4)
-
-
5. A computer-readable storage device storing computer-executable instructions for controlling a computer system to create a firewall policy and a connection policy, the computer-executable instructions for performing steps comprising:
-
providing security rules of a security policy of an enterprise; and automatically generating by the computer system firewall rules and connection rules from the provided security rules, the firewall rules and the connection rules being lower level rules than the security rules, the generated firewall rules for input into a firewall engine of enterprise computing devices and specifying addresses of computing devices that are authorized to send data to the enterprise computing devices and the generated connection rules for input into an Internet protocol security engine of the enterprise computing devices and specifying an authentication protocol for authenticating a computing device that sends data to the enterprise computing devices wherein outbound connection rules are automatically generated based on inbound connection rules so that the enterprise computing systems have matching inbound and outbound security suites.
-
-
6. A computer system that automatically generates a firewall policy and a connection policy based on a security policy of an enterprise, the security policy having security rules, the security rules being higher level rules than the firewall rules and the connection rules, the computer system comprising:
-
a memory storing computer-executable instructions of; a component that accesses the security rules of the security policy; a component that automatically generates firewall rules from the security rules for input into a firewall engine of a target computing device, the generated firewall rules specifying addresses of computing devices that are authorized to send data to the target computing device; a component that automatically generates connection rules from the security rules of the security policy for input into an Internet protocol security engine of the target computing device, the generated connection rules specifying an authentication protocol for authenticating a computing device that sends data to the target computing device; and a component that distributes the firewall rules and the connection rules to target computing devices to implement the security policy of the enterprise; and a processor that executes the computer-executable instructions stored in the memory. - View Dependent Claims (7, 8, 9, 10)
-
-
11. A computer system that automatically generates a firewall policy and a connection policy based on a security policy of an enterprise, the security policy having security rules, the security rules being higher level rules than the firewall rules and the connection rules, the computer system comprising:
-
a memory storing computer-executable instructions of; a component that accesses the security rules of the security policy; a component that automatically generates firewall rules from the security rules for input into a firewall engine of a target computing device of the enterprise, the generated firewall rules specifying addresses of computing devices that are authorized to send data to the target computing device; and a component that automatically generates connection rules from the security rules of the security policy for input into an Internet protocol security engine of the target computing device, the generated connection rules specifying an authentication protocol for authenticating a computing device that sends data to the target computing device wherein outbound connection rules are automatically generated based on inbound connection rules so that the target computing devices of the enterprise have matching inbound and outbound security suites; and a processor that executes the computer-executable instructions stored in the memory.
-
Specification