Automatically generating rules for connection security

• US 8,490,153 B2
• Filed: 11/08/2011
• Issued: 07/16/2013
• Est. Priority Date: 07/15/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bassett, Charles D., Yariv, Eran, Carbaugh, Ian M., Koppolu, Lokesh Srinivas, Noy, Maksim, Wahlert, Sarah A., Bahl, Pradeep
• Primary Examiner(s): LOUIE, OSCAR A
• Application Number:
  US13/292,018
• Publication Number:
  US 20120054825A1
• Time in Patent Office: 616 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system for creating security policies for firewall and connection policies in an integrated manner is provided. The security system provides a user interface through which a user can define a security rule that specifies both a firewall policy and a connection policy. After the security rule is specified, the security system automatically generates a firewall rule and a connection rule to implement the security rule. The security system provides the firewall rule to a firewall engine that is responsible for enforcing the firewall rules and provides the connection rule to an IPsec engine that is responsible for enforcing the connection rules.

Claims

1. A computer-readable storage device storing computer-executable instructions for controlling a computer system to create a firewall policy and a connection policy, the computer-executable instructions for performing steps comprising:

providing security rules of a security policy of an enterprise;

automatically generating by the computer system firewall rules and connection rules from the provided security rules, the firewall rules and the connection rules being lower level rules than the security rules, the generated firewall rules for input into a firewall engine of enterprise computing devices and specifying addresses of computing devices that are authorized to send data to the enterprise computing devices and the generated connection rules for input into an Internet protocol security engine of the enterprise computing devices and specifying an authentication protocol for authenticating a computing device that sends data to the enterprise computing devices; and

distributing the firewall rules and the connection rules to the enterprise computing devices to implement the security policy of the enterprise.

2. The computer-readable storage device of claim 1 wherein the generated connection rules further specify a confidentiality protocol and an integrity protocol for ensuring the confidentiality and integrity of data sent to the enterprise computing devices.

3. The computer-readable storage device of claim 1 wherein a connection rule specifies behavior of the IP security protocol.

4. The computer-readable storage device of claim 1 wherein a connection rule specifies key exchange, data protection, and authentication associated with a connection.

5. A computer-readable storage device storing computer-executable instructions for controlling a computer system to create a firewall policy and a connection policy, the computer-executable instructions for performing steps comprising:

providing security rules of a security policy of an enterprise; and

automatically generating by the computer system firewall rules and connection rules from the provided security rules, the firewall rules and the connection rules being lower level rules than the security rules, the generated firewall rules for input into a firewall engine of enterprise computing devices and specifying addresses of computing devices that are authorized to send data to the enterprise computing devices and the generated connection rules for input into an Internet protocol security engine of the enterprise computing devices and specifying an authentication protocol for authenticating a computing device that sends data to the enterprise computing devices wherein outbound connection rules are automatically generated based on inbound connection rules so that the enterprise computing systems have matching inbound and outbound security suites.

6. A computer system that automatically generates a firewall policy and a connection policy based on a security policy of an enterprise, the security policy having security rules, the security rules being higher level rules than the firewall rules and the connection rules, the computer system comprising:

a memory storing computer-executable instructions of;

a component that accesses the security rules of the security policy;

a component that automatically generates firewall rules from the security rules for input into a firewall engine of a target computing device, the generated firewall rules specifying addresses of computing devices that are authorized to send data to the target computing device;

a component that automatically generates connection rules from the security rules of the security policy for input into an Internet protocol security engine of the target computing device, the generated connection rules specifying an authentication protocol for authenticating a computing device that sends data to the target computing device; and

a component that distributes the firewall rules and the connection rules to target computing devices to implement the security policy of the enterprise; and

a processor that executes the computer-executable instructions stored in the memory.

7. The computer system of claim 6 wherein the connection rules further specify a confidentiality protocol and an integrity protocol for ensuring the confidentiality and integrity of data sent to the target computing device.

8. The computer system of claim 6 wherein a connection rule specifies behavior of the IP security protocol.

9. The computer system of claim 6 wherein a connection rule specifies key exchange, data protection, and authentication associated with a connection.

10. The computer system of claim 6 wherein a security rule specifies a condition and an action to take when the condition is satisfied and authentication and encryption behavior for data that satisfies the condition and wherein a firewall rule includes a condition and action to take when the condition is satisfied and the condition based on connection security information.

11. A computer system that automatically generates a firewall policy and a connection policy based on a security policy of an enterprise, the security policy having security rules, the security rules being higher level rules than the firewall rules and the connection rules, the computer system comprising:

a memory storing computer-executable instructions of;

a component that accesses the security rules of the security policy;

a component that automatically generates firewall rules from the security rules for input into a firewall engine of a target computing device of the enterprise, the generated firewall rules specifying addresses of computing devices that are authorized to send data to the target computing device; and

a component that automatically generates connection rules from the security rules of the security policy for input into an Internet protocol security engine of the target computing device, the generated connection rules specifying an authentication protocol for authenticating a computing device that sends data to the target computing device wherein outbound connection rules are automatically generated based on inbound connection rules so that the target computing devices of the enterprise have matching inbound and outbound security suites; and

a processor that executes the computer-executable instructions stored in the memory.