Methods, systems, and computer program products for managing firewall change requests in a communication network

• US 9,154,462 B2
• Filed: 12/22/2009
• Issued: 10/06/2015
• Est. Priority Date: 12/22/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Grimes, Robert Preston, Luther, Kevin W., Hiemstra, Shawn M.
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Asres, Hermon
• Application Number:
  US12/644,326
• Publication Number:
  US 20110154470A1
• Time in Patent Office: 2,114 Days
• Field of Search: 709/213, 709/221, 726/11
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of managing firewall change requests for a communication network includes providing a change request interface comprising a plurality of change request form types, each request form including an interface for entering requestor identification information, Internet Protocol (IP) address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change, receiving completed change request forms from at least one requestor, arranging the completed change request forms in a request queue, and presenting the request queue to at least one administrator responsible for implementing firewall changes in the communication network.

Claims

1. A method of managing firewall change requests for a communication network, comprising:

providing a change request interface comprising a plurality of change request form types, each request form comprising an interface for entering requestor identification information, internet protocol address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change, wherein the plurality of change request form types comprises the following request types;

a standard source to destination request, an internet protocol address modification to existing firewall rules request, a file transfer protocol account request, a custom request, a network address translation modification request, and a modification associated with a group of associated internet protocol addresses,

receiving completed change request forms from a requestor,

arranging the completed change request forms in a request queue,

presenting the request queue to an administrator responsible for implementing firewall changes in the communication network,

identifying an application affected by the firewall changes in the communication network;

sending a notification to an individual responsible for the application informing the individual that the application is affected by the firewall changes;

inserting a firewall security node in a topology of the communication network; and

providing an intuitive representation of the existing firewall rules affected by the internet protocol address received through the internet protocol address modification to existing firewall rules request.

2. The method of claim 1, wherein the request queue comprises one of the following types of information for each of the completed change request forms:

date information, time information, the requestor identification information, tester information, affected firewall information, and change request status information.

3. The method of claim 1, further comprising:

sending notifications to the requestor associated with each of the completed change request forms, respectively, wherein each of the notifications comprises status information associated with the change request.

4. The method of claim 1, further comprising:

communicating with a firewall in the communication network regarding one of internet protocol address information, policy information, and rule information.

7. The method of claim 1, further comprising:

defining a group of associated internet protocol addresses;

wherein one of the completed change request forms comprises the group of associated internet protocol addresses.

8. The method of claim 7, wherein the group is defined by the requestor for use in the change request form.

9. The method of claim 7, wherein the group is defined by the administrator for use by the requestor in the change request form.

5. A system for managing firewall change requests in a communication network comprising:

a processor; and

a memory coupled to the processor, the memory comprising computer readable program code that when executed by the processor causes the processor to perform operations comprising;

providing a change request interface comprising a plurality of change request form types, each request form comprising an interface for entering requestor identification information, internet protocol address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change, wherein the plurality of change request form types comprises the following request types;

a standard source to destination request, an internet protocol address modification to existing firewall rules request, a file transfer protocol account request, a custom request, a network address translation modification request, and a modification associated with a group of associated internet protocol addresses,

receiving completed change request forms from a requestor,

arranging the completed change request forms in a request queue,

presenting the request queue to an administrator responsible for implementing firewall changes in the communication network,

identifying an application affected by the firewall changes in the communication network;

sending a notification to an individual responsible for the application informing the individual that the application is affected by the firewall changes;

inserting a firewall security node in a topology of the communication network; and

providing an intuitive representation of the existing firewall rules affected by the internet protocol address received through the internet protocol address modification to existing firewall rules request.

6. A computer program product for managing firewall change requests in a communication network, comprising:

a non-transitory computer readable storage medium having computer readable program code embodied in the medium, the computer readable program code when executed by a processor causing the process to perform operations comprising;

providing a change request interface comprising a plurality of change request form types, each request form comprising an interface for entering requestor identification information, internet protocol address information, change implementation schedule information, and submission information specifying any requestor instructions for implementing the change, wherein the plurality of change request form types comprises the following request types;

a standard source to destination request, an internet protocol address modification to existing firewall rules request, a file transfer protocol account request, a custom request, a network address translation modification request, and a modification associated with a group of associated internet protocol addresses,

receiving completed change request forms from a requestor,

arranging the completed change request forms in a request queue,

presenting the request queue to an administrator responsible for implementing firewall changes in the communication network,

identifying an application affected by the firewall changes in the communication network;

sending a notification to an individual responsible for the application informing the individual that the application is affected by the firewall changes;

inserting a firewall security node in a topology of the communication network; and

providing an intuitive representation of the existing firewall rules affected by the internet protocol address received through the internet protocol address modification to existing firewall rules request.