Security device controller

• US 9,648,047 B2
• Filed: 04/29/2016
• Issued: 05/09/2017
• Est. Priority Date: 02/07/2013
• Status: Active Grant

• Current Assignee: Infoblox Incorporated
• Original Assignee: Infoblox Incorporated
• Inventors: Kirby, Jason A., Belamaric, John Dominic, Tur, Francois J., Troillard, Christophe
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/143,149
• Publication Number:
  US 20160308908A1
• Time in Patent Office: 375 Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In some embodiments, a security device controller (SDC) is provided. In some embodiments, a security device controller includes receiving a configuration policy in a vendor neutral language; and automatically configuring a plurality of security devices on a heterogeneous network based on the configuration policy. For example, the plurality of security devices can include physical, virtual, or software defined network (SDN) based routers and/or firewalls, and the heterogeneous network can include security devices from a plurality of different vendors.

Claims

1. A system for a security device controller, comprising:

a hardware processor; and

a memory coupled with the hardware processor, wherein the memory is configured to provide the processor with instructions which when executed cause the hardware processor to;

receive a configuration policy in a vendor neutral language;

determine whether the configuration policy causes a configuration change to at least one security device of a plurality of security devices that violates a general or higher precedential rule of the configuration policy; and

in the event that the configuration policy does not cause the configuration change to the at least one security device of the plurality of security devices that violates the general or higher precedential rule of the configuration policy, automatically configure the plurality of security devices on a heterogeneous network based on the configuration policy, wherein the heterogeneous network includes different firewall devices from a plurality of different vendors, and wherein a firewall policy defined using the security device controller is automatically translated by the security device controller into a native language for each of the different firewall devices that can be implemented by each of the different firewall devices from each respective vendor of the plurality of different vendors.

2. The system of claim 1, wherein the plurality of security devices includes physical, virtual, or software defined network (SDN) based routers, firewalls, or both, and wherein the heterogeneous network includes security devices from a plurality of different vendors.

3. The system of claim 1, wherein the hardware processor is further configured to:

automatically translate the vendor neutral language into a plurality of vendor specific languages for automatically configuring the plurality of security devices on the network based on the configuration policy.

4. The system of claim 1, wherein the security device controller facilitates provisioning security devices.

5. The system of claim 1, wherein the security device controller facilitates provisioning security devices, including physical security devices, virtual security devices, software defined networks (SDN) based networks, or any combination thereof.

6. The system of claim 1, wherein the heterogeneous network includes security devices from a plurality of different vendors, and wherein the hardware processor is further configured to:

generate a report on the configured security devices on the heterogeneous network.

7. A method for a security device controller, comprising:

receiving a configuration policy in a vendor neutral language;

determining whether the configuration policy causes a configuration change to at least one security device of a plurality of security devices that violates a general or higher precedential rule of the configuration policy; and

in the event that the configuration policy does not cause the configuration change to the at least one security device of the plurality of security devices that violates the general or higher precedential rule of the configuration policy, automatically configuring the plurality of security devices on a heterogeneous network based on the configuration policy, wherein the heterogeneous network includes different firewall devices from a plurality of different vendors, and wherein a firewall policy defined using the security device controller is automatically translated by the security device controller into a native language for each of the different firewall devices that can be implemented by each of the different firewall devices from each respective vendor of the plurality of different vendors.

8. The method of claim 7, wherein the plurality of security devices includes physical, virtual, or software defined network (SDN) based routers, firewalls, or both, and wherein the heterogeneous network includes security devices from a plurality of different vendors.

9. The method of claim 7, further comprising:

automatically translating the vendor neutral language into a plurality of vendor specific languages for automatically configuring the plurality of security devices on the network based on the configuration policy.

10. The method of claim 7, wherein the security device controller facilitates provisioning security devices.

11. The method of claim 7, wherein the security device controller facilitates provisioning security devices, including physical security devices, virtual security devices, software defined networks (SDN) based networks, or any combination thereof.

12. A computer program product for a security device controller, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a configuration policy in a vendor neutral language;

determining whether the configuration policy causes a configuration change to at least one security device of a plurality of security devices that violates a general or higher precedential rule of the configuration policy; and

in the event that the configuration policy does not cause the configuration change to the at least one security device of the plurality of security devices that violates the general or higher precedential rule of the configuration policy, automatically configuring the plurality of security devices on a heterogeneous network based on the configuration policy, wherein the heterogeneous network includes different firewall devices from a plurality of different vendors, and wherein a firewall policy defined using the security device controller is automatically translated by the security device controller into a native language for each of the different firewall devices that can be implemented by each of the different firewall devices from each respective vendor of the plurality of different vendors.

13. The computer program product recited in claim 12, wherein the plurality of security devices includes physical, virtual, or software defined network (SDN) based routers, firewalls, or both, and wherein the heterogeneous network includes security devices from a plurality of different vendors.

14. The computer program product recited in claim 12, further comprising computer instructions for:

automatically translating the vendor neutral language into a plurality of vendor specific languages for automatically configuring the plurality of security devices on the network based on the configuration policy.

15. The computer program product recited in claim 12, wherein the security device controller facilitates provisioning security devices.

16. The computer program product recited in claim 12, wherein the security device controller facilitates provisioning security devices, including physical security devices, virtual security devices, software defined networks (SDN) based networks, or any combination thereof.