Security orchestration framework

• US 9,807,118 B2
• Filed: 06/27/2015
• Issued: 10/31/2017
• Est. Priority Date: 10/26/2014
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Nadkarni, Hemang
• Primary Examiner(s): Brown, Anthony
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US14/752,867
• Publication Number:
  US 20160119379A1
• Time in Patent Office: 857 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/03 Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In an example, there is disclosed a computing apparatus, including: a network interface; one or more logic elements providing a security orchestration server engine operable for: receiving contextual data from a client via a network interface; providing the contextual data to a security orchestration state machine, the security orchestration state machine operable for deriving a policy decision from the contextual data; and receiving the policy decision from the policy orchestration state machine. There is also disclosed one or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for providing a security orchestration engine, and a method of providing a security orchestration engine.

Claims

1. A computing apparatus, comprising:

a network interface to communicatively couple the apparatus to an enterprise service bus (ESB);

one or more logic elements comprising a security orchestration server engine operable for;

receiving contextual data from a client via the ESB;

providing the contextual data to a security orchestration state machine, the security orchestration state machine operable for deriving a policy decision from the contextual data; and

receiving the policy decision from the policy orchestration state machine.

2. The computing apparatus of claim 1, wherein the security orchestration server engine is further operable for enforcing the policy decision.

3. The computing apparatus of claim 2, wherein enforcing the policy decision comprises sending an enforcement message to the client via the ESB.

4. The computing apparatus of claim 1, wherein the ESB is a data exchange layer (DXL).

5. The computing apparatus of claim 3, wherein sending the enforcement message to the client comprises sending the message via an application programming interface (API), wherein the API is agnostic of implementation of the enforcement on the client.

6. The computing apparatus of claim 2, wherein enforcing the policy decision comprises jointly enforcing the policy with a second device.

7. The computing apparatus of claim 1, wherein deriving a policy decision from the contextual data comprises receiving a policy objective comprising a result-oriented declaration of the policy decision.

8. The computing apparatus of claim 1, wherein receiving contextual data from the client via the network interface comprises receiving the contextual data via an application programming interface (API), wherein the API is agnostic of implementation of the contextual data.

9. The computing apparatus of claim 1, wherein the network interface is a data exchange layer (DXL) interface.

10. The apparatus of claim 9, wherein receiving contextual data comprises receiving a DXL message.

11. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for providing a security orchestration server engine operable for:

receiving contextual data from a client via an enterprise service bus (ESB);

providing the contextual data to a security orchestration state machine, the security orchestration state machine operable for deriving a policy decision from the contextual data; and

receiving the policy decision from the policy orchestration state machine.

12. The one or more tangible, non-transitory computer-readable storage mediums of claim 11, wherein the security orchestration server engine is further operable for enforcing the policy decision.

13. The one or more tangible, non-transitory computer-readable storage mediums of claim 12, wherein enforcing the policy decision comprises sending an enforcement message to the client.

14. The one or more tangible, non-transitory computer-readable storage mediums of claim 13, wherein the enforcement message is a data exchange layer (DXL) message.

15. The one or more tangible, non-transitory computer-readable storage mediums of claim 13, wherein sending the enforcement message to the client comprises sending the message via an application programming interface (API), wherein the API is agnostic of implementation of the enforcement on the client.

16. The one or more tangible, non-transitory computer-readable storage mediums of claim 12, wherein enforcing the policy decision comprises jointly enforcing the policy with a second device.

17. The one or more tangible, non-transitory computer-readable storage mediums of claim 11, wherein deriving a policy decision from the contextual data comprises receiving a policy objective comprising a result-oriented declaration of the policy decision.

18. The one or more tangible, non-transitory computer-readable storage mediums of claim 11, wherein receiving contextual data from the client via the ESB comprises receiving the contextual data via an application programming interface (API), wherein the API is agnostic of implementation of the contextual data.

19. The one or more tangible, non-transitory computer-readable storage mediums of claim 11, wherein the ESB is a data exchange layer (DXL) interface.

20. The one or more tangible, non-transitory computer-readable storage mediums of claim 11, wherein receiving contextual data comprises receiving a DXL message.