Method and system for security policy management

• US 20030014644A1
• Filed: 05/02/2002
• Published: 01/16/2003
• Est. Priority Date: 05/02/2001
• Status: Abandoned Application

• Current Assignee: Telcordia Technologies Incorporated (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Telcordia Technologies Incorporated (Telefonaktiebolaget LM Ericsson)
• Inventors: Gurung, Provin, Rajagopalan, Siva, Burns, James E., Varadarajan, Surendran, Cheng, Aileen, Rao, Prasad
• Application Number:
  US10/137,795
• Publication Number:
  US 20030014644A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The conformance of a network to a set of security policy statements is determined by attempting to violate the policies by routing packets through models of network elements. Policy statements specify whether a set of clients is granted or denied access to a network service offered by a set of servers. Network element models are in accordance to the element'"'"'s configurable parameters and supported services, which together indicate how the element will treat packets when the element'"'"'s current configuration is applied to the model. Conformance to a policy statement is determined by building a packet in accordance with the network service and a representative network-element client and server, and by attempting to move the packet from the client to the server by applying the packet to the network element models. Policy conformance is based on whether the packet reaches the service on the server. Network reconfigurations are determined for non-conformant policies.

Claims

1. A method for determining whether a network comprising a plurality of network elements is conformant to a policy statement, wherein the policy statement indicates whether a set of clients is denied or granted access to a network-service supported by a set of servers, the method comprising the steps of:

building a topology and model of the network, wherein said model comprises a plurality of service models corresponding to the network elements, and wherein said service models indicate how the network elements will treat network packets,

identifying a first network element from the set of clients and a second network element from the set of servers,

building a packet in accordance with the network-service and the identified first and second network elements,

attempting to move the packet from the first network element to the second network element by applying the packet to the network element service models, and

based on whether the packet reaches the server, indicating whether the network is conformant to the policy statement.

2. The method of claim 1 wherein if the network is not conformant to the policy statement, determining a network configuration to make the network conformant to the policy statement.