Method and system for simulating computer networks to facilitate testing of computer network security

• US 20030212908A1
• Filed: 05/10/2002
• Published: 11/13/2003
• Est. Priority Date: 05/10/2002
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Piesco, Albert L.
• Granted Patent: US 7,379,857 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method and system for simulating computer networks and computer network components to test computer network security is disclosed. A user specifies a desired configuration of a simulated computer network by using a configuration manager. The user also defines all the network components within the simulated computer network by specifying whether a component should be provided in hardware or should be simulated via software. Upon receiving the above-mentioned information from the user, the configuration manager acquires the required hardware resources from a hardware inventory. The configuration manager utilizes an interface switch that connects the hardware in the hardware inventory to produce the desired network layout. Next, the specified configuration for each of the network components is pushed into the acquired hardware resources. Computer network components to be simulated with software are subsequently initialized by the configuration manager. At this point, the user can use the simulated computer network for real-time testing of network security.

Claims

1. A method for simulating a computer network in order to facilitate testing computer network security, said method comprising:

providing a hardware inventory of physical network components;

providing a software library of simulated network components;

in response to the receipt of a computer network configuration to be simulated, acquiring physical network components from said hardware inventory and simulated network components from said software library;

configuring said acquired physical network components via an interface switch;

configuring said acquired simulated network components via a plurality of daemons; and

performing computer network security tests on said simulated computer network in real-time.

2. The method of claim 1, wherein said method further includes pushing configuration on said acquired physical network components.

3. The method of claim 1, wherein said hardware inventory includes one or more routers.

4. The method of claim 1, wherein said hardware inventory includes one or more firewalls.

5. The method of claim 1, wherein said hardware inventory includes one or more workstations.

6. The method of claim 1, wherein said interface switch is a virtual local-area network switch.

7. A computer program product residing on a computer usable medium for simulating a computer network in order to facilitate testing computer network security, said computer program product comprising:

program code means for providing a hardware inventory of physical network components;

program code means for providing a software library of simulated network components;

in response to the receipt of a computer network configuration to be simulated and network components for said simulated computer network, program code means for acquiring physical network components from said hardware inventory and simulated network components from said software library;

program code means for configuring said acquired physical network components via an interface switch;

program code means for configuring said acquired simulated network components via a plurality of daemons; and

program code means for performing computer network security tests on said simulated computer network in real-time.

8. The computer program product of claim 7, wherein said computer program product further includes program code means for pushing configuration on said acquired physical network components.

9. The computer program product of claim 7, wherein said hardware inventory includes one or more routers.

10. The computer program product of claim 7, wherein said hardware inventory includes one or more firewalls.

11. The computer program product of claim 7, wherein said hardware inventory includes one or more workstations.

12. The computer program product of claim 7, wherein said interface switch is a virtual local-area network switch.

13. A computer system for simulating a computer network in order to facilitate testing computer network security, said computer system comprising:

an inventory of physical computer network components;

a software library containing a plurality of simulated computer network components;

a configuration manager to allow a user to specify a desired configuration of a simulated computer network; and

an interface switch for establishing logical links between said configuration manager and at least one of said computer network components within said inventory of physical computer network components.

14. The computer system of claim 13, wherein said inventory of physical computer network components includes one or more routers.

15. The computer system of claim 13, wherein said inventory of physical computer network components includes one or more firewalls.

16. The computer system of claim 13, wherein said inventory of physical computer network components includes one or more workstations.

17. The computer system of claim 13, wherein said interface switch is a virtual local-area network switch.

18. The computer system of claim 13, wherein said configuration manager includes a network/system configuration module, a network/system management module and a scenario builder module.