Method and apparatus for enforcing network security policies

• US 20040064727A1
• Filed: 09/30/2002
• Published: 04/01/2004
• Est. Priority Date: 09/30/2002
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Yadav, Satyendra
• Granted Patent: US 7,448,067 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention is a system and method for applying a uniform network security policy. The security policy is described using a computer-readable file. The computer-readable file may be filtered and/or translated into other files that may be used as inputs to security devices. An example of one such security device is a remote system security controller, which is responsible for ensuring that remote devices outside the corporate network enforce the corporate security policy. In addition, the system is capable of updating the security policy of all network components based on feedback received from one or more devices.

Claims

1. A system for establishing a security policy for a network, comprising:

a network;

a first machine-accessible file representing a network-wide security policy on the network;

first and second security tools connected to the network; and

a translator operative to translate the first machine-accessible file into second and third machine-accessible files for the first and second security tools, respectively.

2. A system according to claim 1, wherein the first and second security tools are drawn from a set including a proxy server, a firewall, a intrusion detection system, a logging/monitoring device, and a remote system security controller.

3. A system according to claim 1, wherein the translator includes a filter operative to filter a first entry in the first machine-accessible file from the second machine-accessible file, and to filter a second entry in the first machine-accessible file from the third machine-accessible file.

4. A system according to claim 1, further comprising a centralized security manager.

5. A system according to claim 4, wherein:

the system further comprises a feedback issued by at least one of the first and second security tools; and

the centralized security manager is operative to update the first machine-accessible file responsive to the feedback.

6. A system for establishing a security policy for a network, comprising:

a network;

a first machine-accessible file representing a network-wide security policy on the network;

a proxy server connected to the network;

a firewall connected to the network;

an intrusion detection system connected to the network; and

a translator operative to translate the first machine-accessible file into second, third, and fourth machine-accessible files for the proxy server, firewall, and instruction detection system, respectively.

7. A system according to claim 6, wherein:

the system further comprises a remote system security controller; and

the translator is operative to translate the first machine-accessible file into a fifth machine-accessible file for the remote system security controller.

8. A system according to claim 6, wherein:

the system further comprises a logging/monitoring device; and

the translator is operative to translate the first machine-accessible file into a sixth machine-accessible file for the logging/monitoring device.

9. An apparatus for establishing a security policy for a network, comprising:

a first machine-accessible file representing a network-wide security policy on the network;

a translator operative to translate the first machine-accessible file into second and third machine-accessible files for use with first and second security tools, respectively; and

a machine operative to access the first machine-accessible file, to use the translator to produce the second and third machine-accessible files, and to use the second and third machine-accessible files to operate the first and second security tools.

10. An apparatus according to claim 9, wherein the translator includes a filter operative to filter a first entry in the first machine-accessible file from the second machine-accessible file, and to filter a second entry in the first machine-accessible file from the third machine-accessible file.

11. An apparatus according to claim 9, further comprising:

a feedback issued by at least one of the first and second security tools; and

a centralized security manager, operative to update the first machine-accessible file responsive to the feedback.

12. A method for enforcing security policy on a network, comprising:

generating a first machine-accessible file representing a network-wide security policy on a network;

translating the first machine-accessible file into second and third machine-accessible files for first and second security tools, respectively; and

applying the second and third machine-accessible files to the first and second security tools.

13. A method according to claim 12, wherein translating the first machine-accessible file includes filtering an entry in the first machine-accessible file from the second machine-accessible file.

14. A method according to claim 12, wherein translating the first machine-accessible file includes translating the first machine-accessible file from a first language to a second language recognizable to the first security tool.

15. A method according to claim 12, wherein applying the second and third machine-accessible files includes applying the second and third machine-accessible files to the first and second security tools drawn from a set including a proxy server, a firewall, an intrusion detection system, and a logging/monitoring device.

16. A method according to claim 12, further comprising:

receiving a feedback from at least one of the first and second security tools; and

updating the first machine-accessible file responsive to the feedback.

17. A method according to claim 12, wherein applying the second and third machine-accessible files includes applying the second machine-accessible file to a remote system security controller.

18. A method according to claim 17, the method further comprising:

receiving a request for a connection to the network from a device;

determining if the device includes a tool to enforce the security policy; and

granting the request for the connection to the network if the device includes the tool to enforce the security policy.

19. A method according to claim 18, the method further comprising denying the request for the connection to the network if the device lacks the tool to enforce the security policy.

20. A method according to claim 18, wherein receiving a request includes receiving the request for a wireless connection to the network from the device.

21. A method according to claim 18, wherein determining if the device includes a tool includes determining by the remote system security controller if the device includes at least an application monitoring tool, an intrusion detection tool, and a firewall tool.

22. A method according to claim 21, wherein determining if the device includes a tool further includes determining by the remote system security controller if the device includes a session logging tool.

23. A method according to claim 18, the method further comprising:

translating by the remote system security controller the second machine-accessible file into a fourth machine-accessible file for the tool on the device;

transmitting the fourth machine-accessible file to the device; and

applying the fourth machine-accessible file to the tool on the device.

24. A method according to claim 23, wherein applying the fourth machine-accessible file includes changing a setting in the tool on the device.

25. An article comprising a machine-accessible medium having associated data that, when accessed, results in a machine:

generating a first machine-accessible file representing a network-wide security policy on a network;

translating the first machine-accessible file into second and third machine-accessible files for first and second security tools, respectively; and

applying the second and third machine-accessible files to the first and second security tools.

26. An article according to claim 25, wherein the associated data for translating the first machine-accessible file includes associated data for filtering an entry in the first machine-accessible file from the second machine-accessible file.

27. An article according to claim 25, wherein the associated data for translating the first machine-accessible file includes associated data for translating the first machine-accessible file from a first language to a second language recognizable to the first security tool.

28. An article according to claim 25, wherein the associated data for applying the second and third machine-accessible files includes associated data for applying the second and third machine-accessible files to the first and second security tools drawn from a set including a proxy server, a firewall, an intrusion detection system, and a logging/monitoring device.

29. An article according to claim 25, the machine-accessible medium having further associated data that, when accessed, results in the machine:

receiving a feedback from at least one of the first and second security tools; and

updating the first machine-accessible file responsive to the feedback.

30. An article according to claim 25, wherein the associated data for applying the second and third machine-accessible files includes associated data for applying the second machine-accessible file to a remote system security controller.

31. An article according to claim 30, the machine-accessible medium having further associated data that, when accessed, results in the machine:

receiving a request for a connection to the network from a device;

determining if the device includes a tool to enforce the security policy; and

granting the request for the connection to the network if the device includes the tool to enforce the security policy.

32. An article according to claim 31, the machine-accessible medium having further associated data that, when accessed, results in the machine denying the request for the connection to the network if the device lacks the tool to enforce the security policy.

33. An article according to claim 31, wherein the associated data for receiving a request includes associated data for receiving the request for a wireless connection to the network from the device.

34. An article according to claim 31, wherein the associated data for determining if the device includes a tool includes associated data for determining by the remote system security controller if the device includes at least an application monitoring tool, an intrusion detection tool, and a firewall tool.

35. An article according to claim 34, wherein the associated data for determining if the device includes a tool further includes associated data for determining by the remote system security controller if the device includes a session logging tool.

36. An article according to claim 31, the machine-accessible medium having further associated data that, when accessed, results in the machine:

translating by the remote system security controller the second machine-accessible file into a fourth machine-accessible file for the tool on the device;

transmitting the fourth machine-accessible file to the device; and

applying the fourth machine-accessible file to the tool on the device.

37. An article according to claim 36, wherein the associated data for applying the fourth machine-accessible file includes the associated data for changing a setting in the tool on the device.