Access control list generation and validation tool

• US 20080222290A1
• Filed: 03/05/2007
• Published: 09/11/2008
• Est. Priority Date: 03/05/2007
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Le Moigne, Olivier, Hawley, Christopher
• Granted Patent: US 7,853,687 B2
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

This invention provides a tool for generating ACLs in an environment where a set of network elements or servers (e.g. web servers, IPTV servers, application servers . . . ) need to be secure. The tool also performs ACL validation to ensure that the filtering rules are correct before they are deployed in a network. The system enables a central view of the security configuration concerning the filtering rules in the network. Furthermore, it allows end-to-end configuration of the ACL rules, from the definition of the flows between the servers to the deployment of the rules on the network elements.

Claims

1. An access control list generation and validation system for deployment on network elements of a communication network, comprising:

a tables generation unit for creating a flows table, a roles definition table and an enforcement points table;

a tables management unit for creating an interaction table from said flows table and said roles definition table while validating data contained in said flows table, roles definition table and enforcement points table;

an access control rules generation unit for generating generic access control rules for each enforcement point listed in said enforcement points table using said interaction table and said enforcement points table; and

a rules translation and deployment unit for translating said generic access control rules into a format specific to each respective enforcement point and deploying access control rules having said specific format to said respective enforcement points.

2. A system as claimed in claim 1, further comprising a memory unit for storing said flows table, said roles definition table, said enforcement points table, and said interaction table.

3. A system as claimed in claim 1, further comprising an errors reporting unit for reporting errors detected in said flows table, said enforcement points table, and said interaction table.

4. A system as claimed in claim 1, wherein said flows table comprises a list of all documented flows within said communication network, each flow being defined by a protocol used for communication between two roles.

5. A system as claimed in claim 1, further comprising a flow data collector operating in one of an access control rules generation mode, whereby said collector collects real-time flow data obtained for all flows established in said network and a flow monitoring mode, whereby said collector collects discarded flows data for the flows discarded by said network elements.

6. A system as claimed in claim 5, further comprising a flow analysis block for analyzing said flow data, and identifying access control violations and an ACL violations reporting block for generating an AC rules violations list providing particulars of said access control violations.

7. A system as claimed in claim 5, further comprising a flows table validation unit for comparing said real-time flow data with said documented flow data stored in said flows table and identifying flows data errors in said flows table.

8. The system of claim 1, further comprising a graphical user interface for enabling input of documented flow data, roles data and enforcement point data into said respective tables, and for enabling display of said errors detected in said flows table, said enforcement points table, and said interaction table.

9. A method for generating and validating access control lists before deployment on network elements of a communication network, comprising:

logically dividing said network into subnets, a subnet including network elements communicating with each other without any enforcement between them;

in each said subnet, grouping network elements into zones, the network elements in a zone being characterized by a common role and a common enforcement point, and each enforcement point being adapted to enforce specific access control rules on the traffic to and from said zone;

identifying all flows within said network, a flow being defined by the protocol used between two roles;

generating a flows table, a roles definition table and an enforcement points table; and

validating accuracy of said flows table, roles definition table and enforcement points table based on network configuration information.

10. A method as claimed in claim 9, wherein said roles definition table comprises a list of all roles that each network element can assume during operation, a role being determined by the type of operations performed by said network element.

11. A method as claimed in claim 9, wherein said flows table comprises a list of all documented flows within said communication network, each flow being defined by a protocol used for communication between two roles.

12. A method as claimed in claim 9, wherein said enforcement points table comprises a list of all the documented flows at each enforcement point of said network and all paths between said zones.

13. A method as claimed in claim 9, further comprising:

creating an interaction table from said flows table and said roles definition table, said interactions table listing for each role of a network element all interactions with other roles of other network elements;

validating accuracy of said interactions table against network configuration information before deployment of said ACLs.

14. A method as claimed in claim 13, further comprising:

generating generic access control rules for each enforcement point in said enforcement points table using said interaction table and said enforcement points table; and

translating said generic access control rules into said specific access control rules and deploying said specific access control rules to said respective enforcement points.

15. A method as claimed in claim 9, further comprising monitoring the flows discarded at each said enforcement point and generating a list with all ACL violations for identifying all flows that violate said specific access control rules.

16. A method as claimed in claim 15, wherein said list includes tier violations, which report flows between subnets that should not communicate at all with each other;

and port violations, which report flows between subnets that are authorized to communicate, but use the wrong protocol, wrong port or other inconsistency with the flows documented in the flows table.

17. A method as claimed in claim 9, wherein said step of validating accuracy comprises:

collecting real-time flow data for all flows established in said network;

comparing said real-time flow data with documented flow data stored in said flows table for identifying errors in said flows table; and

correcting said documented flow data in said flows table.