MANAGING NETWORK SECURITY

• US 20110131324A1
• Filed: 11/20/2007
• Published: 06/02/2011
• Est. Priority Date: 05/24/2007
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Foundry Networks LLC (Broadcom, Inc.)
• Inventors: CHATURVEDI, Animesh, Lau, Ron, Lavine, Marc, Shah, Manan
• Granted Patent: US 8,341,739 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Technology for network security is disclosed. In one embodiment, a method of managing network security includes receiving sampled packets. The sampled packets represent packets being sampled from network packet traffic in at least one location in a network. The sampled packets are converted into an appropriate format for analysis to form converted packets. Moreover, the converted packets are sent to a first group including at least one security device for analysis. If an event message is generated by the at least one security device as a result of analysis of the converted packets, the event message is received from the at least one security device. Network security is evaluated based on the event message and security policies and is adjusted based on that evaluation. The method may be implemented with a network manager.

Claims

1. A computer-implemented method of managing network security, said method comprising:

receiving sampled packets at said computer at a first location, wherein said sampled packets represent packets being sampled from network packet traffic in at least one second location in a network;

converting said sampled packets into an appropriate format for analysis to form converted packets;

sending said converted packets to a first group including at least one security device for analysis;

receiving an event message from said at least one security device if said event message is generated by said at least one security device as a result of analysis of said converted packets;

evaluating said network security based on said event message and security policies; and

adjusting said network security based on said evaluation of said network security wherein said first location said second location and said at least one security device are a part of a closed loop that comprises a feedback path.

2. The method as recited in claim 1 wherein said adjusting said network security comprises:

notifying a network administrator concerning network security adjustment; and

if said network administrator approves said network security adjustment, implementing said network security adjustment.

3. The method as recited in claim 1 wherein said adjusting said network security comprises:

sending security adjustment information to a network device.

4. The method as recited in claim 1 further comprising:

receiving an event message from a second group including at least one security device.

5. The method as recited in claim 4 further comprising:

evaluating said network security based on said event message from said second group and said security policies; and

adjusting said network security based on said evaluation based on said event message from said second group and said security policies.

6. A computer-implemented method of managing network security, said method comprising:

sampling network packet traffic in at least one first location in a network to form sampled packets;

sending said sampled packets to said computer including a network manager at a second location;

receiving security adjustment information from said network manager; and

implementing security adjustment based on said security adjustment information wherein said first location and said second location are a part of a closed loop that comprises a feedback path.

7. The method as recited in claim 6 wherein said at least one first location is in a network device.

8. A computer-implemented network manager comprising:

a sampled packets collector for receiving sampled packets at said computer at a first location, wherein said sampled packets represent packets being sampled from network packet traffic in at least one second location in a network;

a packet format converter for converting said sampled packets into an appropriate format for analysis to form converted packets and for sending said converted packets to a first group including at least one security device for analysis;

an event message collector for receiving event messages based on analysis of said converted packets from said at least one security device; and

an event message processor for processing said event messages based on security policies and for adjusting network security based on results of said processing wherein said first location said second location and said at least one security device are a part of a closed loop that comprises a feedback path.

9. The network manager as recited in claim 8 further comprising a security alert notification unit for notifying a network administrator concerning network security adjustment and for receiving a response from said network administrator.

10. The network manager as recited in claim 8 wherein said event message processor sends security adjustment information to a network device.

11. The network manager as recited in claim 8 wherein said event message collector receives event messages from a second group including at least one security device.

12. The network manager as recited in claim 11 wherein said event message processor processes said event messages from said second group based on said security policies and adjusts network security based on result of said processing of said event messages from said second group.

13. A network device comprising:

a packet sampling unit for sampling network packet traffic at a first location to form sampled packets and for sending said sampled packets to a network manager at a second location; and

a security response unit for receiving security adjustment information from said network manager and for implementing security adjustment based on said security adjustment information wherein said first location said second location and said at least one security response unit are a part of a closed loop that comprises a feedback path.

14. The network device as recited in claim 13 wherein said network device is a network switch.

15. A computer-readable non-transitory medium comprising computer-executable instructions for causing performance of a method of managing network security, said method comprising:

receiving sampled packets at a first location, wherein said sampled packets represent packets being sampled from network packet traffic in at least one second location in a network;

converting said sampled packets into an appropriate format for analysis to form converted packets;

sending said converted packets to a first group including at least one security device for analysis;

receiving an event message from said at least one security device if said event message is generated by said at least one security device as a result of analysis of said converted packets;

evaluating said network security based on said event message and security policies; and

adjusting said network security based on said evaluation of said network security wherein said first location said second location and said at least one security device are a part of a closed loop that comprises a feedback path.

16. The computer-readable non-transitory medium as recited in claim 15 wherein said adjusting said network security comprises:

notifying a network administrator concerning network security adjustment; and

if said network administrator approves said network security adjustment, implementing said network security adjustment.

17. The computer-readable non-transitory medium as recited in claim 15 wherein said adjusting said network security comprises:

sending security adjustment information to a network device.

18. The computer-readable non-transitory medium as recited in claim 15 wherein said method further comprises:

receiving an event message from a second group including at least one security device;

evaluating said network security based on said event message from said second group and said security policies; and

adjusting said network security based on said evaluation based on said event message from said second group and said security policies.

19. A computer-readable non-transitory medium comprising computer-executable instructions for causing performance of a method of managing network security, said method comprising:

sampling network packet traffic in at least one first location in a network to form sampled packets;

sending said sampled packets to a network manager at a second location;

receiving security adjustment information from said network manager; and

implementing security adjustment based on said security adjustment information wherein said first location and said second location are a part of a closed loop that comprises a feedback path.

20. The computer-readable non-transitory medium as recited in claim 19 wherein said at least one first location is in a network switch.

21. A computer-implemented method of managing network security, said method comprising:

sampling network packet traffic in at least one first location in a network to form sampled packets;

sending said sampled packets to at least one security device for analysis at a second location;

receiving security adjustment information from said computer including a network manager; and

implementing security adjustment based on said security adjustment information wherein said first location and said second location are a part of a closed loop that comprises a feedback path.