METHOD AND SYSTEM FOR MANAGEMENT OF SECURITY RULE SET

• US 20130254150A1
• Filed: 05/21/2013
• Published: 09/26/2013
• Est. Priority Date: 05/18/2009
• Status: Active Grant

• Current Assignee: Tufin Software Technologies Ltd.
• Original Assignee: Tufin Software Technologies Ltd.
• Inventors: HARRISON, Reuven, COGAN, Amir, BARKAN, Tomer
• Granted Patent: US 9,122,990 B2
• Time in Patent Office: Days
• US Class Current: 706/46
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/765 intermediate

Abstract

There are provided a method of automated managing one or more security rule-sets and a system thereof. The method comprising: obtaining data characterizing a connectivity request and an amended rule-set, the amended rule-set being derivative of an initial rule-set amended to fit the connectivity request; automated verifying each possible combination of values in the connectivity request against the initial rule-set and the amended rule-set; calculating one or more values selected from a group comprising values characterizing relative amount of extra allowed traffic and values characterizing relative amount of dissatisfied requested traffic; automated comparing the calculated values and/or derivatives thereof with a predefined threshold; and automated classifying the amended rule-set as applicable for implementation if the results of the automated comparing match a predefined verification criterion.

Claims

1. A method of automated managing one or more security rule-sets, the method comprising:

a. obtaining data characterizing a connectivity request and data characterizing an amended rule-set, the amended rule-set being derivative of an initial rule-set amended to fit the connectivity request;

b. automated verifying each possible combination of values in the connectivity request against the initial rule-set and the amended rule-set;

c. calculating one or more values selected from a group comprising values characterizing relative amount of extra allowed traffic and values characterizing relative amount of dissatisfied requested traffic;

d. automated comparing the calculated values and/or derivatives thereof with a predefined threshold; and

e. automated classifying the amended rule-set as applicable for implementation if the results of the automated comparing match a predefined verification criterion.

2. The method of claim 1 wherein at least one value characterizing the relative amount of extra allowed traffic is selected from a group consisting of:

a. values characterizing a relation between allowed traffic in the amended rule-set and traffic allowed in the initial rule-set;

b. values characterizing a relation between entire added traffic and traffic which needs to be added in accordance with the connectivity request; and

c. values characterizing a relation between allowed traffic that has not been requested and traffic allowed in the initial rule-set.

3. The method of claim 1 wherein at least one value characterizing relative amount of dissatisfied requested traffic is selected from a group consisting of:

a. values characterizing a relation between requested traffic dissatisfied resulting from amendment and requested traffic satisfied resulting from the amendment;

b. values characterizing a relation between requested traffic dissatisfied resulting from the amendment and entire requested traffic; and

c. values characterizing a relation between requested traffic dissatisfied resulting from the amendment and requested traffic dissatisfied before the amendment.

10. A computer program product embodied on a non-transitory computer readable medium and comprising computer program code means for performing all the steps of claim 1 when run on a computer.

4. A system capable of automated managing a security rule-set, the system comprising:

a. an interface operable to obtain data characterizing a connectivity request;

b. an interface operable to obtain data characterizing an amended rule-set, the amended rule-set being derivative of an initial rule-set amended to fit the connectivity request;

c. means for automated verifying each possible combinations of values in the connectivity request against the initial rule-set and the amended rule-set;

d. means for calculating one or more values selected from a group comprising values characterizing relative amount of extra allowed traffic and values characterizing relative amount of dissatisfied requested traffic;

e. means for automated comparing the calculated values and/or derivatives thereof with a predefined threshold; and

f. means for automated classifying the amended rule-set as applicable for implementation if the results of the automated comparing match a predefined verification criterion.

5. The system of claim 4 wherein at least one value characterizing relative amount of extra allowed traffic is selected from a group consisting of:

a. value characterizing a relation between allowed traffic in the amended rule-set and traffic allowed in the initial rule-set;

b. value characterizing a relation between entire added traffic and traffic which needs to be added in accordance with the connectivity request; and

c. value characterizing a relation between allowed traffic that has not been requested and traffic allowed in the initial rule-set.

6. The system of claim 4 wherein at least one value characterizing relative amount of dissatisfied requested traffic is selected from a group consisting of:

a. value characterizing a relation between requested traffic dissatisfied resulting from amendment and requested traffic satisfied resulting from the amendment;

b. value characterizing a relation between requested traffic dissatisfied resulting from the amendment and entire requested traffic; and

c. value characterizing a relation between requested traffic dissatisfied resulting from the amendment and requested traffic dissatisfied before the amendment.

7. A method of automated managing one or more security rule-sets, the method comprising:

a. obtaining data characterizing a connectivity request and data characterizing one or more rules in an amended rule-set, the one or more rules in the amended rule-set being derivatives of corresponding one or more rules in an initial rule-set amended to fit the connectivity request;

b. automated verifying each possible combination of values in the connectivity request against the one or more rules in the amended rule-set and against the corresponding one or more rules in the initial rule-set;

c. calculating one or more values selected from a group comprising values characterizing relative amount of extra allowed traffic and values characterizing relative amount of dissatisfied requested traffic;

d. comparing the calculated values and/or derivatives thereof with a predefined threshold; and

e. automated classifying the one or more rules in the amended rule-set as non-applicable for implementation if the results of the automated comparing do not match a predefined verification criterion.

8. The method of claim 7 wherein at least one value characterizing the relative amount of extra allowed traffic is selected from a group consisting of:

a. values characterizing a relation between allowed traffic in the one or more rules in the amended rule-set and traffic allowed in the corresponding one or more rules in the initial rule-set;

b. values characterizing a relation between traffic added in the one or more rules in the amended rule-set and traffic which needs to be added in accordance with the connectivity request; and

c. values characterizing a relation between traffic allowed in the one or more rules in the amended rule-set that has not been requested and traffic allowed in the one or more rules in the initial rule-set.

9. The method of claim 7 wherein at least one value characterizing the relative amount of dissatisfied requested traffic is selected from a group consisting of:

a. values characterizing a relation between requested traffic dissatisfied resulting from amendment and requested traffic satisfied resulting from the amendment;

b. values characterizing a relation between requested traffic dissatisfied resulting from the amendment and entire requested traffic; and

c. values characterizing a relation between requested traffic dissatisfied resulting from the amendment and requested traffic dissatisfied before the amendment.