Computer network security management system

• US 6,070,244 A
• Filed: 11/10/1997
• Issued: 05/30/2000
• Est. Priority Date: 11/10/1997
• Status: Expired due to Term

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: The Chase Manhattan Bank (JP Morgan Chase & Co)
• Inventors: Ardito, Dario, Byreddy, Anil, Orchier, Jonathan, Soriano, Raymond, Salvaterra, Louis
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Bonzo, Bryce P.
• Application Number:
  US08/966,902
• Time in Patent Office: 932 Days
• Field of Search: 713/200, 713/201, 709/220, 709/223, 709/224, 709/225, 709/250, 709/227, 709/229, 395/500.44, 395/500.47, 395/500.48
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/024 using relational databases for representation of network management data, e.g. managing via structured query language [SQL]
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system for controlling computer security. The system is a centralized, computer-network security management tool capable of handling many different kinds of equipment in a standardized format despite differences in the computer security features among the diverse range of computer equipment in the computer network. The invention uses a layered software architecture, including a technology specific layer and a technology independent layer. The technology specific layer serves to extract and maintain security data on target platforms and for converting data to and from a common data model used by the technology independent layer. The technology independent layer handles the main functionality of the system such as locating and removing certain present and former employees from computer access lists, auditing system user data, monitoring security events (e.g. failed login attempts), automatically initiating corrective action, interfacing with the system users, reporting, querying and storing of collected data.

Claims

1. A centralized security system for a computer network comprising a plurality of discrete computer subsystems, each subsystem having a discrete security domain associated therewith, the centralized security system comprising:

a plurality of collection agents, each agent being operatively coupled with a respective one of said discrete security domains for collecting differently presented security-related data of said security domains;

a collection agent abstraction facility coupled to said collection agents and effective for transforming the differently presented security-related data into a common-format security data which has a format common across said security domains;

a database for storing said common-format security data from the collection agent abstraction facility, the database being comprised of a standardized, off-the-shelf database software program;

a security controlling facility for examining the security data stored in the database, for ensuring that the security related data in the database indicates that the security domains are in compliance with pre-determined security regulations and for issuing security related common-format commands effective for correcting computer security breach conditions; and

a security maintenance software facility for receiving the common format commands and translating them into specific commands that are specific to and understandable by the various security domains.

2. The computer security system of claim 1, in which the security controlling facility includes a maintenance agent abstraction facility for producing the common-format commands.

3. The computer security system of claim 2, in which the security maintenance software facility includes a plurality of maintenance agents coupled to the maintenance agent abstraction facility, each maintenance agent being configured to communicate and provide the specific commands to a specific one of said security domains with which it is associated.

4. The computer security system of claim 2, in which the security controlling facility includes means for parsing and validating incoming data.

5. The computer security system of claim 2, in which the security controlling facility includes means for consulting mapping tables which convert incoming data to said common-format commands.

6. The computer security system of claim 1, in which the security controlling facility comprises a compliance facility coupled to and communicating with the database for analyzing the data in the database and for determining that individual ones of the security domains are out of compliance with the security regulations, when warranted.

7. The computer security system of claim 6, further comprising an active agent coupled to the compliance facility for formulating specific corrective actions needed to correct said computer security breach conditions.

8. The computer security system of claim 7, further comprising an alert agent coupled to the database for communicating said computer security breach conditions to personnel responsible for security.

9. The computer security system of claim 8, further including a manual maintenance agent coupled to the security controlling facility for providing manual control over the security controlling facility.

10. The computer security system of claim 9, in which the security manual maintenance agent includes means for conducting searches of user accounts.

11. The computer security system of claim 8, further comprising a query agent coupled to the security controlling facility for enabling personnel to obtain specific information concerning security conditions within the computer network.

12. The computer security system of claim 11, in which the query agent includes means for generating security group reports.

13. The computer security system of claim 11, in which the query agent includes means for generating operating system and security product reports.

14. The computer security system of claim 8, in which the alert agent comprises means for communicating with personnel via communication links selected from the group including telephones, e-mail and pagers.

15. The computer security system of claim 1, wherein the security domains are comprised of different software operating systems.

16. The computer security system of claim 1, further comprising a facility for generating exception reports describing deviations from the security regulations.

17. The computer security system of claim 1, in which the database comprises security-policy data.

18. The computer security system of claim 1, in which the database comprises threshold parameters which define situations triggering alarm conditions.

19. The computer security system of claim 1, in which each one of the security domains associated with an entire network of an organization is connected to a respective one of said collection agents.

20. A method of centrally controlling security in a computer network comprising a plurality of discrete computer subsystems each having a discrete security domain associated therewith, the method comprising the steps of:

separately collecting from each of the security domains security-related data associated with each security domain, wherein each security-related data is uniquely presented;

supplying the security-related data collected from the security domains to a collection agent abstraction facility and deploying the collection agent abstraction facility to transform the separately collected security-related data into a common-format security data, said transformation of the separately collected security-related data including the steps of;

mapping the data collected from a single security domain to a generic language using a predetermined map for the environment; and

sending the mapped data to a database;

storing the common-format security data in the database;

analyzing the common-format security-related data for discerning in the data out-of-compliance conditions in specific ones of said security domains by comparing the data with predetermined security regulations;

issuing common-format security-related commands effective for controlling security at the individual security domains;

converting the common-format security-related commands to a plurality of specific security commands which are configured to be understood by corresponding ones of said security domains; and

repeating the above-steps for remaining ones of said security domains.

21. The method of claim 20, including converting the common-format security-related commands to at least one specific command which results in iterative execution of a single maintenance agent function.

22. The method of claim 20, in which the out-of-compliance conditions include one or more of the following conditions:

a) an unusually large increase in the number of failed access attempts;

b) repeated failed attempts from a single user or location;

c) attempted modification of predetermined key security regulations;

d) minimum password length is less than a predetermined number of characters;

e) password life is longer than 90 days;

f) more than three failed logins not being disallowed before an account is disabled;

g) concurrent logins are allowed;

h) account has not been used in 90 days and has not been disabled; and

i) account was used after employee termination date.

23. The method of claim 20, including storing in the database threshold parameters for triggering alarm conditions which require the alerting of security personnel.

24. The method of claim 20, including controlling how often security-related data is collected from each of the security domains.

25. The method of claim 20, including providing an operator controlled field which can be used to designate from which one of said security domains security-related data is to be collected.

26. The method of claim 20, in which the step of separately collecting the security-related data from the security domains comprises providing a plurality of collection agents, each agent being operatively coupled with a respective one of said discrete security domains for collecting differently presented security-related data of said security domains.

27. The method of claim 20, in which the step of converting the common-format security-related commands to specific security commands comprises using a plurality of maintenance agents coupled to a maintenance agent abstraction facility, wherein each maintenance agent is configured to communicate and provide the specific security commands to a specific one of said security domains with which it is associated.

28. A method of centrally controlling security in a computer network comprising a plurality of discrete computer subsystems each having a discrete security domain associated therewith, the method comprising the steps of:

separately collecting from each of the security domains security-related data associated with each security domain, wherein each security-related data is uniquely presented;

supplying the security-related data collected from the security domains to a collection agent abstraction facility and deploying the collection agent abstraction facility to transform the separately collected security-related data into a common-format security data;

storing the common-format security data in a database;

analyzing the common-format security-related data for discerning in the data out-of-compliance conditions in specific ones of said security domains by comparing the data with predetermined security regulations;

issuing common-format security-related commands effective for controlling security at the individual security domains; and

converting the common-format security-related commands to a plurality of specific security commands which are configured to be understood by corresponding ones of said security domains, the plurality of specific security commands including a specific command which results in the execution of multiple maintenance agent actions.

29. The method of claim 28, in which the out-of-compliance conditions include one or more of the following conditions:

a) an unusually large increase in the number of failed access attempts;

b) repeated failed attempts from a single user or location;

c) attempted modification of predetermined key security regulations;

d) minimum password length is less than a predetermined number of characters;

e) password life is longer than 90 days;

f) more than three failed logins not being disallowed before an account is disabled;

g) concurrent logins are allowed;

h) account has not been used in 90 days and has not been disabled; and

i) account was used after employee termination date.

30. The method of claim 28, including storing in the database threshold parameters for triggering alarm conditions which require the alerting of security personnel.

31. The method of claim 28, including controlling how often security-related data is collected from each of the security domains.

32. The method of claim 28, including providing an operator controlled field which can be used to designate from which one of said security domains security-related data is to be collected.

33. The method of claim 28, in which the step of separately collecting the security-related data from the security domains comprises providing a plurality of collection agents, each agent being operatively coupled with a respective one of said discrete security domains for collecting differently presented security-related data of said security domains.

34. The method of claim 28, in which the step of converting the common-format security-related commands to specific security commands comprises using a plurality of maintenance agents coupled to a maintenance agent abstraction facility, wherein each maintenance agent is configured to communicate and provide the specific security commands to a specific one of said security domains with which it is associated.