System and method for implementing a security policy

• US 6,453,419 B1
• Filed: 03/18/1998
• Issued: 09/17/2002
• Est. Priority Date: 03/18/1998
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Amdur, Gene, Flint, Andrew, Reid, Irving
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): Elisca, Pierre E.
• Application Number:
  US09/040,827
• Time in Patent Office: 1,644 Days
• Field of Search: 713/200, 713/201, 709/223, 709/225, 709/232
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method of implementing a security policy, comprising the steps of providing a plurality of access policies, defining a process and connecting the access policies and the process to form a security policy.

Claims

1. In a computer network having a plurality of separate networks, an access control mechanism comprising:

a plurality of regions, including a first and a second region;

one or more services bridging said first and second regions;

access control rules which define a security policy, wherein the access control rules limit data transfer by the one or more services bridging the first and second regions, wherein the access control rules are defined as a decision tree, wherein the decision tree includes a decision node and a first and a second branch and wherein the decision node includes a true and a false destination path, wherein the true destination path leads to the first branch and the false destination path leads to the second branch; and

access control logic, wherein the access control logic operates with the access control rules to enforce the security policy.

2. The access control mechanism according to claim 1, wherein the first and the second branches lead to other decision nodes.

3. The access control mechanism according to claim 1, wherein the decision tree further includes a filter, wherein the first branch leads to the filter.

4. The access control mechanism according to claim 3, wherein the first and the second branches lead to other decision nodes.

5. In a computer network system having a plurality of networks and a plurality of services, wherein each service defines a protocol for transferring data between two of the plurality of networks, a method of defining a security policy, comprising:

defining a plurality of access policies, including a first and a second access policy, wherein the first and second access policies limit access to one or more services, wherein defining includes creating a plurality of access policy routines, including a first and a second access policy routine, wherein the first access policy routine embodies the first access policy and wherein the second access policy routine embodies the second access policy;

forming a decision tree having a plurality of decision nodes, including a first, second and third decision node, wherein the first and second decision nodes enforce the first access policy and wherein the third decision node enforces the second access policy; and

compiling a list of access control rules, wherein compiling includes replacing each decision node with one of the plurality of access policy routines.

7. The method according to claim 5, wherein forming a decision tree includes displaying the decision tree graphically and modifying the decision tree using a graphical user interface.

6. In a computer network system having a plurality of networks and a plurality of services, wherein each service defines a protocol for transferring data between two of the plurality of networks, a method of enforcing a security policy, comprising:

defining a plurality of regions, including a first and a second region;

assigning each network to a region;

defining a first and a second service;

defining a plurality of access policies, including a first and a second access policy, wherein the first access policy limits communication between the first and second region using the first service and wherein the second access policy limits communication between the first and second region using the second service, wherein defining a plurality of access policies includes creating a plurality of access policy routines, including a first and a second access policy routine, wherein the first access policy routine embodies the first access policy and wherein the second access policy routine embodies the second access policy;

forming a decision tree having a plurality of decision nodes, including a first, second and third decision node, wherein the first and second decision nodes enforce the first access policy and wherein the third decision node enforces the second access policy;

compiling a list of access control rules, wherein compiling includes replacing each decision node with one of the plurality of access policy routines;

receiving a packet from the first region; and

accessing the list of access control rules to determine if the packet should be forwarded to the second region.

8. The method according to claim 6, wherein forming a decision tree includes displaying the decision tree graphically and modifying the decision tree using a graphical user interface.