System and method for analyzing a router in a shared network system

• US 7,590,745 B2
• Filed: 03/02/2001
• Issued: 09/15/2009
• Est. Priority Date: 03/02/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Haugen, James B.
• Primary Examiner(s): Blair; Douglas B
• Application Number:
  US09/798,835
• Publication Number:
  US 20020138647A1
• Time in Patent Office: 3,119 Days
• Field of Search: 709/220, 709/224, 709/229, 709/223, 709/242, 709/249, 370/254, 370/401, 713/155, 713/201, 713/187, 713/189, 714/37, 715/736, 726/8, 726/22, 726/23, 726/26, 726/3, 379/189, 340/825.01
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system and method for analyzing a router in a shared network system (SNS). Specifically, the present invention retrieves information for each network participating in the SNS from a common router. By identifying source and destination networks for communications in the SNS, and then comparing the identified networks to network policies, a network map, and/or flow tables, security findings for each network can be identified. These findings, as well as the network map, can then be outputted to each network according to their preferences in a report or summary format.

Claims

1. A system for detecting security risks in a shared network system shared by different entity networks, said system comprising:

a central processing unit, a memory and a computer readable storage;

first program instructions to retrieve, from a router for said shared network system, flow tables that identify source and destination networks for which intercommunication is permitted, security policies indicating that at least one of said entity networks is not permitted to communicate with another of said entity networks, filter files that identify at least one of said entity networks which is permitted to use another of said entity networks to access web applications outside of said shared network system, and maps of respective entity networks of said shared network system;

second program instructions to generate a shared network map of said shared network system, based at least in part on said maps of said respective entity networks, said shared network map including said different entity networks;

third program instructions to identify a set of permitted communications through said router based on said flow tables and filter files; and

fourth program instructions to identify a permitted communication of said set which represents a security risk based on said shared network map and said security policies; and

wherein

said first, second, third and fourth program instructions are stored in said computer readable storage for execution by said central processing unit via said memory.

2. A computer system as set forth in claim 1 wherein:

said security policies also identify a subnet within one of said entity networks which is not permitted to communicate with another subnet within said one entity network; and

said fourth program instructions identify a permitted communication of said set which represents a security risk based also on said security policies which identify a subnet within one of said entity networks which is not permitted to communicate with another subnet within said one entity network.

3. A computer system as set forth in claim 1 further comprising fifth program instructions to display on a computer monitor said security risks;

and wherein

said fifth program instructions are stored in said computer readable storage for execution by said central processing unit via said memory.

4. A computer program product for detecting security risks in a shared network system shared by different entity networks, said computer program product comprising:

a computer readable storage media;

first program instructions to retrieve, from a router for said shared network system, flow tables that identify source and destination networks for which intercommunication is permitted, security policies indicating that at least one of said entity networks is not permitted to communicate with another of said entity networks, filter files that identify at least one of said entity networks which is permitted to use another of said entity networks to access web applications outside of said shared network system, and maps of respective entity networks of said shared network system;

second program instructions to generate a shared network map of said shared network system, based at least in part on said maps of said respective entity networks, said shared network map including said different entity networks;

third program instructions to identify a set of permitted communications through said router based on said flow tables and filter files; and

fourth program instructions to identify a permitted communication of said set which represents a security risk based on said shared network map and said security policies; and

wherein

said first, second, third and fourth program instructions are stored on said computer readable storage media.

5. A computer program product as set forth in claim 4 wherein:

said security policies also identify a subnet within one of said entity networks which is not permitted to communicate with another subnet within said one entity network; and

said fourth program instructions identify a permitted communication of said set which represents a security risk based also on said security policies which identify a subnet within one of said entity networks which is not permitted to communicate with another subnet within said one entity network.

6. A computer program product as set forth in claim 4 further comprising fifth program instructions to display on a computer monitor said security risks;

and wherein

said fifth program instructions are stored on said computer readable storage media.