Context-aware network and situation management for crypto-partitioned networks

• US 9,736,112 B2
• Filed: 10/10/2014
• Issued: 08/15/2017
• Est. Priority Date: 12/19/2013
• Status: Active Grant

• Current Assignee: Architecture Technology Corporation
• Original Assignee: Architecture Technology Corporation
• Inventors: Charan, Deborah K., Burnett, Benjamin L., Pozzo, Fabio, Ramanujan, Ranga
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/512,123
• Publication Number:
  US 20150180830A1
• Time in Patent Office: 1,040 Days
• Field of Search: 709203, 709223-229, 709250
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

This disclosure describes a context aware scalable dynamic network whereby network information concerning network elements in an untrusted (Black) network are gathered by network sensors, stored at a network sensor collector, and sent to another network sensor collector in a trusted (Red) network through a one-way guard. At the Red network, the network information from the Black network may be combined with network information from one or more Red networks. The combined network information may then be used to visualize a cross-domain network topology of both Red and Black networks, and to implement network management functions.

Claims

1. An apparatus comprising:

a computing device located in a trusted network, the computing device executing a network management system, the computing device comprising;

at least one processor; and

a memory storing instructions that, when executed, cause the at least one processor to;

access network information from the trusted network;

access network information from an untrusted network;

correlate one or more data flows in the trusted network to one or more encrypted data tunnels in the untrusted network to form fused network information; and

generate a cross-domain network topology for the trusted network and the untrusted network based on the fused network information.

2. The apparatus of claim 1, wherein the instructions further cause the at least one processor to correlate the one or more data flows in the trusted network to the one or more encrypted data tunnels in the untrusted network by comparing destination addresses of the one or more data flows in the trusted network with origination addresses of the one or more encrypted tunnels in the untrusted network.

3. The apparatus of claim 1, wherein the instructions further cause the at least one processor to generate the cross-domain network topology to depict at least one of the one or more data flows in the trusted network as being contained in at least one of the one or more encrypted data tunnels based on the correlation of the one or more data flows in the trusted network to the one or more encrypted data tunnels in the untrusted network.

4. The apparatus of claim 1, wherein the instructions further cause the at least one processor to generate the cross-domain topology to show one or more of a topology of network elements in the untrusted network and the trusted network, a position for one or more of the network elements, a status of one or more links coupled to the network element, an amount of traffic at each of the network elements, a link bandwidth between the network elements, a priority of data flows traversing the network elements, a number of data flows between the untrusted network and the trusted network, a statistical breakdown of types of data flows at the network elements, an application sending data flows traversing the network elements, an application receiving the data flows, a username associated with the application sending data flows, and a username associated with the application receiving the data flows.

5. The apparatus of claim 4, wherein the instructions further cause the at least one processor to display the cross-domain network topology.

6. The apparatus of claim 1, wherein the network information includes one or more of network addresses for network elements within the untrusted network and the trusted network, a position for one or more of the network elements, a status of one or more links coupled to the network element, an amount of traffic at each of the network elements, a link bandwidth between the network elements, a priority of flows traversing the network elements, an application sending traffic traversing the network elements, an application receiving the traffic, a username associated with the application sending data flows, and a username associated with the application receiving the data flows.

7. The apparatus of claim 1, wherein the instructions further cause the at least one processor to access the network information from the untrusted network through a one-way guard.

8. The apparatus of claim 1, wherein the instructions further cause the at least one processor to:

analyze the fused network information; and

perform a network management function based on the analysis of the data analyzer.

9. The apparatus of claim 8, wherein the instructions further cause the at least one processor to detect a broken link between two network elements based on the fused network information, and

reroute data packets in response to detecting the broken link.

10. The apparatus of claim 8, wherein the instructions further cause the at least one processor to determine contexts of a plurality of data packets, and

group one or more data packets of the plurality of data packets based on the determined contexts and the fused network information.

11. The apparatus of claim 10, wherein the fused network information includes a topology of network elements and a link status of the network elements, and wherein the instructions further cause the at least one processor to:

cache data packets during a period when the link status between two network elements indicates an inactive link; and

send new data packets and the cached data packets during a period when the link status between two network elements indicates an active link.

12. A method comprising:

accessing network information from a trusted network;

accessing network information from an untrusted network;

correlating one or more data flows in the trusted network to one or more encrypted data tunnels in the untrusted network to form fused network information; and

generating a cross-domain network topology for the trusted network and the untrusted network based on the fused network information.

13. The method of claim 12, wherein correlating the one or more data flows in the trusted network to the one or more encrypted data tunnels in the untrusted network comprises comparing destination addresses of the one or more data flows in the trusted network with origination addresses of the one or more encrypted tunnels in the untrusted network.

14. The method of claim 12, wherein generating the cross-domain network topology comprises depicting at least one of the one or more data flows in the trusted network as being contained in at least one of the one or more encrypted data tunnels based on the correlation of the one or more data flows in the trusted network to the one or more encrypted data tunnels in the untrusted network.

15. An apparatus comprising:

a database configured to store network information from a trusted network and network information from an untrusted network; and

a computing device located in the trusted network, the computing device executing a network management system, the network management system configured to;

correlate one or more data flows in the trusted network to one or more encrypted data tunnels in the untrusted network to form fused network information; and

generate a cross-domain network topology for the trusted network and the untrusted network based on the fused network information.

16. A non-transitory computer-readable storage medium storing instructions that, when executed, cause one or more processors of a device to:

access network information from a trusted network;

access network information from an untrusted network;

correlate one or more data flows in the trusted network to one or more encrypted data tunnels in the untrusted network to form fused network information; and

generate a cross-domain network topology for the trusted network and the untrusted network based on the fused network information.

17. The non-transitory computer-readable storage medium storing of claim 16, wherein the instructions cause the one or more processors to correlate the one or more data flows in the trusted network to the one or more encrypted data tunnels in the untrusted network by comparing destination addresses of the one or more data flows in the trusted network with origination addresses of the one or more encrypted tunnels in the untrusted network.