US20050022027A1 - Generalized network security policy templates for implementing similar network security policies across multiple networks - Google Patents
Generalized network security policy templates for implementing similar network security policies across multiple networks Download PDFInfo
- Publication number
- US20050022027A1 US20050022027A1 US10/819,718 US81971804A US2005022027A1 US 20050022027 A1 US20050022027 A1 US 20050022027A1 US 81971804 A US81971804 A US 81971804A US 2005022027 A1 US2005022027 A1 US 2005022027A1
- Authority
- US
- United States
- Prior art keywords
- network
- security policy
- network security
- alias
- policy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0263—Rule management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/105—Multiple levels of security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99931—Database or file accessing
- Y10S707/99939—Privileged access
Definitions
- the present invention is directed to the field of automated network security.
- Network security devices provide various types of network security services to a network, such as a local area network connected to the Internet.
- a network security device may perform access control and traffic monitoring and logging.
- Access control refers to the regulation of network traffic based upon its type, content, source, and/or destination.
- access control services of a network security device can be employed to prevent email traffic from sources on the Internet from reaching computer systems inside the network other than a designated mail host computer system.
- Traffic monitoring and logging refers to observing network traffic, and storing important observations about the network traffic in a log.
- traffic monitoring and logging services of a network security device can be employed to log all unsuccessful attempts from sources on the Internet to access a server in the network containing sensitive information.
- the present invention provides a software facility for implementing similar network security policies across multiple networks (“the facility”).
- Each network is a collection of network elements, including a network security device that protects the network by implementing a network security policy (hereinafter simply “policy”) within the network.
- policy a network security policy
- Firebox II network security devices provided by WatchGuard Technologies, Inc., of Seattle, Wash. are suggested for use with the facility, the facility preferably also operates with other network security devices available from other sources.
- the policy implemented in a particular network comprises a set of rules for managing network traffic. These rules are specified in terms of specific network elements, such as user workstations, servers, routers, and printers, that perform certain functions, or “roles.” For example, a rule in a network security policy for a particular network may specify that all email traffic must flow through a network element having a particular network address that is specifically configured as a mail host. In a sense, these rules establish trust relationships between specific network elements, or groups thereof.
- the facility preferably provides a user interface for constructing one or more network security policy templates (hereinafter simply “templates”) that can each be used to generate similar policies for any number of specific networks.
- a template contains rules expressed in terms of “aliases,” rather than in terms of specific network elements.
- a template may include a rule specifying that all email traffic must flow through a “MailHost” alias that is not associated with a particular network address.
- the facility uses a profile of the network that maps the aliases occurring in the template to specific network elements within the network. For example, the network profile for a particular network maps the “MailHost” alias to a particular network element of the network having a particular network address.
- the facility preferably provides a user interface that makes it convenient for a user to generate network profiles.
- the facility uses the profile for the network to replace occurrences of aliases in the template with the addresses of the corresponding specific network elements.
- the facility preferably sends the resulting network-specific policy to the network security device of the network for implementation.
- the policy may be further modified before transmission to the networks security device.
- This process can be repeated to generate policies for each of a number of other networks.
- the underlying template can be revised to add or change rules. Together with the network profiles, this revised template can be used to automatically generate revised policies corresponding to the revised template for all of the networks.
- the facility is especially well suited for use by Internet service providers and other organizations responsible for providing network security to a large number of networks, as it enables these organizations to configure the network security devices for additional networks at a very low cost.
- the facility also enables such organizations to efficiently update the configuration of a large number of operating network security devices by merely modifying and reapplying one or more templates.
- FIG. 1A is a conceptual diagram illustrating the generation of security policies for each of several networks from a single security policy template.
- FIG. 1B is a conceptual diagram illustrating the creation of a security policy in greater detail.
- FIG. 2 is a network diagram showing a sample network for which the facility generates a policy.
- FIG. 3 is a high-level block diagram of a computing environment in which the facility may be implemented.
- FIG. 4 is a high-level block diagram of the policy manager computer system upon which portions of the facility preferably execute.
- FIG. 5 is a flow diagram showing, at a high level, the steps preferably performed by the facility in order to generate and implement network security policies for a number of protected networks.
- FIG. 6 is a display diagram showing the creation of a template.
- FIG. 7 is a display diagram showing the naming of a new template.
- FIG. 8 is a display diagram showing the policy manager user interface.
- FIG. 9 is a display diagram showing the user interface for adding rules to the template.
- FIG. 10 is a display diagram showing the user interface for specifying rules relating to the FTP network service.
- FIG. 11 is a display diagram showing a modification made by the user to allow certain outgoing FTP connections.
- FIG. 12 is a display diagram showing the user interface for adding aliases to the source or destination list for a network service.
- FIG. 13 is a display diagram showing the addition of a new alias to the alias list.
- FIG. 14 is a display diagram showing the effect of modifying security rules regarding outgoing FTP connections.
- FIG. 15 is a display diagram showing a depiction of the completed “minimal” template.
- FIG. 16 is a display diagram showing a list of several generated templates.
- FIG. 17 is a display diagram showing a user interface for configuring a new network security device.
- FIG. 18 is a display diagram showing the selection of a template for configuring the new network security device.
- FIG. 19 is a display diagram showing the user interface for generating a network profile for the new network.
- FIG. 20 is a display diagram showing the user interface for defining a first alias within the network profile.
- FIG. 21 is a display diagram showing the user interface for defining a second alias within the network profile.
- FIG. 22 is a display diagram showing a user interface for adding additional services and rules to the policy generated for the network from the template.
- the present invention provides a software facility for implementing similar network security policies across multiple networks (“the facility”).
- Each network is a collection of network elements, including a network security device that protects the network by implementing a network security policy (hereinafter simply “policy”) within the network.
- policy a network security policy
- Firebox II network security devices provided by WatchGuard Technologies, Inc., of Seattle, Wash. are suggested for use with the facility, the facility preferably also operates with other network security devices available from other sources.
- the policy implemented in a particular network comprises a set of rules for managing network traffic. These rules are specified in terms of specific network elements, such as user workstations, servers, routers, and printers, that perform certain functions, or “roles.” For example, a rule in a network security policy for a particular network may specify that all email traffic must flow through a network element having a particular network address that is specifically configured as a mail host. In a sense, these rules establish trust relationships between specific network elements, or groups thereof.
- the facility preferably provides a user interface for constructing one or more network security policy templates (hereinafter simply “templates”) that can each be used to generate similar policies for any number of specific networks.
- a template contains rules expressed in terms of “aliases,” rather than in terms of specific network elements.
- a template may include a rule specifying that all email traffic must flow through a “MailHost” alias that is not associated with a particular network address.
- the facility uses a profile of the network that maps the aliases occurring in the template to specific network elements within the network. For example, the network profile for a particular network maps the “MailHost” alias to a particular network element of the network having a particular network address.
- the facility preferably provides a user interface that makes it convenient for a user to generate network profiles.
- the facility uses the profile for the network to replace occurrences of aliases in the template with the addresses of the corresponding specific network elements.
- the facility preferably sends the resulting network-specific policy to the network security device of the network for implementation.
- the policy may be further modified before transmission to the networks security device.
- This process can be repeated to generate policies for each of a number of other networks.
- the underlying template can be revised to add or change rules. Together with the network profiles, this revised template can be used to automatically generate revised policies corresponding to the revised template for all of the networks.
- the facility is especially well suited for use by Internet service providers and other organizations responsible for providing network security to a large number of networks, as it enables these organizations to configure the network security devices for additional networks at a very low cost.
- the facility also enables such organizations to efficiently update the configuration of a large number of operating network security devices by merely modifying and reapplying one or more templates.
- FIG. 1A is a conceptual diagram illustrating the generation of security policies for each of several networks from a single security policy template.
- the user uses the facility to generate a security template 100 .
- the user uses the facility to generate a network profile specifically for implementation in the network.
- These network profiles are shown as network profiles 110 , 120 , 130 , etc.
- the facility combines the security policy template with the network profile for that network. For example, in order to create security policy 115 for network 1 , the facility combines the security policy template 100 with network profile 110 for network 1 .
- FIG. 1B is a conceptual diagram illustrating the creation of a security policy in greater detail.
- FIG. 1B shows the creation of security policy 115 for network 1 shown in FIG. 1A .
- FIG. 1B shows that the security policy template 100 contains a number of security policy rules, including security policy rule 101 .
- Security policy rule 101 specifies that outgoing FTP connections are allowed only from network elements defined as being within the “InformationServices” alias. While only one security policy rule is shown in security policy template 100 to simplify this example, security policy templates often have a larger number of security policy rules.
- the network profile 110 for network 1 contains a definition of the “InformationServices” alias 111 . It can be seen that this definition defines the “InformationServices” alias to include the network elements at the following IP addresses:
- the facility When the security -policy template 100 and the network profile 110 for network 1 are combined to create the security policy 115 for network 1 , the facility replaces the “InfornationServices” alias in rule 101 with the network addresses listed for the “InformationServices” alias in definition 111 . Doing so produces rule 116 in the security policy 115 for network 1 , which indicates that outgoing FTP connections are allowed only from the network elements having IP addresses 220.15.23.52, 220.15.23.53, and 220.15.23.97. In the same manner, for each additional rule in security policy template 100 , the facility replaces each occurrence of an alias with the network addresses of the network elements defined to be within the alias in the network profile 110 for network 1 .
- the rules in security policy 115 for network 1 which are to be implemented in network 1 , specifically refer to network elements within network 1 . In this sense, they differ from the rules in security policies 125 and 135 , which specifically refer to network elements within networks 2 and 3 , respectively.
- FIG. 2 is a network diagram showing a sample network for which the facility generates a policy.
- the network is described relative to a network security device 200 .
- the network security device 200 has three interfaces, through which the network security device is connected to three different “zones”: a trusted zone 210 , an optional zone 220 , and an external zone 230 .
- the trusted zone 210 contains the elements of the network that, in general, receive the most extensive protection from the network security device.
- the trusted zone contains such network elements as user workstations 111 - 114 , and internal server 215 , and a log host 216 .
- Each of the network elements in the trusted zone is preferably identified by a unique address, such as an Ethernet address or an IP address.
- the external zone 230 is considered to include the entirety of the Internet 231 , as well as any intermediate network elements, such as intermediate network element 232 .
- network elements in the external zone are not within the control of the operator of the network.
- Optional zone 220 includes network elements operated by the operators of the network that must be available, at least in certain respects, to network elements of the Internet.
- An example of such an element is public server 221 , which may provide services such as world wide web serving, email serving, file transfer serving, and domain name serving.
- the rules in the policy implemented by the network security device 200 relate to traffic flowing between network elements in the three zones shown.
- FIG. 3 is a high-level block diagram of a computing environment in which the facility may be implemented.
- the diagram shows network security devices 331 - 339 , each protecting a customer network such as the network shown in FIG. 2 .
- These network security devices are operated for the users of these customer networks by a policy manager 310 , such as an Internet service provider.
- the policy manager 310 preferably administers the network security devices via intermediary elements 321 - 323 , called “event processors.” It should be noted that, while only nine protected networks are shown in FIG. 3 , a global policy manager utilizing the facility may easily configure and administer tens, hundreds, or even thousands of network security devices at a reasonable cost.
- U.S. patent application No. ______ (Attorney Docket No. 850108.402) entitled “Managing Multiple Network Security Devices From A Manager Device,” filed concurrently herewith and hereby incorporated by reference in its entirety.
- FIG. 4 is a high-level block diagram of the policy manager computer system upon which portions of the facility preferably execute.
- the policy manager computer system 400 contains one or more central processing units (CPUs) 410 , input/output devices 420 , and a computer memory (memory) 430 .
- CPUs central processing units
- input/output devices is a storage device 421 , such as a hard disk drive, and a computer-readable media drive 422 , which can be used to install software products, including components of the facility, which are provided on a computer-readable medium, such as a CD-ROM.
- the input/output devices also include a network connection 423 , through which the policy manager computer system 400 may communicate with other connected computer systems, such as network security devices.
- the memory 430 preferably contains an operating system 431 , such as MICROSOFT WINDOWS NT or SUN SOLARIS, for providing to other programs access to resources of the computer system.
- the memory 430 preferably further contains policy manager software 432 , which implements aspects of the facility.
- the memory 430 preferably also contains policy templates 433 and 434 generated with the facility, as well as network profiles 435 and 436 generated by the facility. While the facility is preferably implemented on a computer system configured as described above, those skilled in the art will recognize that it may also be implemented on computer systems having different configurations.
- FIG. 5 is a flow diagram showing, at a high level, the steps preferably performed by the facility in order to generate and implement network security policies for a number of protected networks.
- the facility constructs a template based upon aliases for certain network elements.
- the template constructed in step 501 is expressed in terms of rules for network elements rather than in terms of rules for specific network elements of a particular network, and thus may be applied to a number of different networks.
- the facility loops through each of a number of particular networks.
- the facility establishes a network profile mapping the network element aliases used in the template constructed in step 501 to network elements of the current network acting in the roles of the aliases.
- step 504 the facility generates a network security policy for the current network using the template generated in step 501 and the network profile generated for the current network in step 503 .
- step 505 the facility transmits the generated network security policy to the network security device for the current network to enable the network security device to enforce the network security policy within the network.
- step 406 if additional networks remain, then the facility continues to step 502 to process the next network, else the steps conclude.
- FIGS. 6-22 In order to further describe the facility, its operation is discussed below with respect to an example depicted in FIGS. 6-22 .
- the example shows the generation of templates, network profiles, and ultimately policies.
- FIGS. 6-16 show the generation of templates.
- FIG. 6 is a display diagram showing the creation of a template.
- the facility displays a window 600 containing a list 610 of objects that can be created. In this window, the user selects item 611 and OK button 620 in order to create a new template.
- FIG. 7 is a display diagram showing the naming of a new template.
- the facility displays window 700 which contains a name field 701 .
- the user types the name “minimal” in the name field 701 and selects OK button 720 in order to name the new template “minimal.”
- FIG. 8 is a display diagram showing the policy manager user interface.
- the facility displays a policy manager window 800 , which contains a template window 810 corresponding to the new “minimal” template.
- the user selects add button 811 .
- FIG. 9 is a display diagram showing the user interface for adding rules to the template.
- the facility displays window 900 , which contains a list 910 of network services each corresponding to one or more potential network security rules. Among these services are services 911 - 919 .
- the user may select any of the listed services, or may select new button 920 in order to create a new service. In this case, the user has selected the FTP service 912 .
- details 930 about the service are displayed in the window 900 . For example, as the FTP service 912 was selected, the displayed details 930 refer to the FTP service.
- the user selects an Add button 940 .
- FIG. 10 is a display diagram showing the user interface for specifying rules relating to the FTP network service.
- the facility displays window 1000 , which contains tabs 1001 and 1002 , each having a pane for specifying rules relating to the FTP network service.
- the “outgoing” tab 1002 is selected in order to display the pane relating to outgoing traffic.
- the window 1000 further includes radio buttons 1011 and 1012 for denying or allowing outgoing FTP connections, respectively.
- radio button 1011 is selected, so that all outgoing FTP connections are denied.
- FIG. 11 is a display diagram showing a modification made by the user to allow certain outgoing FTP connections.
- the user has selected radio button 1112 in order to allow certain outgoing FTP connections.
- the contents of lists 1121 and 1122 show that outgoing FTP connections are allowed from any source to any destination.
- the user may select add button 1131 or 1132 , respectively.
- FIG. 12 is a display diagram showing the user interface for adding aliases to the source or destination list for outgoing FTP connections.
- the facility displays window 1200 , containing an empty list 1203 of aliases to permit as sources of outgoing FTP connections.
- Window 1200 provides two methods for adding aliases to list 1203 . The first is to select one of the existing aliases 1211 - 1214 , then press Transfer button 1215 to transfer the selected aliases into aliases list 1203 .
- the second method is to type the name of a new alias in new alias field 1201 , then select Add button 1202 in order to transfer the new alias name into alias list 1203 .
- the user uses the second method in order to add the alias “InformationServices” to the alias list 1203 .
- FIG. 13 is a display diagram showing the addition of a new alias to the alias list. It can be seen in FIG. 13 that a new “InformationServices” alias has been added to alias list 1303 . At this point, the user selects Okay button 1305 in order to add the aliases listed in alias list 1303 to the list of aliases that may be the source of outgoing FTP connections.
- FIG. 14 is a display diagram showing the effect of modifying security rules regarding outgoing FTP connections. It can be seen that the “InformationServices” alias 1423 has been added to the list 1421 from the list of aliases from which outgoing FTP connections are allowed. At this point, the user can select the incoming tab 1401 in order to modify rules for incoming FTP connections. The user may also select Okay button 1424 in order to return to the add service window 900 to add additional network services to the template and modify the rules relating to them.
- FIG. 15 is a display diagram showing a depiction of the completed “minimal” template.
- the policy window 1510 contains a rules table 1530 showing information relating to network security rules making up the template, as well as aliases window 1520 listing the aliases occurring in the rules.
- Each row of the table 1530 includes an entry in each of a number of columns: a service column 1531 identifying a network service to which the row corresponds; an incoming sources column 1532 identifying sources from which incoming traffic for the service is permitted; an incoming destinations column 1533 identifying destinations to which incoming traffic of the service is permitted; an incoming allowed traffic log column 1534 indicating whether allowed incoming traffic of the service is to be logged; an incoming denied traffic log column 1535 indicating whether denied incoming traffic for the service is to be logged; outgoing traffic source column 1536 identifying sources from which outgoing traffic for the service is permitted; outgoing traffic destination column 1537 identifying destinations to which outgoing traffic for the service is permitted; an allowed outgoing traffic log column 1538 indicating whether allowed outgoing traffic is to be logged; and denied outgoing traffic log column 1539 indicating whether outgoing denied traffic for the service is to be logged.
- the icons preceding the service name in column 1531 further indicate the extent to which incoming and outgoing traffic is allowed at all for the service in question.
- the aliases list 1520 lists an “InformationServices” alias 1521 for the computers of members of the information services department; an “InternalWebServer” alias 1522 for the internal web server computer system; and a “MailHost” alias 1523 for the mail host computer system. Occurrences of these aliases can be seen in the table 1530 .
- the table 1530 represents the substance of the “minimal” template. In a sense, the table constitutes a data structure storing this template. Those skilled in the art will recognize that such a template may be stored in data structures having a variety of different formats.
- the “minimal” template can be used by the facility to generate policies for particular networks.
- the user repeats the template generation process to generate two additional templates.
- FIG. 16 is a display diagram showing a list of several generated templates.
- Policy manager window 1600 contains a template list 1650 . Included in the template list are the “minimal” template 1651 generated as shown in FIGS. 6-15 , as well as additional “typical” and “full” templates 1652 and 1653 that were generated in the similar manner.
- Each of the templates is preferably designed to correspond to a different set of security services provided by the operators of the policy manager.
- the network security device may be configured using any of the existing templates.
- FIGS. 17-22 show the configuration of a new network security device.
- FIG. 17 is a display diagram showing a user interface for configuring a new network security device.
- the facility display window 1700 which contains a list 1710 of items to create. The user here selects network security device configuration item 1712 and then selects Okay button 1720 .
- FIG. 18 is a display diagram showing the selection of a template for configuring the new network security device.
- the facility displays window 1800 , which contains a list of the three templates 1831 - 1833 .
- the user selects the “minimal” template 1832 , then selects Open button 1820 .
- the user could select one of the three templates from the template list 1650 in the policy manager window 1600 .
- FIG. 19 is a display diagram showing the user interface for generating a network profile for the new network. It can be seen that, in addition to service table 1930 and alias list 1920 , the network security device configuration window 1960 also includes an Edit button 1924 for mapping the aliases in the alias list to specific network elements within the network protected by the new network security device. In order to do so, the user selects each of the aliases 1921 - 1923 in turn, selecting the Edit button 1924 to define each.
- FIG. 20 is a display diagram showing the user interface for defining a first alias within the network profile.
- the Edit button 1924 the facility displays window 2000 .
- Window 2000 contains a list 2010 of addresses for each of the network elements defined for the “InformationServices” alias.
- the user has entered three addresses 2015 - 2017 . In this case, these addresses are those of the computer systems by members of the Information Services department of the company using the protected network. After entering these addresses, the user selects Okay button 2020 .
- FIG. 21 is a display diagram showing the user interface for defining a second alias within the network profile.
- the user has entered a single address 2115 for the “InternalWebServer” alias. This address is the address of the internal web server computer system within the protected network.
- Okay button 2120 the user presses Okay button 2120 .
- the user After the user defines addresses for each of the aliases in alias list 1920 , the user has generated a network profile.
- the facility preferably proceeds to combine this network profile with the “minimal” template to create a policy for the new network, which it forwards to the network security device in the new network to configure the network security device to implement the policy in the protected network.
- FIG. 22 is a display diagram showing a user interface for adding additional services and rules to the policy generated for the network from the template.
- the policy window 2260 further contains table 2270 , which contains “supplemental” rules included in the policy that are entered separately from the selected template.
- the user uses controls 2271 - 2273 , and employs a process similar to that described in conjunction with FIGS. 9-14 .
- Supplemental rules may preferably be expressed in terms of the addresses of specific network elements, aliases, or both.
Abstract
Description
- The present invention is directed to the field of automated network security.
- Network security devices provide various types of network security services to a network, such as a local area network connected to the Internet. For example, a network security device may perform access control and traffic monitoring and logging. Access control refers to the regulation of network traffic based upon its type, content, source, and/or destination. For example, access control services of a network security device can be employed to prevent email traffic from sources on the Internet from reaching computer systems inside the network other than a designated mail host computer system. Traffic monitoring and logging refers to observing network traffic, and storing important observations about the network traffic in a log. As an example, traffic monitoring and logging services of a network security device can be employed to log all unsuccessful attempts from sources on the Internet to access a server in the network containing sensitive information.
- Unfortunately, in order to perform such functions, conventional network security devices generally must be configured manually, typically on-site at the location of the network. Such configuration can be extremely time-consuming. Also, because of the nature of typical configuration processes, they generally must be performed by a technical specialist whose time is both scarce and expensive. It is especially important that the configuration process be performed correctly, since misconfiguration of a security device often leaves the network that is to be protected by the security device vulnerable to attack or other abuse.
- These shortcomings of conventional network security device configuration processes tend to make the installation and use of a network security device difficult and/or expensive. Accordingly, a streamlined, more highly automated configuration process that is capable of correctly configuring network security devices would make the proper use of such network security devices more accessible, and would therefore have significant utility.
- The present invention provides a software facility for implementing similar network security policies across multiple networks (“the facility”). Each network is a collection of network elements, including a network security device that protects the network by implementing a network security policy (hereinafter simply “policy”) within the network. While Firebox II network security devices provided by WatchGuard Technologies, Inc., of Seattle, Wash. are suggested for use with the facility, the facility preferably also operates with other network security devices available from other sources.
- The policy implemented in a particular network comprises a set of rules for managing network traffic. These rules are specified in terms of specific network elements, such as user workstations, servers, routers, and printers, that perform certain functions, or “roles.” For example, a rule in a network security policy for a particular network may specify that all email traffic must flow through a network element having a particular network address that is specifically configured as a mail host. In a sense, these rules establish trust relationships between specific network elements, or groups thereof.
- The facility preferably provides a user interface for constructing one or more network security policy templates (hereinafter simply “templates”) that can each be used to generate similar policies for any number of specific networks. A template contains rules expressed in terms of “aliases,” rather than in terms of specific network elements. For example, a template may include a rule specifying that all email traffic must flow through a “MailHost” alias that is not associated with a particular network address.
- To generate a policy for a particular network from a template, the facility uses a profile of the network that maps the aliases occurring in the template to specific network elements within the network. For example, the network profile for a particular network maps the “MailHost” alias to a particular network element of the network having a particular network address. The facility preferably provides a user interface that makes it convenient for a user to generate network profiles.
- The facility uses the profile for the network to replace occurrences of aliases in the template with the addresses of the corresponding specific network elements. The facility preferably sends the resulting network-specific policy to the network security device of the network for implementation. In certain embodiments, the policy may be further modified before transmission to the networks security device.
- This process can be repeated to generate policies for each of a number of other networks. At a later time, the underlying template can be revised to add or change rules. Together with the network profiles, this revised template can be used to automatically generate revised policies corresponding to the revised template for all of the networks.
- The facility is especially well suited for use by Internet service providers and other organizations responsible for providing network security to a large number of networks, as it enables these organizations to configure the network security devices for additional networks at a very low cost. The facility also enables such organizations to efficiently update the configuration of a large number of operating network security devices by merely modifying and reapplying one or more templates.
-
FIG. 1A is a conceptual diagram illustrating the generation of security policies for each of several networks from a single security policy template. -
FIG. 1B is a conceptual diagram illustrating the creation of a security policy in greater detail. -
FIG. 2 is a network diagram showing a sample network for which the facility generates a policy. -
FIG. 3 is a high-level block diagram of a computing environment in which the facility may be implemented. -
FIG. 4 is a high-level block diagram of the policy manager computer system upon which portions of the facility preferably execute. -
FIG. 5 is a flow diagram showing, at a high level, the steps preferably performed by the facility in order to generate and implement network security policies for a number of protected networks. -
FIG. 6 is a display diagram showing the creation of a template. -
FIG. 7 is a display diagram showing the naming of a new template. -
FIG. 8 is a display diagram showing the policy manager user interface. -
FIG. 9 is a display diagram showing the user interface for adding rules to the template. -
FIG. 10 is a display diagram showing the user interface for specifying rules relating to the FTP network service. -
FIG. 11 is a display diagram showing a modification made by the user to allow certain outgoing FTP connections. -
FIG. 12 is a display diagram showing the user interface for adding aliases to the source or destination list for a network service. -
FIG. 13 is a display diagram showing the addition of a new alias to the alias list. -
FIG. 14 is a display diagram showing the effect of modifying security rules regarding outgoing FTP connections. -
FIG. 15 is a display diagram showing a depiction of the completed “minimal” template. -
FIG. 16 is a display diagram showing a list of several generated templates. -
FIG. 17 is a display diagram showing a user interface for configuring a new network security device. -
FIG. 18 is a display diagram showing the selection of a template for configuring the new network security device. -
FIG. 19 is a display diagram showing the user interface for generating a network profile for the new network. -
FIG. 20 is a display diagram showing the user interface for defining a first alias within the network profile. -
FIG. 21 is a display diagram showing the user interface for defining a second alias within the network profile. -
FIG. 22 is a display diagram showing a user interface for adding additional services and rules to the policy generated for the network from the template. - The present invention provides a software facility for implementing similar network security policies across multiple networks (“the facility”). Each network is a collection of network elements, including a network security device that protects the network by implementing a network security policy (hereinafter simply “policy”) within the network. While Firebox II network security devices provided by WatchGuard Technologies, Inc., of Seattle, Wash. are suggested for use with the facility, the facility preferably also operates with other network security devices available from other sources.
- The policy implemented in a particular network comprises a set of rules for managing network traffic. These rules are specified in terms of specific network elements, such as user workstations, servers, routers, and printers, that perform certain functions, or “roles.” For example, a rule in a network security policy for a particular network may specify that all email traffic must flow through a network element having a particular network address that is specifically configured as a mail host. In a sense, these rules establish trust relationships between specific network elements, or groups thereof.
- The facility preferably provides a user interface for constructing one or more network security policy templates (hereinafter simply “templates”) that can each be used to generate similar policies for any number of specific networks. A template contains rules expressed in terms of “aliases,” rather than in terms of specific network elements. For example, a template may include a rule specifying that all email traffic must flow through a “MailHost” alias that is not associated with a particular network address.
- To generate a policy for a particular network from a template, the facility uses a profile of the network that maps the aliases occurring in the template to specific network elements within the network. For example, the network profile for a particular network maps the “MailHost” alias to a particular network element of the network having a particular network address. The facility preferably provides a user interface that makes it convenient for a user to generate network profiles.
- The facility uses the profile for the network to replace occurrences of aliases in the template with the addresses of the corresponding specific network elements. The facility preferably sends the resulting network-specific policy to the network security device of the network for implementation. In certain embodiments, the policy may be further modified before transmission to the networks security device.
- This process can be repeated to generate policies for each of a number of other networks. At a later time, the underlying template can be revised to add or change rules. Together with the network profiles, this revised template can be used to automatically generate revised policies corresponding to the revised template for all of the networks.
- The facility is especially well suited for use by Internet service providers and other organizations responsible for providing network security to a large number of networks, as it enables these organizations to configure the network security devices for additional networks at a very low cost. The facility also enables such organizations to efficiently update the configuration of a large number of operating network security devices by merely modifying and reapplying one or more templates.
-
FIG. 1A is a conceptual diagram illustrating the generation of security policies for each of several networks from a single security policy template. Using the facility, the user generates asecurity template 100. Then, for each of a number ofdifferent networks security policy 115 fornetwork 1, the facility combines thesecurity policy template 100 withnetwork profile 110 fornetwork 1. -
FIG. 1B is a conceptual diagram illustrating the creation of a security policy in greater detail. In particular,FIG. 1B shows the creation ofsecurity policy 115 fornetwork 1 shown inFIG. 1A .FIG. 1B shows that thesecurity policy template 100 contains a number of security policy rules, includingsecurity policy rule 101.Security policy rule 101 specifies that outgoing FTP connections are allowed only from network elements defined as being within the “InformationServices” alias. While only one security policy rule is shown insecurity policy template 100 to simplify this example, security policy templates often have a larger number of security policy rules. - The
network profile 110 fornetwork 1 contains a definition of the “InformationServices”alias 111. It can be seen that this definition defines the “InformationServices” alias to include the network elements at the following IP addresses: -
- 20 220.15.23.52
- 220.15.23.53
- 220.15.23.97
In general, a network profile contains an alias definition likealias definition 111 for each alias used in the security policy template.
- When the security -
policy template 100 and thenetwork profile 110 fornetwork 1 are combined to create thesecurity policy 115 fornetwork 1, the facility replaces the “InfornationServices” alias inrule 101 with the network addresses listed for the “InformationServices” alias indefinition 111. Doing so producesrule 116 in thesecurity policy 115 fornetwork 1, which indicates that outgoing FTP connections are allowed only from the network elements having IP addresses 220.15.23.52, 220.15.23.53, and 220.15.23.97. In the same manner, for each additional rule insecurity policy template 100, the facility replaces each occurrence of an alias with the network addresses of the network elements defined to be within the alias in thenetwork profile 110 fornetwork 1. As a result, the rules insecurity policy 115 fornetwork 1, which are to be implemented innetwork 1, specifically refer to network elements withinnetwork 1. In this sense, they differ from the rules insecurity policies networks -
FIG. 2 is a network diagram showing a sample network for which the facility generates a policy. The network is described relative to anetwork security device 200. Thenetwork security device 200 has three interfaces, through which the network security device is connected to three different “zones”: a trustedzone 210, anoptional zone 220, and anexternal zone 230. The trustedzone 210 contains the elements of the network that, in general, receive the most extensive protection from the network security device. The trusted zone contains such network elements as user workstations 111-114, andinternal server 215, and alog host 216. Each of the network elements in the trusted zone is preferably identified by a unique address, such as an Ethernet address or an IP address. Theexternal zone 230 is considered to include the entirety of theInternet 231, as well as any intermediate network elements, such asintermediate network element 232. In general, network elements in the external zone are not within the control of the operator of the network.Optional zone 220 includes network elements operated by the operators of the network that must be available, at least in certain respects, to network elements of the Internet. An example of such an element is public server 221, which may provide services such as world wide web serving, email serving, file transfer serving, and domain name serving. The rules in the policy implemented by thenetwork security device 200 relate to traffic flowing between network elements in the three zones shown. -
FIG. 3 is a high-level block diagram of a computing environment in which the facility may be implemented. The diagram shows network security devices 331-339, each protecting a customer network such as the network shown inFIG. 2 . These network security devices are operated for the users of these customer networks by apolicy manager 310, such as an Internet service provider. Thepolicy manager 310 preferably administers the network security devices via intermediary elements 321-323, called “event processors.” It should be noted that, while only nine protected networks are shown inFIG. 3 , a global policy manager utilizing the facility may easily configure and administer tens, hundreds, or even thousands of network security devices at a reasonable cost. For additional information on the environment shown inFIG. 3 , refer to U.S. patent application No. ______ (Attorney Docket No. 850108.402) entitled “Managing Multiple Network Security Devices From A Manager Device,” filed concurrently herewith and hereby incorporated by reference in its entirety. -
FIG. 4 is a high-level block diagram of the policy manager computer system upon which portions of the facility preferably execute. The policymanager computer system 400 contains one or more central processing units (CPUs) 410, input/output devices 420, and a computer memory (memory) 430. Among the input/output devices is a storage device 421, such as a hard disk drive, and a computer-readable media drive 422, which can be used to install software products, including components of the facility, which are provided on a computer-readable medium, such as a CD-ROM. The input/output devices also include anetwork connection 423, through which the policymanager computer system 400 may communicate with other connected computer systems, such as network security devices. Thememory 430 preferably contains anoperating system 431, such as MICROSOFT WINDOWS NT or SUN SOLARIS, for providing to other programs access to resources of the computer system. Thememory 430 preferably further containspolicy manager software 432, which implements aspects of the facility. Thememory 430 preferably also containspolicy templates -
FIG. 5 is a flow diagram showing, at a high level, the steps preferably performed by the facility in order to generate and implement network security policies for a number of protected networks. In step 501, the facility constructs a template based upon aliases for certain network elements. The template constructed in step 501 is expressed in terms of rules for network elements rather than in terms of rules for specific network elements of a particular network, and thus may be applied to a number of different networks. In steps 502-506, the facility loops through each of a number of particular networks. In step 503, the facility establishes a network profile mapping the network element aliases used in the template constructed in step 501 to network elements of the current network acting in the roles of the aliases. In step 504, the facility generates a network security policy for the current network using the template generated in step 501 and the network profile generated for the current network in step 503. In step 505, the facility transmits the generated network security policy to the network security device for the current network to enable the network security device to enforce the network security policy within the network. In step 406 if additional networks remain, then the facility continues to step 502 to process the next network, else the steps conclude. - In order to further describe the facility, its operation is discussed below with respect to an example depicted in
FIGS. 6-22 . The example shows the generation of templates, network profiles, and ultimately policies. -
FIGS. 6-16 show the generation of templates.FIG. 6 is a display diagram showing the creation of a template. The facility displays awindow 600 containing alist 610 of objects that can be created. In this window, the user selectsitem 611 andOK button 620 in order to create a new template. -
FIG. 7 is a display diagram showing the naming of a new template. The facility displayswindow 700 which contains aname field 701. The user types the name “minimal” in thename field 701 and selectsOK button 720 in order to name the new template “minimal.” -
FIG. 8 is a display diagram showing the policy manager user interface. The facility displays apolicy manager window 800, which contains atemplate window 810 corresponding to the new “minimal” template. In order to add rules to the “minimal” template, the user selects addbutton 811. -
FIG. 9 is a display diagram showing the user interface for adding rules to the template. The facility displayswindow 900, which contains alist 910 of network services each corresponding to one or more potential network security rules. Among these services are services 911-919. The user may select any of the listed services, or may selectnew button 920 in order to create a new service. In this case, the user has selected theFTP service 912. Once a service is selected, details 930 about the service are displayed in thewindow 900. For example, as theFTP service 912 was selected, the displayed details 930 refer to the FTP service. In order to add rules corresponding to the FTP service to the rules of the “minimal” template, the user selects anAdd button 940. -
FIG. 10 is a display diagram showing the user interface for specifying rules relating to the FTP network service. The facility displayswindow 1000, which containstabs FIG. 10 , the “outgoing”tab 1002 is selected in order to display the pane relating to outgoing traffic. Thewindow 1000 further includesradio buttons FIG. 10 ,radio button 1011 is selected, so that all outgoing FTP connections are denied. -
FIG. 11 is a display diagram showing a modification made by the user to allow certain outgoing FTP connections. InFIG. 11 it can be seen that the user has selectedradio button 1112 in order to allow certain outgoing FTP connections. The contents oflists button -
FIG. 12 is a display diagram showing the user interface for adding aliases to the source or destination list for outgoing FTP connections. The facility displayswindow 1200, containing anempty list 1203 of aliases to permit as sources of outgoing FTP connections.Window 1200 provides two methods for adding aliases tolist 1203. The first is to select one of the existing aliases 1211-1214, then pressTransfer button 1215 to transfer the selected aliases intoaliases list 1203. The second method is to type the name of a new alias innew alias field 1201, then selectAdd button 1202 in order to transfer the new alias name intoalias list 1203. InFIG. 12 , the user uses the second method in order to add the alias “InformationServices” to thealias list 1203. -
FIG. 13 is a display diagram showing the addition of a new alias to the alias list. It can be seen inFIG. 13 that a new “InformationServices” alias has been added toalias list 1303. At this point, the user selectsOkay button 1305 in order to add the aliases listed inalias list 1303 to the list of aliases that may be the source of outgoing FTP connections. -
FIG. 14 is a display diagram showing the effect of modifying security rules regarding outgoing FTP connections. It can be seen that the “InformationServices”alias 1423 has been added to thelist 1421 from the list of aliases from which outgoing FTP connections are allowed. At this point, the user can select theincoming tab 1401 in order to modify rules for incoming FTP connections. The user may also selectOkay button 1424 in order to return to theadd service window 900 to add additional network services to the template and modify the rules relating to them. -
FIG. 15 is a display diagram showing a depiction of the completed “minimal” template. Thepolicy window 1510 contains a rules table 1530 showing information relating to network security rules making up the template, as well asaliases window 1520 listing the aliases occurring in the rules. Each row of the table 1530 includes an entry in each of a number of columns: aservice column 1531 identifying a network service to which the row corresponds; anincoming sources column 1532 identifying sources from which incoming traffic for the service is permitted; anincoming destinations column 1533 identifying destinations to which incoming traffic of the service is permitted; an incoming allowedtraffic log column 1534 indicating whether allowed incoming traffic of the service is to be logged; an incoming deniedtraffic log column 1535 indicating whether denied incoming traffic for the service is to be logged; outgoingtraffic source column 1536 identifying sources from which outgoing traffic for the service is permitted; outgoing traffic destination column 1537 identifying destinations to which outgoing traffic for the service is permitted; an allowed outgoingtraffic log column 1538 indicating whether allowed outgoing traffic is to be logged; and denied outgoingtraffic log column 1539 indicating whether outgoing denied traffic for the service is to be logged. The icons preceding the service name incolumn 1531 further indicate the extent to which incoming and outgoing traffic is allowed at all for the service in question. The aliases list 1520 lists an “InformationServices”alias 1521 for the computers of members of the information services department; an “InternalWebServer”alias 1522 for the internal web server computer system; and a “MailHost”alias 1523 for the mail host computer system. Occurrences of these aliases can be seen in the table 1530. - The table 1530 represents the substance of the “minimal” template. In a sense, the table constitutes a data structure storing this template. Those skilled in the art will recognize that such a template may be stored in data structures having a variety of different formats.
- Now that the “minimal” template is complete, it can be used by the facility to generate policies for particular networks. As part of the example, the user repeats the template generation process to generate two additional templates.
-
FIG. 16 is a display diagram showing a list of several generated templates.Policy manager window 1600 contains atemplate list 1650. Included in the template list are the “minimal”template 1651 generated as shown inFIGS. 6-15 , as well as additional “typical” and “full”templates FIGS. 17-22 show the configuration of a new network security device. -
FIG. 17 is a display diagram showing a user interface for configuring a new network security device. Thefacility display window 1700, which contains alist 1710 of items to create. The user here selects network securitydevice configuration item 1712 and then selectsOkay button 1720. -
FIG. 18 is a display diagram showing the selection of a template for configuring the new network security device. The facility displayswindow 1800, which contains a list of the three templates 1831-1833. The user selects the “minimal”template 1832, then selectsOpen button 1820. Alternatively, the user could select one of the three templates from thetemplate list 1650 in thepolicy manager window 1600. -
FIG. 19 is a display diagram showing the user interface for generating a network profile for the new network. It can be seen that, in addition to service table 1930 andalias list 1920, the network securitydevice configuration window 1960 also includes anEdit button 1924 for mapping the aliases in the alias list to specific network elements within the network protected by the new network security device. In order to do so, the user selects each of the aliases 1921-1923 in turn, selecting theEdit button 1924 to define each. -
FIG. 20 is a display diagram showing the user interface for defining a first alias within the network profile. When the user selects the “InformationServices”alias 1921, then theEdit button 1924, the facility displayswindow 2000.Window 2000 contains alist 2010 of addresses for each of the network elements defined for the “InformationServices” alias. Here, the user has entered three addresses 2015-2017. In this case, these addresses are those of the computer systems by members of the Information Services department of the company using the protected network. After entering these addresses, the user selectsOkay button 2020. -
FIG. 21 is a display diagram showing the user interface for defining a second alias within the network profile. In this case, the user has entered asingle address 2115 for the “InternalWebServer” alias. This address is the address of the internal web server computer system within the protected network. In order to finalize this list, the user pressesOkay button 2120. - After the user defines addresses for each of the aliases in
alias list 1920, the user has generated a network profile. The facility preferably proceeds to combine this network profile with the “minimal” template to create a policy for the new network, which it forwards to the network security device in the new network to configure the network security device to implement the policy in the protected network. -
FIG. 22 is a display diagram showing a user interface for adding additional services and rules to the policy generated for the network from the template. It can be seen that, in addition to table 2230 which contains rules defined within the template, thepolicy window 2260 further contains table 2270, which contains “supplemental” rules included in the policy that are entered separately from the selected template. In order to add rules to this table and modify or remove rules from this table, the user uses controls 2271-2273, and employs a process similar to that described in conjunction withFIGS. 9-14 . Supplemental rules may preferably be expressed in terms of the addresses of specific network elements, aliases, or both. Once the user has defined supplemental rules in this manner, the policy used by the network security device for the network constitutes a union of the rules shown inwindows - While this invention has been shown and described with reference to preferred embodiments, it will be understood by those skilled in the art that various changes or modifications in form and detail may be made without departing from the scope of the invention. For example, those skilled in the art will recognize that the facility may be straightforwardly adapted to work with other types of security devices in addition to those described herein. Further, the facility may be adapted to use various other user interface techniques and data structures in addition to those described herein. Also, the facility may be straightforwardly adapted to operate in a variety of different types of networking environments.
Claims (14)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/819,718 US20050022027A1 (en) | 1999-05-06 | 2004-04-07 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
US11/873,512 US20080209504A1 (en) | 1999-05-06 | 2007-10-17 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/306,646 US6738908B1 (en) | 1999-05-06 | 1999-05-06 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
US10/819,718 US20050022027A1 (en) | 1999-05-06 | 2004-04-07 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/306,646 Continuation US6738908B1 (en) | 1999-05-06 | 1999-05-06 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/873,512 Continuation US20080209504A1 (en) | 1999-05-06 | 2007-10-17 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Publications (1)
Publication Number | Publication Date |
---|---|
US20050022027A1 true US20050022027A1 (en) | 2005-01-27 |
Family
ID=23186223
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/306,646 Expired - Lifetime US6738908B1 (en) | 1999-05-06 | 1999-05-06 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
US10/819,718 Abandoned US20050022027A1 (en) | 1999-05-06 | 2004-04-07 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
US11/873,512 Abandoned US20080209504A1 (en) | 1999-05-06 | 2007-10-17 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/306,646 Expired - Lifetime US6738908B1 (en) | 1999-05-06 | 1999-05-06 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/873,512 Abandoned US20080209504A1 (en) | 1999-05-06 | 2007-10-17 | Generalized network security policy templates for implementing similar network security policies across multiple networks |
Country Status (3)
Country | Link |
---|---|
US (3) | US6738908B1 (en) |
AU (1) | AU4240100A (en) |
WO (1) | WO2000069145A1 (en) |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040030915A1 (en) * | 2002-02-21 | 2004-02-12 | Shigetoshi Sameshima | Access restriction control device and method |
US20040230450A1 (en) * | 2003-03-06 | 2004-11-18 | Bartlit Fred H. | System, method, and computer program product for enabling customers to adjust the level of service provided by service providers |
US20050068935A1 (en) * | 2003-09-30 | 2005-03-31 | Nokia Corporation | Method of communication |
US20060072456A1 (en) * | 2004-09-30 | 2006-04-06 | Cisco Technology, Inc. | Method and apparatus for device based policy configuration in a network |
US20080098455A1 (en) * | 2006-10-20 | 2008-04-24 | Canon Kabushiki Kaisha | Document management system and document management method |
US20160188877A1 (en) * | 2013-08-14 | 2016-06-30 | Ajeya Hindupur Simha | Automating Monitoring Of A Computing Resource In A Cloud-Based Data Center |
US11212322B2 (en) * | 2018-10-10 | 2021-12-28 | Rockwelll Automation Technologies, Inc. | Automated discovery of security policy from design data |
US20220321568A1 (en) * | 2021-04-01 | 2022-10-06 | Hewlett Packard Enterprise Development Lp | Systems and methods for generating and implementing security profiles |
Families Citing this family (118)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6738908B1 (en) * | 1999-05-06 | 2004-05-18 | Watchguard Technologies, Inc. | Generalized network security policy templates for implementing similar network security policies across multiple networks |
US7376965B2 (en) * | 2000-05-15 | 2008-05-20 | Hewlett-Packard Development Company, L.P. | System and method for implementing a bubble policy to achieve host and network security |
JP2001325172A (en) * | 2000-05-17 | 2001-11-22 | Fujitsu Ltd | Communication setting management system |
US8250570B2 (en) | 2000-10-31 | 2012-08-21 | Hewlett-Packard Development Company, L.P. | Automated provisioning framework for internet site servers |
US20020082818A1 (en) * | 2000-10-31 | 2002-06-27 | Glenn Ferguson | Data model for automated server configuration |
US8095624B2 (en) * | 2000-12-28 | 2012-01-10 | CenterBeam Inc. | Architecture for serving and managing independent access devices |
JP2002290708A (en) * | 2001-03-27 | 2002-10-04 | Fujitsu Ltd | Security securing system in service function executing system |
US7743147B2 (en) * | 2001-04-20 | 2010-06-22 | Hewlett-Packard Development Company, L.P. | Automated provisioning of computing networks using a network database data model |
US8141144B2 (en) * | 2001-05-10 | 2012-03-20 | Hewlett-Packard Development Company, L.P. | Security policy management for network devices |
US7536715B2 (en) | 2001-05-25 | 2009-05-19 | Secure Computing Corporation | Distributed firewall system and method |
US7200662B2 (en) | 2001-07-06 | 2007-04-03 | Juniper Networks, Inc. | Integrated rule network management system |
US7305492B2 (en) * | 2001-07-06 | 2007-12-04 | Juniper Networks, Inc. | Content service aggregation system |
US7546629B2 (en) * | 2002-03-06 | 2009-06-09 | Check Point Software Technologies, Inc. | System and methodology for security policy arbitration |
GB0117429D0 (en) * | 2001-07-17 | 2001-09-12 | Trustis Ltd | Trust management |
US7222359B2 (en) * | 2001-07-27 | 2007-05-22 | Check Point Software Technologies, Inc. | System methodology for automatic local network discovery and firewall reconfiguration for mobile computing devices |
US6986160B1 (en) * | 2001-08-31 | 2006-01-10 | Mcafee, Inc. | Security scanning system and method utilizing generic IP addresses |
US20030074578A1 (en) * | 2001-10-16 | 2003-04-17 | Richard Ford | Computer virus containment |
US8006280B1 (en) | 2001-12-12 | 2011-08-23 | Hildebrand Hal S | Security system for generating keys from access rules in a decentralized manner and methods therefor |
US10033700B2 (en) | 2001-12-12 | 2018-07-24 | Intellectual Ventures I Llc | Dynamic evaluation of access rights |
US7178033B1 (en) | 2001-12-12 | 2007-02-13 | Pss Systems, Inc. | Method and apparatus for securing digital assets |
US7260555B2 (en) | 2001-12-12 | 2007-08-21 | Guardian Data Storage, Llc | Method and architecture for providing pervasive security to digital assets |
US7930756B1 (en) | 2001-12-12 | 2011-04-19 | Crocker Steven Toye | Multi-level cryptographic transformations for securing digital assets |
US7921284B1 (en) | 2001-12-12 | 2011-04-05 | Gary Mark Kinghorn | Method and system for protecting electronic data in enterprise environment |
USRE41546E1 (en) | 2001-12-12 | 2010-08-17 | Klimenty Vainstein | Method and system for managing security tiers |
US7681034B1 (en) | 2001-12-12 | 2010-03-16 | Chang-Ping Lee | Method and apparatus for securing electronic data |
US7783765B2 (en) * | 2001-12-12 | 2010-08-24 | Hildebrand Hal S | System and method for providing distributed access control to secured documents |
US7380120B1 (en) | 2001-12-12 | 2008-05-27 | Guardian Data Storage, Llc | Secured data format for access control |
US10360545B2 (en) | 2001-12-12 | 2019-07-23 | Guardian Data Storage, Llc | Method and apparatus for accessing secured electronic data off-line |
US8065713B1 (en) | 2001-12-12 | 2011-11-22 | Klimenty Vainstein | System and method for providing multi-location access management to secured items |
US7921450B1 (en) | 2001-12-12 | 2011-04-05 | Klimenty Vainstein | Security system using indirect key generation from access rules and methods therefor |
US7921288B1 (en) | 2001-12-12 | 2011-04-05 | Hildebrand Hal S | System and method for providing different levels of key security for controlling access to secured items |
US7478418B2 (en) * | 2001-12-12 | 2009-01-13 | Guardian Data Storage, Llc | Guaranteed delivery of changes to security policies in a distributed system |
US7565683B1 (en) | 2001-12-12 | 2009-07-21 | Weiqing Huang | Method and system for implementing changes to security policies in a distributed security system |
US7950066B1 (en) | 2001-12-21 | 2011-05-24 | Guardian Data Storage, Llc | Method and system for restricting use of a clipboard application |
US8176334B2 (en) | 2002-09-30 | 2012-05-08 | Guardian Data Storage, Llc | Document security system that permits external users to gain access to secured files |
US7243368B2 (en) * | 2002-03-29 | 2007-07-10 | Hewlett-Packard Development Company, L.P. | Access control system and method for a networked computer system |
JP4072370B2 (en) * | 2002-04-04 | 2008-04-09 | キヤノン株式会社 | Printer, printing method, program, and storage medium |
US8613102B2 (en) | 2004-03-30 | 2013-12-17 | Intellectual Ventures I Llc | Method and system for providing document retention using cryptography |
US7340770B2 (en) * | 2002-05-15 | 2008-03-04 | Check Point Software Technologies, Inc. | System and methodology for providing community-based security policies |
US6950825B2 (en) * | 2002-05-30 | 2005-09-27 | International Business Machines Corporation | Fine grained role-based access to system resources |
US7249174B2 (en) * | 2002-06-12 | 2007-07-24 | Bladelogic, Inc. | Method and system for executing and undoing distributed server change operations |
US7143283B1 (en) * | 2002-07-31 | 2006-11-28 | Cisco Technology, Inc. | Simplifying the selection of network paths for implementing and managing security policies on a network |
US7594262B2 (en) | 2002-09-04 | 2009-09-22 | Secure Computing Corporation | System and method for secure group communications |
JP4786116B2 (en) | 2002-09-06 | 2011-10-05 | ソニー株式会社 | Information processing apparatus and method, and program |
US7512810B1 (en) | 2002-09-11 | 2009-03-31 | Guardian Data Storage Llc | Method and system for protecting encrypted files transmitted over a network |
US7673344B1 (en) | 2002-09-18 | 2010-03-02 | Symantec Corporation | Mechanism to search information content for preselected data |
US8041719B2 (en) | 2003-05-06 | 2011-10-18 | Symantec Corporation | Personal computing device-based mechanism to detect preselected data |
US7472114B1 (en) | 2002-09-18 | 2008-12-30 | Symantec Corporation | Method and apparatus to define the scope of a search for information from a tabular data source |
US8225371B2 (en) * | 2002-09-18 | 2012-07-17 | Symantec Corporation | Method and apparatus for creating an information security policy based on a pre-configured template |
US8661498B2 (en) | 2002-09-18 | 2014-02-25 | Symantec Corporation | Secure and scalable detection of preselected data embedded in electronically transmitted messages |
US7886359B2 (en) * | 2002-09-18 | 2011-02-08 | Symantec Corporation | Method and apparatus to report policy violations in messages |
US7308706B2 (en) | 2002-10-28 | 2007-12-11 | Secure Computing Corporation | Associative policy model |
US7836310B1 (en) | 2002-11-01 | 2010-11-16 | Yevgeniy Gutnik | Security system that uses indirect password-based encryption |
US7136856B2 (en) * | 2002-12-04 | 2006-11-14 | International Business Machines Corporation | Multi-level security profile refresh |
US7890990B1 (en) | 2002-12-20 | 2011-02-15 | Klimenty Vainstein | Security system with staging capabilities |
US8707034B1 (en) | 2003-05-30 | 2014-04-22 | Intellectual Ventures I Llc | Method and system for using remote headers to secure electronic files |
US8346929B1 (en) * | 2003-08-18 | 2013-01-01 | Oracle America, Inc. | System and method for generating secure Web service architectures using a Web Services security assessment methodology |
WO2005032042A1 (en) | 2003-09-24 | 2005-04-07 | Infoexpress, Inc. | Systems and methods of controlling network access |
US8127366B2 (en) | 2003-09-30 | 2012-02-28 | Guardian Data Storage, Llc | Method and apparatus for transitioning between states of security policies used to secure electronic documents |
US7703140B2 (en) | 2003-09-30 | 2010-04-20 | Guardian Data Storage, Llc | Method and system for securing digital assets using process-driven security policies |
US7484237B2 (en) * | 2004-05-13 | 2009-01-27 | Hewlett-Packard Development Company, L.P. | Method and apparatus for role-based security policy management |
US7540013B2 (en) * | 2004-06-07 | 2009-05-26 | Check Point Software Technologies, Inc. | System and methodology for protecting new computers by applying a preconfigured security update policy |
JP4341517B2 (en) * | 2004-06-21 | 2009-10-07 | 日本電気株式会社 | Security policy management system, security policy management method and program |
JP4197311B2 (en) * | 2004-06-22 | 2008-12-17 | インターナショナル・ビジネス・マシーンズ・コーポレーション | Security policy generation method, security policy generation device, program, and recording medium |
US7707427B1 (en) | 2004-07-19 | 2010-04-27 | Michael Frederick Kenrich | Multi-level file digests |
KR100645514B1 (en) * | 2004-10-19 | 2006-11-15 | 삼성전자주식회사 | System and Method for Element Management in Multi-Network |
US8904486B2 (en) * | 2005-05-19 | 2014-12-02 | International Business Machines Corporation | Method and system for autonomic security configuration |
US8566928B2 (en) | 2005-10-27 | 2013-10-22 | Georgia Tech Research Corporation | Method and system for detecting and responding to attacking networks |
US8181220B2 (en) * | 2005-12-19 | 2012-05-15 | Adobe Systems Incorporated | Method and apparatus for digital rights management policies |
US20070204323A1 (en) * | 2006-02-24 | 2007-08-30 | Rockwell Automation Technologies, Inc. | Auto-detection capabilities for out of the box experience |
US20070282982A1 (en) * | 2006-06-05 | 2007-12-06 | Rhonda Childress | Policy-Based Management in a Computer Environment |
US7814531B2 (en) * | 2006-06-30 | 2010-10-12 | Intel Corporation | Detection of network environment for network access control |
US8607300B2 (en) * | 2006-07-18 | 2013-12-10 | Genband Us Llc | Network security policy mediation |
US8284664B1 (en) | 2007-09-28 | 2012-10-09 | Juniper Networks, Inc. | Redirecting data units to service modules based on service tags and a redirection table |
US8332761B2 (en) * | 2008-01-08 | 2012-12-11 | International Business Machines Corporation | Multiple profiles for a user in a synchronous conferencing environment |
US7996374B1 (en) | 2008-03-28 | 2011-08-09 | Symantec Corporation | Method and apparatus for automatically correlating related incidents of policy violations |
US20090300748A1 (en) * | 2008-06-02 | 2009-12-03 | Secure Computing Corporation | Rule combination in a firewall |
US8424053B2 (en) * | 2008-07-01 | 2013-04-16 | International Business Machines Corporation | Method of dynamically updating network security policy rules when new network resources are provisioned in a service landscape |
US8819201B2 (en) * | 2008-08-07 | 2014-08-26 | At&T Intellectual Property I, L.P. | Method and apparatus for providing routing and access control filters |
US10027688B2 (en) | 2008-08-11 | 2018-07-17 | Damballa, Inc. | Method and system for detecting malicious and/or botnet-related domain names |
US8826443B1 (en) | 2008-09-18 | 2014-09-02 | Symantec Corporation | Selective removal of protected content from web requests sent to an interactive website |
US8935752B1 (en) | 2009-03-23 | 2015-01-13 | Symantec Corporation | System and method for identity consolidation |
US8925034B1 (en) * | 2009-06-30 | 2014-12-30 | Symantec Corporation | Data protection requirements specification and migration |
US8578497B2 (en) | 2010-01-06 | 2013-11-05 | Damballa, Inc. | Method and system for detecting malware |
CN102835071B (en) * | 2010-04-02 | 2015-09-02 | 交互数字专利控股公司 | policy management method |
US8880666B2 (en) * | 2010-10-29 | 2014-11-04 | At&T Intellectual Property I, L.P. | Method, policy request router, and machine-readable hardware storage device to select a policy server based on a network condition to receive policy requests for a duration |
US9112911B1 (en) * | 2011-01-04 | 2015-08-18 | Juniper Networks, Inc. | Adding firewall security policy dynamically to support group VPN |
CN104106073B (en) * | 2011-12-21 | 2017-06-27 | 阿卡麦科技公司 | Security strategy editing machine |
US9680925B2 (en) | 2012-01-09 | 2017-06-13 | At&T Intellectual Property I, L. P. | Methods and apparatus to route message traffic using tiered affinity-based message routing |
US10547674B2 (en) | 2012-08-27 | 2020-01-28 | Help/Systems, Llc | Methods and systems for network flow analysis |
US10084806B2 (en) | 2012-08-31 | 2018-09-25 | Damballa, Inc. | Traffic simulation to identify malicious activity |
US9258234B1 (en) | 2012-12-28 | 2016-02-09 | Juniper Networks, Inc. | Dynamically adjusting liveliness detection intervals for periodic network communications |
US8953460B1 (en) | 2012-12-31 | 2015-02-10 | Juniper Networks, Inc. | Network liveliness detection using session-external communications |
US9880776B1 (en) | 2013-02-22 | 2018-01-30 | Veritas Technologies Llc | Content-driven data protection method for multiple storage devices |
US8977746B2 (en) * | 2013-03-20 | 2015-03-10 | Watchguard Technologies, Inc. | Systems and methods for scalable network monitoring |
US9571511B2 (en) * | 2013-06-14 | 2017-02-14 | Damballa, Inc. | Systems and methods for traffic classification |
US9769017B1 (en) | 2014-09-26 | 2017-09-19 | Juniper Networks, Inc. | Impending control plane disruption indication using forwarding plane liveliness detection protocols |
US9401933B1 (en) | 2015-01-20 | 2016-07-26 | Cisco Technology, Inc. | Classification of security policies across multiple security products |
US9680875B2 (en) * | 2015-01-20 | 2017-06-13 | Cisco Technology, Inc. | Security policy unification across different security products |
US9531757B2 (en) | 2015-01-20 | 2016-12-27 | Cisco Technology, Inc. | Management of security policies across multiple security products |
US9571524B2 (en) | 2015-01-20 | 2017-02-14 | Cisco Technology, Inc. | Creation of security policy templates and security policies based on the templates |
US9521167B2 (en) | 2015-01-20 | 2016-12-13 | Cisco Technology, Inc. | Generalized security policy user interface |
US9609023B2 (en) | 2015-02-10 | 2017-03-28 | International Business Machines Corporation | System and method for software defined deployment of security appliances using policy templates |
US9641540B2 (en) | 2015-05-19 | 2017-05-02 | Cisco Technology, Inc. | User interface driven translation, comparison, unification, and deployment of device neutral network security policies |
CN104917761B (en) * | 2015-05-29 | 2018-01-30 | 西安电子科技大学 | A kind of general access control method and device |
US10374936B2 (en) | 2015-12-30 | 2019-08-06 | Juniper Networks, Inc. | Reducing false alarms when using network keep-alive messages |
US9992232B2 (en) | 2016-01-14 | 2018-06-05 | Cisco Technology, Inc. | Policy block creation with context-sensitive policy line classification |
US10397085B1 (en) | 2016-06-30 | 2019-08-27 | Juniper Networks, Inc. | Offloading heartbeat responses message processing to a kernel of a network device |
US10521590B2 (en) | 2016-09-01 | 2019-12-31 | Microsoft Technology Licensing Llc | Detection dictionary system supporting anomaly detection across multiple operating environments |
US10778722B2 (en) * | 2016-11-08 | 2020-09-15 | Massachusetts Institute Of Technology | Dynamic flow system |
US20180270200A1 (en) * | 2017-03-14 | 2018-09-20 | T-Mobile Usa, Inc. | Active Inventory Discovery for Network Security |
US10659482B2 (en) | 2017-10-25 | 2020-05-19 | Bank Of America Corporation | Robotic process automation resource insulation system |
US10616280B2 (en) * | 2017-10-25 | 2020-04-07 | Bank Of America Corporation | Network security system with cognitive engine for dynamic automation |
US10503627B2 (en) | 2017-10-30 | 2019-12-10 | Bank Of America Corporation | Robotic process automation enabled file dissection for error diagnosis and correction |
US10575231B2 (en) | 2017-11-03 | 2020-02-25 | Bank Of America Corporation | System for connection channel adaption using robotic automation |
US10606687B2 (en) | 2017-12-04 | 2020-03-31 | Bank Of America Corporation | Process automation action repository and assembler |
US11750441B1 (en) | 2018-09-07 | 2023-09-05 | Juniper Networks, Inc. | Propagating node failure errors to TCP sockets |
US11245703B2 (en) | 2019-09-27 | 2022-02-08 | Bank Of America Corporation | Security tool for considering multiple security contexts |
Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4677588A (en) * | 1983-11-14 | 1987-06-30 | International Business Machines Corp. | Network interconnection without integration |
US5377354A (en) * | 1989-08-15 | 1994-12-27 | Digital Equipment Corporation | Method and system for sorting and prioritizing electronic mail messages |
US5577209A (en) * | 1991-07-11 | 1996-11-19 | Itt Corporation | Apparatus and method for providing multi-level security for communication among computers and terminals on a network |
US5848233A (en) * | 1996-12-09 | 1998-12-08 | Sun Microsystems, Inc. | Method and apparatus for dynamic packet filter assignment |
US5968176A (en) * | 1997-05-29 | 1999-10-19 | 3Com Corporation | Multilayer firewall system |
US6167445A (en) * | 1998-10-26 | 2000-12-26 | Cisco Technology, Inc. | Method and apparatus for defining and implementing high-level quality of service policies in computer networks |
US6243747B1 (en) * | 1995-02-24 | 2001-06-05 | Cabletron Systems, Inc. | Method and apparatus for defining and enforcing policies for configuration management in communications networks |
US6449650B1 (en) * | 1999-02-01 | 2002-09-10 | Redback Networks Inc. | Methods and apparatus for deploying quality of service policies on a data communication network |
US6530024B1 (en) * | 1998-11-20 | 2003-03-04 | Centrax Corporation | Adaptive feedback security system and method |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE69601149T2 (en) * | 1995-07-03 | 1999-08-05 | Sun Microsystems Inc | Systems and methods for implementing a hierarchical policy for the administration of a computer system |
US5991877A (en) * | 1997-04-03 | 1999-11-23 | Lockheed Martin Corporation | Object-oriented trusted application framework |
US6446200B1 (en) * | 1999-03-25 | 2002-09-03 | Nortel Networks Limited | Service management |
US6738908B1 (en) * | 1999-05-06 | 2004-05-18 | Watchguard Technologies, Inc. | Generalized network security policy templates for implementing similar network security policies across multiple networks |
-
1999
- 1999-05-06 US US09/306,646 patent/US6738908B1/en not_active Expired - Lifetime
-
2000
- 2000-04-13 AU AU42401/00A patent/AU4240100A/en not_active Abandoned
- 2000-04-13 WO PCT/US2000/009983 patent/WO2000069145A1/en active Application Filing
-
2004
- 2004-04-07 US US10/819,718 patent/US20050022027A1/en not_active Abandoned
-
2007
- 2007-10-17 US US11/873,512 patent/US20080209504A1/en not_active Abandoned
Patent Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4677588A (en) * | 1983-11-14 | 1987-06-30 | International Business Machines Corp. | Network interconnection without integration |
US5377354A (en) * | 1989-08-15 | 1994-12-27 | Digital Equipment Corporation | Method and system for sorting and prioritizing electronic mail messages |
US5577209A (en) * | 1991-07-11 | 1996-11-19 | Itt Corporation | Apparatus and method for providing multi-level security for communication among computers and terminals on a network |
US6243747B1 (en) * | 1995-02-24 | 2001-06-05 | Cabletron Systems, Inc. | Method and apparatus for defining and enforcing policies for configuration management in communications networks |
US5848233A (en) * | 1996-12-09 | 1998-12-08 | Sun Microsystems, Inc. | Method and apparatus for dynamic packet filter assignment |
US5968176A (en) * | 1997-05-29 | 1999-10-19 | 3Com Corporation | Multilayer firewall system |
US6167445A (en) * | 1998-10-26 | 2000-12-26 | Cisco Technology, Inc. | Method and apparatus for defining and implementing high-level quality of service policies in computer networks |
US6530024B1 (en) * | 1998-11-20 | 2003-03-04 | Centrax Corporation | Adaptive feedback security system and method |
US6449650B1 (en) * | 1999-02-01 | 2002-09-10 | Redback Networks Inc. | Methods and apparatus for deploying quality of service policies on a data communication network |
Cited By (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040030915A1 (en) * | 2002-02-21 | 2004-02-12 | Shigetoshi Sameshima | Access restriction control device and method |
US7331059B2 (en) * | 2002-02-21 | 2008-02-12 | Shigetoshi Sameshima | Access restriction control device and method |
US7640168B2 (en) * | 2003-03-06 | 2009-12-29 | Bartlit Jr Fred H | Method and computer program product for enabling customers to adjust the level of service provided by service providers |
US20040230450A1 (en) * | 2003-03-06 | 2004-11-18 | Bartlit Fred H. | System, method, and computer program product for enabling customers to adjust the level of service provided by service providers |
US20050068935A1 (en) * | 2003-09-30 | 2005-03-31 | Nokia Corporation | Method of communication |
US7843948B2 (en) * | 2003-09-30 | 2010-11-30 | Nokia Corporation | Method of communication |
US20060072456A1 (en) * | 2004-09-30 | 2006-04-06 | Cisco Technology, Inc. | Method and apparatus for device based policy configuration in a network |
US8595347B2 (en) * | 2004-09-30 | 2013-11-26 | Cisco Technology, Inc. | Method and apparatus for device based policy configuration in a network |
US20080098455A1 (en) * | 2006-10-20 | 2008-04-24 | Canon Kabushiki Kaisha | Document management system and document management method |
US8561128B2 (en) * | 2006-10-20 | 2013-10-15 | Canon Kabushiki Kaisha | Document management system and document management method |
US20160188877A1 (en) * | 2013-08-14 | 2016-06-30 | Ajeya Hindupur Simha | Automating Monitoring Of A Computing Resource In A Cloud-Based Data Center |
US10095863B2 (en) * | 2013-08-14 | 2018-10-09 | Hewlett Packard Enterprise Development Lp | Automating monitoring of a computing resource in a cloud-based data center |
US11212322B2 (en) * | 2018-10-10 | 2021-12-28 | Rockwelll Automation Technologies, Inc. | Automated discovery of security policy from design data |
US20220321568A1 (en) * | 2021-04-01 | 2022-10-06 | Hewlett Packard Enterprise Development Lp | Systems and methods for generating and implementing security profiles |
Also Published As
Publication number | Publication date |
---|---|
US6738908B1 (en) | 2004-05-18 |
AU4240100A (en) | 2000-11-21 |
US20080209504A1 (en) | 2008-08-28 |
WO2000069145A1 (en) | 2000-11-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6738908B1 (en) | Generalized network security policy templates for implementing similar network security policies across multiple networks | |
US9800571B2 (en) | Web based extranet architecture providing applications to non-related subscribers | |
US20020158899A1 (en) | Portal system and method for managing resources in a networked computing environment | |
US7747954B2 (en) | Method and system for virtual private network connectivity verification | |
US7150037B2 (en) | Network configuration manager | |
US6859783B2 (en) | Integrated interface for web based customer care and trouble management | |
US7539769B2 (en) | Automated deployment and management of network devices | |
RU2595517C2 (en) | Objects of virtual network interface | |
US8141144B2 (en) | Security policy management for network devices | |
US6763376B1 (en) | Integrated customer interface system for communications network management | |
US7159125B2 (en) | Policy engine for modular generation of policy for a flat, per-device database | |
US8312127B2 (en) | Discovering, defining, and implementing computer application topologies | |
US6484261B1 (en) | Graphical network security policy management | |
US7624422B2 (en) | System and method for security information normalization | |
US20230385269A1 (en) | General, flexible, resilient ticketing interface between a device management system and ticketing systems | |
WO1999015975A1 (en) | Integrated interface for web based customer care and trouble management | |
US7500196B2 (en) | Method and system for generating route distinguishers and targets for a virtual private network | |
US20200213262A1 (en) | System and method for automating actions in distributed computing | |
US20020161876A1 (en) | System and method for managing data miner modules in an information network system | |
US7181490B1 (en) | Method and apparatus for mapping network events to names of network devices | |
US8639801B2 (en) | Real-time automated virtual private network (VPN) access management | |
JP2001216267A (en) | Information provision control system, information provision control method, and recording medium therefor | |
US20080059887A1 (en) | System, method and computer program product for locating a subset of computers on a network | |
Kim et al. | A Web-Based Monitoring System of Network Security Functions in Blockchain-Based Cloud Security Systems | |
Edholm | Electronic messaging |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: SILICON VALLEY BANK, CALIFORNIA Free format text: SECURITY AGREEMENT;ASSIGNORS:WATCHGUARD TECHNOLOGIES, INC.;GLADIATOR CORPORATION;REEL/FRAME:023098/0771 Effective date: 20090730 Owner name: SILICON VALLEY BANK,CALIFORNIA Free format text: SECURITY AGREEMENT;ASSIGNORS:WATCHGUARD TECHNOLOGIES, INC.;GLADIATOR CORPORATION;REEL/FRAME:023098/0771 Effective date: 20090730 |
|
AS | Assignment |
Owner name: GLADIATOR CORPORATION, WASHINGTON Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:SILICON VALLEY BANK;REEL/FRAME:028477/0268 Effective date: 20120628 Owner name: WATCHGUARD TECHNOLOGIES, INC., WASHINGTON Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:SILICON VALLEY BANK;REEL/FRAME:028477/0268 Effective date: 20120628 |