Methods and systems for managing security policies

Patent metadata

Field	Value
Publication number	US-10110632-B2
Application number	US-40497803-A
Country	US
Kind code	B2
Filing date	Mar 31, 2003
Priority date	Mar 31, 2003
Publication date	Oct 23, 2018
Grant date	Oct 23, 2018

Abstract

Methods, machines, and systems manage security policies of heterogeneous infrastructure and computing devices of a network. Security policy repository houses security policies that are pushed over the network by a policy decision point PDP to appropriate security-enabled devices (policy enforcement points (PEPs)) for enforcement. Using a closed feedback loop, a policy feedback point (PFP) collects and processes data from intrusions, alerts, violations, and other abnormal behaviors from a variety of PEPs or logs produced from PEPs. This data is sent as feedback to the policy repository. The PDP detects the data and analyzes it to determine if policy updates (which can be dynamic and automatic) need to be adaptively made and dynamically pushed to PEPs. The PDP can also send console messages or alerts to consoles or administrators.

First claim

What is claimed is:

1. A method comprising:
dynamically detecting, on a first security device, security information obtained from a second security-enabled device over a network connection between the first security device and the second security-enabled device, wherein the security information is related to activity occurring on the second security-enabled device detected by a security mechanism of the second security-enabled device and produced in a first data format specific to the security mechanism that is already processing on the second security-enabled device;
normalizing the security information from the first data format into an intermediate data format before being processed by the first security device;
recording the normalized security information in a data repository; and
dynamically pushing from the first security device a security policy in response to the normalized security information to the second security-enabled device over the network in the first data format for enforcement on the second security-enabled device, and wherein enforcement occurs on the second security-enabled device, and wherein the security policy is an executable script and the security-enabled device automatically and dynamically executes the executable script to provide adaptive and dynamic security policy detection and enforcement.

2. The method of claim 1 further comprising triggering a security policy change associated with a security policy based on at least a portion of the recorded normalized security information.

3. The method of claim 1 further comprising evaluating the security policy based on at least a portion of the recorded normalized security information.

4. The method of claim 1 wherein in detecting, the security information is detected using at least one of a security transaction protocol and a security transaction command line interface.

5. The method of claim 1 wherein in detecting, the security information is associated with at least one of security intrusions, security alerts, security violations, and abnormal behaviors occurring on the second security-enabled device.

6. The method of claim 1 wherein in recording, the normalized security information provides dynamic policy feedback to one or more security policies.

7. A method, comprising:
dynamically and centrally distributing security policies from a policy repository on a first device to one or more security-enabled devices, wherein the policy is distributed as a file or parameters and in specific recognized formats by existing security mechanisms processing on the one or more security enabled devices;
dynamically enforcing a number of the security policies on one or more of the security-enabled devices;
dynamically tracking security transactions on each of the one or more security-enabled devices, wherein each of the one or more security-enabled devices use its own security mechanism to record its security transactions in its own specific data format and normalizing security information associated with the security transactions before processing the security transactions;
updating the policy repository on the first device based on the tracked security transactions; and
dynamically pushing a dynamically created or dynamically altered security policy to one or more of the security-enabled device from the first device in response to the updated policy repository in the specific formats recognized by the one or more security-enabled devices, the altered security policy is a script and each of the one or more security-enabled devices automatically and dynamically execute the script to provide adaptive and dynamic security policy enforcement.

8. The method of claim 7 wherein in distributing, the policy repository is at least one of a data warehouse, a database, and an electronic file.

9. The method of claim 7 wherein in distributing, the one or more security-enabled devices include at least one of a firewall, a router, a switch, a network bridge, a gateway, a network hub, a client, a peripheral device, a security resource, an intrusion detection system, and a server.

10. The method of claim 7 wherein in tracking, one or more automated applications detect when a security violation occurs on one or more of the security-enabled devices and traps security information for the security violation.

11. The method of claim 7 wherein in updating, the recorded security transactions are translated into a normalized data format before being updated to the policy repository.

12. A system, comprising:
a policy repository having one or more security policies for a network and administered from a first device over a network;
a security-enabled device to enforce one or more of the security policies dynamically provided from the policy repository via the first device, the security policies are scripts and the security-enabled device automatically and dynamically is to execute the scripts to provide adaptive and dynamic security policy enforcement, wherein the security enabled device is externally accessed over the network from the first device, and wherein the security-enabled device uses its own security mechanism to monitor and capture information about security transactions occurring on the security-enabled device and has its own specific data format for monitoring and capturing the information and wherein the security policies are supplied in that specific data format to the security mechanism;
a feedback application to dynamically monitor security transactions on the security-enabled device and to dynamically update the policy repository on the first device with security information based on the security transactions, and wherein security information associated with the security transactions are normalized into a normalized data format before the feedback application processes the security transactions.

13. The system of claim 12 further comprising one or more policy decision point translators to push the one or more security policies from the policy repository to the security-enabled device for enforcement.

14. The system of claim 13 wherein the one or more policy decision point translators retrieve the one or more security policies from the policy repository in an intermediate data format and use translator applications to translate the one or more security policies to a desired data format used by the security-enabled device for enforcement.

15. The system of claim 12 wherein the policy repository is a collection of data stores logically assembled as the policy repository based on a specific schema.

16. The system of claim 15 wherein a number of the data stores are remote from other ones of the data stores.

17. The system of claim 12 wherein feedback application utilizes security protocols of the security-enabled device to monitor security events on the network.

18. The system of claim 12 wherein the feedback application normalizes the security information into a data format used by the policy repository before updating the policy repository with the security information.

19. A non-transitory machine-readable medium having executable instructions that when executed by a machine, perform a method to:
dynamically push security policies from a policy repository on a first device to one or more security-enabled devices over a network in data formats specifically recognized and used by the one or more security-enabled devices, the policy is a script and each of the one or more security-enabled devices is to automatically and dynamically execute the script to provide adaptive and dy

Assignees

• Li Hong C
• Sahita Ravi
• Yadav Satyendra
• Intel Corp

Inventors

• Li Hong C
• Sahita Ravi
• Yadav Satyendra

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/08

  Configuration management of networks or network elements (address allocation H04L61/50) · CPC title

• H04L41/0856

  by backing up or archiving configuration information · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L41/085

  Retrieval of network configuration; Tracking network configuration history · CPC title