Enterprise security management tool

Patent metadata

Field	Value
Publication number	US-10880332-B2
Application number	US-201715494852-A
Country	US
Kind code	B2
Filing date	Apr 24, 2017
Priority date	Apr 24, 2017
Publication date	Dec 29, 2020
Grant date	Dec 29, 2020

Abstract

Methods and systems for configuring security management settings within an enterprise network are disclosed. One method includes receiving network concordance data at an enterprise security management configuration tool from a plurality of nodes within an enterprise network, and, based on the network concordance data, classifying each of the plurality of nodes based on an affinitization between the two or more nodes. The method also includes defining a profile for one or more nodes or grouped nodes, and defining one or more solutions within the enterprise security management configuration tool, the one or more solutions each including one or more nodes of the plurality of nodes. The method also includes receiving a deployment selection identifying at least one of the one or more solutions, and, in response to the deployment selection, generating a security settings file describing security settings for each of the one or more nodes.

First claim

The invention claimed is:

1. A method of configuring security management settings within an enterprise network, the method comprising:
receiving network concordance data at an enterprise security management configuration tool from a plurality of nodes within an enterprise network, the network concordance data including network traffic data regarding identities and interactions of the plurality of nodes;
based on the network concordance data, classifying, by the enterprise security management configuration tool, each of the plurality of nodes, wherein classifying each of the plurality of nodes includes grouping at least some of the plurality of nodes into profiles based on an affinitization among the plurality of nodes determined from the network concordance data, each of the profiles including a group of nodes and describing common security settings for operation and interactivity within the enterprise network for the group of nodes;
defining one or more solutions within the enterprise security management configuration tool, the one or more solutions including a plurality of profiles;
receiving a deployment selection identifying at least one of the one or more solutions; and
in response to the deployment selection, generating a security settings file describing security settings for operation and interactivity of each of the one or more nodes included in the identified one or more solutions,
wherein the security settings file is configured for import by an enterprise management server to populate an enterprise management database, the security settings file conforming to an application programming interface exposed by the enterprise management server.

2. The method of claim 1 , wherein at least one solution includes a plurality of grouped nodes based on an affinitization determined from the network concordance data, and wherein generating the security settings file includes defining common security settings for each node within the plurality of grouped nodes.

3. The method of claim 1 , wherein classifying each of the plurality of nodes includes grouping two or more of the plurality of nodes based on the two or more of the plurality of nodes having an affinitization above a predetermined affinitization level.

4. The method of claim 1 , further comprising capturing, from each of the plurality of nodes, the network concordance data, wherein the network concordance data is derived from network traffic captured at each of the plurality of nodes.

5. The method of claim 4 , further comprising installing at one or more of the plurality of nodes a network traffic monitoring agent configured to collect network concordance data.

6. The method of claim 1 , wherein classifying each of the plurality of nodes comprises forming a plurality of groups.

7. The method of claim 6 , further comprising defining a different profile for each of the plurality of groups.

8. The method of claim 1 , wherein defining one or more solutions includes logically associating two or more profiles within a solution.

9. The method of claim 1 , further comprising importing the security settings file into an enterprise management database defining an enterprise security topology.

10. A system comprising:
an enterprise security management configuration server comprising:
a programmable circuit;
a memory storing computer-executable instructions that, when executed by the programmable circuit, cause the enterprise security management configuration server to:
receive network concordance data at an enterprise security management configuration tool, the network concordance data including network traffic data regarding identities and interactions of a plurality of nodes;
based on the network concordance data, classify, by the enterprise security management configuration tool, each of the plurality of nodes, wherein classifying each of the plurality of nodes includes grouping at least some of the plurality of nodes into profiles based on an affinitization among the plurality of nodes determined from the network concordance data, each of the profiles including a group of nodes and describing common security settings for operation and interactivity within the enterprise network for the group of nodes;
define one or more solutions within the enterprise security management configuration tool, the one or more solutions including a plurality of profiles;
receive a deployment selection identifying at least one of the one or more solutions; and
in response to the deployment selection, generate a security settings file describing security settings for operation and interactivity of each of the one or more nodes included in the identified one or more solutions;
wherein the security settings file is configured for import by an enterprise management server to populate an enterprise management database, the security settings file conforming to an application programming interface exposed by the enterprise management server.

11. The system of claim 10 , further comprising the enterprise management server, wherein the enterprise management server is communicatively connected to the enterprise security management configuration server, the enterprise management server including the enterprise management database storing security settings for nodes within the enterprise network.

12. The system of claim 11 , further comprising a plurality of nodes communicatively connected to the enterprise network including the enterprise security management configuration server and the enterprise management server.

13. The system of claim 10 , further comprising a plurality of monitoring agents installable at nodes within the enterprise network, the plurality of monitoring agents configured to capture network traffic data originating from or addressed to nodes within the enterprise network.

14. The system of claim 13 , wherein the network traffic data is included in the network concordance data received at the enterprise security management configuration tool.

15. The system of claim 10 , wherein the enterprise security management configuration server is integrated with the enterprise management server.

16. The system of claim 10 , wherein the enterprise security management configuration server includes a display, and wherein the enterprise security management configuration server is configured to generate a configuration user interface including one or more predefined solutions.

17. The system of claim 16 , wherein the configuration user interface includes a plurality of predefined solutions, the predefined solutions including an intranet solution, an internet solution, an infrastructure solution, and an enterprise management solution.

18. The system of claim 10 , wherein the enterprise security management configuration server is configured to create a project in which to create the security settings file.

19. A non-transitory computer-readable storage device having computer-executable instructions stored thereon which, when executed by a computing system, cause the computing system to perform:
creating a project in a user interface of an enterprise security management configuration tool;
receiving network concordance data at the enterprise security management configuration tool from a plurality of nodes within an enterprise network, the network concordance data including network traffic data regarding identities and interactions of the plurality of nodes;
based on the network concordance data, classifying, by the enterprise security management configuration tool, each of the plurality of nodes, wherein clas

Assignees

• Johnson Robert A
• Didomenico Michael J
• Jolly Philippe
• Leap Michael C
• Phelps Richard W
• Unisys Corp

Inventors

• Johnson Robert A
• Didomenico Michael J
• Jolly Philippe
• Leap Michael C
• Phelps Richard W

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/104

  Grouping of entities · CPC title