Solution definition for enterprise security management

Patent metadata

Field	Value
Publication number	US-10979455-B2
Application number	US-201715494907-A
Country	US
Kind code	B2
Filing date	Apr 24, 2017
Priority date	Apr 24, 2017
Publication date	Apr 13, 2021
Grant date	Apr 13, 2021

Abstract

Methods and systems for defining a solution within an enterprise security management configuration server is disclosed. One method includes, based on network concordance data, grouping a plurality of nodes within an enterprise network into a plurality of profiles and identifying one or more channels among the plurality of profiles within a project of an enterprise security management configuration tool. The method also includes displaying the plurality of profiles in a configuration user interface, and automatically identifying one or more solutions among the plurality of profiles. The method further includes collapsing each of the one or more solutions into a single icon within the configuration user interface, each single icon representing a solution.

First claim

The invention claimed is:

1. A method of defining a solution within an enterprise security management configuration server, the method comprising:
based on network concordance data including network traffic data, grouping a plurality of nodes within an enterprise network into a plurality of profiles and identifying one or more communication channels among the plurality of profiles within a project of an enterprise security management configuration tool;
displaying the plurality of profiles in a configuration user interface;
automatically identifying, by the enterprise security management configuration tool, one or more solutions among the plurality of profiles, wherein automatically identifying the one or more solutions includes:
automatically identifying, by the enterprise security management configuration tool, a root profile among the plurality of profiles network; and
creating a chain of one or more secondary profiles that are chained to the root profile as consumers of services, the one or more secondary profiles including at least a first secondary profile linked by a communication channel of the one or more communication channels to the root profile, the one or more secondary profiles corresponding to different types of nodes as compared to the root profile, the chain terminating prior to a communication channel extending between a secondary profile and an end user profile; and

collapsing each of the one or more solutions into a single icon within the configuration user interface, each single icon representing a solution.

2. The method of claim 1 , wherein automatically identifying the one or more solutions excludes, by default, end user profiles from the one or more solutions.

3. The method of claim 1 , wherein the root profile is prioritized to be a profile of a database server within the enterprise.

4. The method of claim 3 , wherein the first secondary profile is chained to the root profile as being a consumer of a service provided by the database server.

5. The method of claim 4 , wherein the first secondary profile is one of a web server or an application server.

6. The method of claim 1 , wherein the one or more secondary profiles includes one or more of a web server, an application server, a load balancer, and a database server.

7. The method of claim 1 , wherein each single icon within the configuration user interface is expandable in response to user selection to display each of the profiles included in the chain that is included within that solution.

8. The method of claim 1 , further comprising applying a common security setting to each of the profiles included within a solution.

9. The method of claim 1 , further comprising receiving a manual selection of a profile as a root of a solution.

10. The method of claim 9 , further comprising receiving a manual selection of a second profile connected to the profile by a communication channel as a member of the solution.

11. The method of claim 1 , wherein automatically identifying the one or more solutions is performed in response to selection of a solution tool in a palette displayed in the configuration user interface.

12. The method of claim 1 , further comprising receiving the network concordance data within the project.

13. The method of claim 12 , wherein the network concordance data represents network traffic associated with each of the plurality of nodes within the enterprise network.

14. A system comprising:
an enterprise security management configuration server;
a programmable circuit;
a memory storing computer-executable instructions that, when executed by the programmable circuit, cause the enterprise security management configuration server to:

based on network concordance data including network traffic data received at the enterprise security management configuration server, group a plurality of nodes within an enterprise network into a plurality of profiles and identifying one or more communication channels among the plurality of profiles within a project of an enterprise security management configuration tool;
display the plurality of profiles in a configuration user interface;
automatically identify one or more solutions among the plurality of profiles by:
automatically identifying a root profile among the plurality of profiles; and
creating a chain of one or more secondary profiles that are chained to the root profile as consumers of services, the one or more secondary profiles including at least a first secondary profile linked by a communication channel of the one or more communication channels to the root profile, the one or more secondary profiles corresponding to different types of nodes as compared to the root profile, the chain terminating prior to a communication channel extending between a secondary profile and an end user profile; and

collapse each of the one or more solutions into a single icon within the configuration user interface, each single icon representing a solution.

15. The system of claim 14 , wherein the root profile is prioritized to be a profile of a database server within the enterprise as being a root profile.

16. The system of claim 15 , wherein, if no database server exists within the enterprise that is not already assigned to a solution, automatically identifying a root profile includes prioritizing an application server within the enterprise as being a root profile.

17. The system of claim 16 , wherein, if no database server and no application server exists within the enterprise that is not already assigned to a solution, automatically identifying a root profile includes prioritizing a web server within the enterprise as being a root profile.

18. The system of claim 14 , further comprising an enterprise security management server communicatively connected to the enterprise security management configuration server.

19. The system of claim 14 , further comprising a plurality of nodes within the enterprise network.

20. A non-transitory computer-readable medium comprising computer-executable instructions stored thereon which, when executed by a programmable circuit of a computing system, cause the computing system to perform:
based on network concordance data including network traffic data, grouping a plurality of nodes within an enterprise network into a plurality of profiles and identifying one or more communication channels among the plurality of profiles within a project of an enterprise security management configuration tool;
displaying the plurality of profiles in a configuration user interface;
automatically identifying, by the enterprise security management configuration tool, one or more solutions among the plurality of profiles, wherein automatically identifying the one or more solutions includes:
automatically identifying, by the enterprise security management configuration tool, a root profile among the plurality of profiles network; and
creating a chain of one or more secondary profiles that are chained to the root profile as consumers of services, the one or more secondary profiles including at least a first secondary profile linked by a communication channel of the one or more communication channels to the root profile, the one or more secondary profiles corresponding to different types of nodes as compared to the root profile, the chain terminating prior to a communication channel extending between a secondary profile and an end user profile; and

collapsing each of the one or more solutions into a single icon within the configuration user interface, each single icon representi

Assignees

• Johnson Robert A
• Didomenico Michael J
• Jolly Philippe
• Leap Michael C
• Phelps Richard W
• Unisys Corp

Inventors

• Johnson Robert A
• Didomenico Michael J
• Jolly Philippe
• Leap Michael C
• Phelps Richard W

Classifications

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L41/28

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title