Externally defined objects in security policy

Patent metadata

Field	Value
Publication number	US-9602539-B1
Application number	US-201213631792-A
Country	US
Kind code	B1
Filing date	Sep 28, 2012
Priority date	Sep 28, 2012
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

Using one or more externally defined objects to at least in part define a security policy is disclosed. In some embodiments, an external object list is obtained from an external list server, and a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the external object list and based at least in part on one or more locally defined objects is defined. The security policy is enforced with respect to one or more devices and periodically updated as the external object list is updated.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
obtain a plurality of external object lists from a plurality of external list servers that publish the plurality of external object lists, wherein:
at least one external object list of the plurality of external list servers includes a virtual system;
the at least one external object list includes zones; and
the obtaining of the plurality of external object lists from the plurality of external list servers comprises to:
periodically obtain, at a first frequency, a first external object list from a first external list server; and
periodically obtain, at a second frequency, a second external object list from a second external list server, the first frequency being different from the second frequency; and

for one of the plurality of external object lists:
define a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the one external object list and based at least in part on one or more locally defined objects, wherein a rule of the one or more rules includes a source zone and a destination zone;
enforce the security policy with respect to a device;
automatically check a corresponding external list server for updates of the one external object list and update or refresh locally stored external objects obtained from the one external object list to reflect changes in the one external object list published by the corresponding external list server, wherein any changes in locally stored external objects automatically and dynamically update the security policy as applicable, wherein the updating of the security policy is performed without administrative intervention, and wherein the updating or refreshing of the locally stored external objects obtained from the one external object list comprises to:
determine whether the updates of the one external object list remove an external object from a previous external object list; and
in the event that the updates of the one external object list remove the external object from the previous external object list, remove the external object from the locally stored external objects to obtain updated or refreshed locally stored external objects; and

receive an update to the at least one external object list as a push from the corresponding external list server; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the one external object list comprises a block list or an access list.

3. The system of claim 1 , wherein the one external object list comprises one or more address objects.

4. The system of claim 1 , wherein the one external object list includes an address object expressed as a domain name or an IP (Internet Protocol) address.

5. The system of claim 1 , wherein the one external object list includes an address object expressed as a Fully Qualified Domain Name (FQDN).

6. The system of claim 1 , wherein the one external object list includes an address object expressed as an IPv4 (Internet Protocol version 4) address or an IPv6 (Internet Protocol version 6) address.

7. The system of claim 1 , wherein the one external object list comprises one or more URLs (Uniform Resource Locators).

8. The system of claim 1 , wherein the one external object list comprises one or more URL (Uniform Resource Locator) categories.

9. The system of claim 1 , wherein the corresponding external list server is accessible via an external network that is separate from a protected internal network of which the system is a part.

10. The system of claim 1 , wherein to automatically check and update comprises to periodically check and update.

11. The system of claim 1 , wherein the processor is further configured to translate an address object comprising the one external object list.

12. The system of claim 1 , wherein the system comprises a firewall.

13. The system of claim 1 , wherein the system comprises a security appliance.

14. A method, comprising:
obtaining at a security appliance associated with a private network a plurality of external object lists from a plurality of external list servers that publish the plurality of external object lists, wherein:
at least one external object list of the plurality of external list servers includes a virtual system;
the at least one external object list includes zones; and
the obtaining of the plurality of external object lists from the plurality of external list servers comprises:
periodically obtaining, at a first frequency, a first external object list from a first external list server; and
periodically obtaining, at a second frequency, a second external object list from a second external list server, the first frequency being different from the second frequency; and

for one of the plurality of external object lists:
defining at the security appliance a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the one external object list and based at least in part on one or more locally defined objects, wherein a rule of the one or more rules includes a source zone and a destination zone;
using the security appliance to enforce the security policy with respect to a device on the private network;
configuring the security appliance to automatically check a corresponding external list server for updates of the one external object list and update or refresh locally stored external objects obtained from the one external object list to reflect changes in the one external object list published by the corresponding external list server, wherein any changes in locally stored external objects automatically and dynamically update the security policy as applicable, wherein the updating of the security policy is performed without administrative intervention, and wherein the updating or refreshing of the locally stored external objects obtained from the one external object list comprising:
determining whether the updates of the one external object list remove an external object from a previous external object list; and
in the event that the updates of the one external object list remove the external object from the previous external object list, removing the external object from the locally stored external objects to obtain updated or refreshed locally stored external objects; and

receiving an update to the at least one external object list as a push from the corresponding external list server.

15. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
obtaining a plurality of external object lists from a plurality of external list servers that publish the plurality of external object lists, wherein:
at least one external object list of the plurality of external list servers includes a virtual system;
the at least one external object list includes zones; and
the obtaining of the plurality of external object lists from the plurality of external list servers comprises:
periodically obtaining, at a first frequency, a first external object list from a first external list server; and
periodically obtaining, at a second frequency, a second external object list from a second external list server, the first frequency being different from the second frequency; and

for one of the plurality of external object lists:
defining a security policy comprising one or more rules based at least in part on one or more externally defined objects comprising the one

Assignees

• Palo Alto Networks Inc

Inventors

• Bharali Anupam

Classifications

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/102

  Entity profiles · CPC title