Granted Patent B2

US 9,088,617 · App. 14/084,736 · Granted Jul 21, 2015

Abstract

Claims (35)

1. A method for evaluating a deployment of a network access change request, the method comprises the following computer implemented steps:

formatting a network access change request to provide a formatted network access change request; wherein the formatted network access change request comprises multiple formatted request items; wherein the multiple formatted request items comprise a requested access type, an address of an access source, an address of an access destination;

determining multiple relationships between the multiple formatted request items and corresponding items of at least one entity out of a network model and a current network policy;

responding to the network access change request in response to the multiple determined relationships;

receiving an amended network access change request if a requested connectivity that is a subject of the network access change request is not in compliance with the current network policy;

determining multiple relationships between multiple items of the amended network access change request and corresponding items of at least one entity out of a network model and a current network policy; and

responding to the amended network access change request in response to the multiple determined relationships.

2. The method according to claim 1 comprising determining whether a requested connectivity that is a subject of the network access change request is currently implemented in the network; and determining whether the requested connectivity is in compliance with the current network policy.

3. The method according to claim 1 comprising evaluating a risk associated with a deployment of the network access change request.

4. The method according to claim 1 comprising converting a formatted network access change request to at least one firewall access change request.

5. The method according to claim 1 comprising evaluating compliance of the change request with the current network policy.

6. A method for evaluating a deployment of a network access change request, the method comprises the following computer implemented steps: formatting a network access change request to provide a formatted network access change request; wherein the formatted network access change request comprises multiple formatted request items; wherein the multiple formatted request items comprise a requested access type, an address of an access source, an address of an access destination; determining multiple relationships between the multiple formatted request items and corresponding items of at least one entity out of a network model and a current network policy;

converting a formatted network access change request to at least one firewall access change request;

formatting a firewall access change request to provide a formatted firewall access change request; wherein the formatted firewall access change request comprises multiple formatted request items; wherein the multiple formatted request items comprise a firewall identifier, requested access type, an address of an access source, an address of an access destination;

determining multiple relationships between the multiple formatted request items and corresponding items of at least one entity out of a firewall model and a current firewall policy; and

responding to the firewall access change request in response to the multiple determined relationships.

7. The method according to claim 6 comprising: receiving an amended network access change request if a requested connectivity that is a subject of the network access change request is not in compliance with the current network policy; determining multiple relationships between multiple items of the amended network access change request and corresponding items of at least one entity out of a network model and a current network policy; and responding to the amended network access change request in response to the multiple determined relationships.

8. A method for evaluating a deployment of a firewall access change request, the method comprises the following computer implemented steps:

formatting a firewall access change request to provide a formatted firewall access change request; wherein the formatted firewall access change request comprises multiple formatted request items; wherein the multiple formatted request items comprise a firewall identifier, requested access type, an address of an access source, a requested access destination;

defining implementation details that facilitate a connectivity that is a subject of the firewall access change request; checking the implementation details; and

checking whether a packet sent from a requested access source can reach from a requested access source to a requested access destination and checking whether a requested access type can be supported by a firewall identified by the firewall identifier.

9. The method according to claim 8 comprising evaluating a risk associated with a deployment of the firewall access change request.

10. The method according to claim 8 comprising representing a firewall access change request by at least one rule selected from an allow rule and an a deny rule and evaluating the at least one rule.

11. The method according to claim 8 comprising checking for overlaps between a firewall rule generated in response to the firewall access change request and between currently defined firewall rules.

12. The method according to claim 8 comprising checking a consistency between the formatted firewall access change request and the implementation details.

13. The method according to claim 8 comprising checking whether implementation details that are associated with a certain formatted firewall access change request support precisely a connectivity that is a subject of the certain formatted firewall access change request.

14. The method according to claim 8 comprising checking a compliance of the implementation details with at least one entity out of a firewall access policy and a network access policy.

15. The method according to claim 8 comprising checking a compliance of a connectivity change that is a subject of the firewall access change request with at least one policy out of a network access policy and a firewall access policy.

16. The method according to claim 8 comprising comparing between the requested access type, the address of an access source, and the requested access destination of the firewall access change request and a supported access type, address of an access source, and an access destination of a policy access rule of the firewall access policy.

17. A method for evaluating a deployment of a firewall access change request, the method comprises the following computer implemented steps:

formatting a firewall access change request to provide a formatted firewall access change request; wherein the formatted firewall access change request comprises multiple formatted request items; wherein the multiple formatted request items comprise a firewall identifier, requested access type, an address of an access source, a requested access destination;

defining implementation details that facilitate a connectivity that is a subject of the firewall access change request; checking the implementation details;

checking whether a packet sent from a source address of a network access policy rule can reach from the source address of the network access policy rule to a destination address of the network access policy rule;

and checking whether the packet was allowed or denied by a firewall identified by the firewall identifier, and by considering the access type of the network access policy rule.

18. The method according to claim 17 comprising checking whether a packet sent from a requested access source can reach from a requested access source to a requested access destination and checking whether a requested access type can be supported by a firewall identified by the firewall identifier.

Assignments (10)