Granted Patent B2

US 7,853,687 · App. 11/713,732 · Granted Dec 14, 2010

Assignee: Alcatel Lucent

Abstract

Claims (41)

1. An access control list generation and validation system that protects network computers of a communication network, the system comprising:

a memory and a processor that executes security functions;

a tables generation unit stored in the memory that creates a flows table, a roles definition table and an enforcement points table;

a tables management unit stored in the memory that creates an interaction table from said flows table, said roles definition table, and network configuration information while validating data contained in said flows table, said roles definition table and said enforcement points table and validating accuracy of the interaction table against the network configuration information before deployment of access control lists;

an access control rules generation unit stored in the memory that generates generic access control rules for each enforcement point listed in said enforcement points table using said interaction table and said enforcement points table; and

a rules translation and deployment unit stored in the memory that translates said generic access control rules into a format specific to each respective enforcement point and deploys access control rules having said specific format to said respective enforcement points.

2. The system of claim 1 , further comprising:

a memory unit that stores said flows table, said roles definition table, said enforcement points table, and said interaction table.

3. The system of claim 1 , further comprising:

an errors reporting unit stored in the memory that reports errors detected in said flows table, said enforcement points table, and said interaction table.

4. The system of claim 1 , wherein said flows table comprises a list of all documented flows within said communication network, each flow being defined by a protocol used for communication between two roles.

5. The system of claim 1 , further comprising:

a flow data collector stored in the memory of each network computer that operates in an access control rules generation mode, collecting real-time flow data obtained for all flows established in said communication network and a flow monitoring mode, collecting discarded flows data for flows discarded by said network computers.

6. The system of claim 5 , further comprising:

a flow analysis block stored in the memory that analyzes said flow data, and identifies access control violations; and

an ACL violations reporting block stored in the memory that generates an AC rules violations list providing particulars of said access control violations.

7. The system of claim 5 , further comprising:

a flows table validation unit stored in the memory that compares real-time flow data with documented flow data stored in said flows table and identifies data errors in said flows table.

8. The system of claim 1 , further comprising:

a graphical user interface that enables input of documented flow data, roles data and enforcement point data respectively into said flows table, said roles definition table, and said enforcement points table, and displays errors detected in said flows table, said enforcement points table, and said interaction table.

9. A method, in an access control list (ACL) system, for generating and validating ACLs that protect network computers of a communication network, the method comprising:

using the ACL system to logically divide said communication network into subnets, a subnet including the network computers communicating with each other without any enforcement between them;

in each said subnet, using the ACL system to group the network computers into zones, the network computers in each zone being characterized by a common role and a common enforcement point, and each enforcement point enforcing specific access control rules on traffic to and from said zone;

using the ACL system to identify all flows within said communication network, each flow being defined by a protocol used between two different roles;

using the ACL system to generate a flows table, a roles definition table, and an enforcement points table;

using the ACL system to create an interaction table from said flows table, said roles definition table, and network configuration information while validating data contained in said flows table, said roles definition table, and said enforcement points table;

using the ACL system to generate generic access control rules for each enforcement point in said enforcement points table using said interaction table and said enforcement points table;

using the ACL system to validate accuracy of said flows table, said roles definition table, and said enforcement points table based on network configuration information; and

using the ACL system to validate accuracy of the interaction table against the network configuration information before deployment of the ACLs.

10. The method of claim 9 , wherein said roles definition table comprises a list of all roles that each network computer can assume during operation, each role being determined by operation types performed by said network computer.

11. The method of claim 9 , wherein said flows table comprises a list of all documented flows within said communication network, each flow being defined by a protocol used for communication between two roles.

12. The method of claim 9 , wherein said enforcement points table comprises a list of all documented flows at each enforcement point of said communication network and all paths between said zones.

13. The method of claim 9 , further comprising:

translating said generic access control rules into said specific access control rules and deploying said specific access control rules to respective enforcement points.

14. The method of claim 13 , further comprising:

monitoring flows discarded at each said enforcement point and generating a list with all ACL violations for identifying all flows that violate said specific access control rules.

15. The method of claim 14 , wherein said list includes tier violations, which report flows between subnets that should not communicate at all with each other; and port violations, which report flows between subnets that are authorized to communicate, but use a wrong protocol, a wrong port or another inconsistency with flows documented in the flows table.

16. The method of claim 9 , wherein said step of validating accuracy comprises:

collecting real-time flow data for all flows established in said communication network;

comparing said real-time flow data with documented flow data stored in said flows table for identifying errors in said flows table; and

correcting said documented flow data in said flows table.

Assignments (8)

Continuity (1)