Simplifying the selection of network paths for implementing and managing security policies on a network

A plurality of logical nodes are identified from a plurality of elements on a network, where the plurality of elements include security devices. One or more path entries may be determined for at least some of the logical nodes. Each path entry is associated with one of the logical nodes and specifies a set of communication packets, as well as a next node to receive the communication packets from the associated node. The path entries are used to characterize at least a substantial portion of a network path that is to carry communication packets in the set of communication packets.

FIELD OF THE INVENTION

The present invention generally relates to managing security policies on a network. The invention relates more specifically to simplifying the selection of network paths for implementing and managing security policies on a network.

BACKGROUND OF THE INVENTION

Policy-based network security management is implemented on networks through use of management software, such as CiscoSecure Policy Manager (CSPM) from Cisco Systems Inc. Typically, an administrator enters, into the management software, information that identifies a list of security policies, topology information, and other parameters that may be pertinent for managing security policies. The management software uses the information to determine possible network paths on which security policies are to be implemented. The management software then enforces the security policies on the identified paths.

In some networks, such as interconnected Local Area Networks (LANs), the network paths that are determined by the software management are numerous, often numbering in tens. However, many, if not most of the network paths that are determined by the management software are never actually used because of various network configurations. For example, routing configurations may preclude the use of certain network paths. Due to the complexity of typical networks, the information contained in routing configurations is not always available for use in eliminating unusable network paths from consideration when determining where security policies should be enforced on the network. The result is that the management software implements and manages security policies on network paths that are never actually used.

Previous approaches for eliminating enforcement of security policies on unused network paths have been attempted with varying degrees of success. One approach involves the use of path restriction rules. A path restriction rule usually requires an administrator to identify impermissible combinations of input and output interfaces to firewalls. For example, in a scenario where there is a first firewall having a first interface, and a second firewall having a second interface, an administrator may create a path restriction rule that prohibits any traffic passing into the first firewall through the first interface from passing out of the second firewall through the second interface. As a result, some topological paths are disqualified from becoming paths that can be utilized by the management software.

This approach is problematic because in most cases, many path restrictions are required to make a noticeable difference for managing the security policies. When many path restrictions are used, the net effect of all of the path restrictions is difficult to determine. Moreover, the approach fails to satisfy many scenarios, and the result is that security policies are enforced on many network paths that are never used.

Another typical approach is to calculate all possible paths between a given source node and destination node, and enable the administrator to select paths that will be managed by security policies from all of the possible paths. This approach places a considerable burden on the administrator, because there is often an overwhelming number of possible paths that make path selection by the administrator laborious and time-intensive.

Another approach is to enter routing entries as part of the topology, so as to allow the management software to consider the routing entries in determining all of the possible network paths. This approach requires the user to enter each routing entry. In large networks, the number of routing entries is too large to be efficiently entered and used.

Therefore, there is a need to reduce extraneous network paths when implementing, enforcing and/or managing security policies on a network. There is also a need for reducing the number of routing entries that are to be used for determining which network paths should have security policies enforced upon them.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The needs identified in the foregoing Background, and other needs and objects that will become apparent for the following description, are achieved in the present invention, which comprises, in one aspect, a method for simplifying management of security policies on a network.

An “enforcement path” is a network path that is selected or otherwise used to implement a security policy between a source and a destination.

A “network path” is any sequence of network elements that can be used to carry communication packets between a source and a destination.

A “node” is a logical representation of elements and components of a given network topology. For example, a node represents a collection of elements and components that can be singularized for purpose of determining network connectivity through that collection of elements and components, for communications between a given source and a given destination. In one embodiment, a node is either a security device, such as a firewall, or a collection of elements completely surrounded by security devices. In other embodiments, nodes may represent other portions of the network and/or have different granularities. Examples of network elements, or elements on the network, include firewalls, workstations, sub-networks (“subnets”), switches, gateways, hubs, and routers.

A “path entry” is a data structure that defines a portion of a path between a given source and a given destination. In an embodiment, each path entry is associated with a node, and defines a portion of a network path in terms of nodes. Path entries may specify parameters, which in one embodiment, include a set of communication packets that are subject to the path entry, and a subsequent node or hop for the specified set of communication packets. In one embodiment, the subsequent node or hop is a next node, or a destination element for the set of communication packets.

A “security perimeter” is a set of one or more elements that are completely surrounded by firewalls.

A “subsequent node” to any given node is any node that forms part of a network path between the given node and the destination for a designated set of communication packets. A subsequent node may include a next node, which is the node that is the next hop for a particular communication packet that is received by the given node.

A “substantial portion” means a quantity that is at least 50% of a stated item.

1.2 General Description

Embodiments enable a network topology to be modeled in a manner that simplifies the management of security devices on a network. In doing so, a simplified description of a network is provided that enables management software, and/or a network administrator, to efficiently analyze a network topology and to reduce application of security policies on extraneous network paths that are otherwise never used. In one embodiment, the simplified description of the network can be used to enable the network administrator to enter information that is contained in routing entries or otherwise not available to the management software, for the purpose of significantly reducing enforcement of security policies on unused network paths.

In one embodiment, path entries that represent an aggregation of routing entries are used to define possible network paths between a source and a destination on the network. Each of the path entries may be assigned to a portion of an overall network. A set of possible network paths for implementing a security policy may be defined by a sequence of path entries. The network administrator, or an automatic selection mechanism, may select actual enforcement paths from the set possible network paths. The selection of enforcement paths may be based on information that is not automatically available to the management software, but otherwise known to the administrator. Such information may be provided by actual routing entries which, for example, may select specific directions across firewall interfaces.

In one embodiment, a network may be modeled as a plurality of interconnected logical nodes. Each logical node represents a collection of network elements that may include or be defined by one or more security devices. One or more path entries may be determined for each logical node. Each path entry may specify a set of communication packets and a subsequent logical node that is to receive communication packets in the set of communication packets. The one or more path entries may be used to characterize at least a substantial portion of a network path that is to carry at least some of the communication packets in the set.

A network administrator or other user may specify one or more network paths using the path entries. Alternatively, the network administrator may select actual enforcement paths from among a plurality of possible network paths.

In other aspects, the invention encompasses a computer apparatus, a computer readable medium, and a carrier wave configured to carry out the foregoing steps.

2.0 Functional Overview

FIG. 1is a basic description of a method for managing security policies by simplifying the selection of enforcement paths on a network.

In step110, topology information is identified for a network. The topology information may be received from management software and/or information entered by an administrator of a network. The topology information may specify elements on the network, as well as how those elements are interconnected. For example, the topology information may specify firewalls and other elements, the links that interconnect elements, different LANs, the computers that host LANs, and the placement of physical routers between LANs and sub-networks.

In step120, a plurality of logical nodes are identified based on the topology information. Each node may be viewed as an equivalent representation of a set of components and elements for the purpose of analyzing path information. Components of a node may include, for example, routers, local area networks, and bridges.

In an embodiment, a node coincides with one of either a security perimeter or a firewall. A security perimeter corresponds to a set of elements on the network that is completely surrounded by firewalls. Thus, each logical node corresponds to one or more interconnected elements on a network. A single firewall may correspond to a node because the firewall may need to be configured in order to implement and enforce a particular security policy between two or more nodes.

Step130provides that one or more path entries are assigned to one or more of the nodes identified in step120. Each path entry is associated with a node. According to one embodiment, each path entry provides routing information for a designated set of communication packets, in that each path entry specifies a portion of a network path for the communication packets that are to pass through the node. The portion of the network path that is specified by the path entry may be defined by one or more parameters. In an embodiment, parameters of a path entry may specify a destination for a designated set of communication packets, and at least one subsequent node between the given node and the destination. The destination may be specified as either a node or an element.

In one embodiment, the subsequent node is a next node. The next node corresponds to a node containing a next component outside of the given node that is to receive a communication packet from the designated set of communication packets. Thus, an embodiment provides that for the designated set of communication packets, a path entry assigned to a particular node specifies a destination node (or element) and a next node to the particular node that is assigned the path entry. In this way, the path entry of a particular node defines a portion of a network path for the designated set of communication packets, in that two sequential nodes are identified for the designated set of communication packets.

In step140, a security policy that is to be implemented or configured on the network is identified. The security policy may specify or indicate a given source and a given destination, as well as a particular action that is to be performed for communications passing between the source and component. The source or destination may correspond to a range of components or elements, and even nodes, depending on how the security policy is preferably stated.

In step150, possible enforcement paths between the given source and destination may be determined based on sequences of nodes, as provided by path entries assigned to individual nodes. Since the possible enforcement paths are defined by nodes, the number of possible enforcement paths is much less set than what would otherwise be determined using components or elements that may handle communication packets sent between the source component to the destination component.

Step160provides that a selection of enforcement paths are made from the possible enforcement network paths that are determined in step150. The selection may be made manually by an administrator after all possible enforcement paths for a stated security policy are determined. The selection may also be made programmatically, or through the use of software that may provide additional constraints on which possible enforcement paths can be used. For example, routing configurations may actually preclude components in a first node from accessing components in a second node, even though such precluded paths are identified by combinations of path entries and nodes. The network administrator may use knowledge, or access information not available to the management software, to select enforcement paths from all possible network paths. Since the network topology is modeled as nodes and path entries, the step of selecting enforcement paths can be relatively easy for the network administrator. For instance, the administrator may edit the path entries to make the selection. Similarly, programmatic selection of enforcement paths requires little processing resources, as the number of nodes and path entries is relatively small.

In step170, the security policy identified in step140is enforced on the selected paths between the given source and destination. In order for the security policy to be enforced on the selected paths, firewalls and other security devices that define the nodes forming the selected paths are configured to implement the security policies. For example, one or more firewalls on a selected enforcement path may be configured with access control list entries that combine to enforce the stated security policy.

While embodiments described withFIG. 1provide for enforcement paths to be selected from all possible paths between a given source and a given destination, other embodiments may provide that path entries are used to identify the enforcement paths directly, with no intermediate step of selecting enforcement paths. For example, when the logical nodes of a network are determined, path entries amongst nodes may be entered and/or configured directly by an administrator in order to specify the enforcement paths for security policies that are to be enforced on the network. The administrator may be able to more readily determine path entries between nodes because the nodes provide a more simplified understanding of the routing information on the network.

FIG. 2is a more detailed method for implementing security policies on a network. The method ofFIG. 2assumes that topology information for a given network topology is known. Thus, information such as location and number of firewalls, and the interconnectivity of components such as firewalls, hosts, routers, and servers are assumed to be known in an inventory database, network management system or application, directory, server etc.

In step210, one or more security perimeters are defined on the given topology. As mentioned, each security perimeter corresponds to a set of one or more elements that is completely surrounded by firewalls. Thus, each communication packet that enters the set must be received from a firewall that at least partially surround the set of elements. Likewise, each communication packet that exits the set must also be received by a firewall that partially surrounds the set of elements.

Step220provides that the nodes on the given topology are defined by each identified security perimeter and firewall. In one embodiment, each node is either one of a firewall or a security perimeter, other embodiments contemplate assignment of nodes to other groupings and collections of firewalls and components.

In step230, a path entry is assigned to one or more of the nodes. According to embodiments of the invention, one type of path entry assigned to a particular node is for when the destination of a communication packet is another node. Each of these path entries specify, as parameters, a destination and a next node. Then, when the security policies are enforced, communication packets that are to pass through the particular node are identified by their destinations. For a given destination, a communication packet exiting the particular node is to be passed to the logical node that is designated as the next node for communication packets having that given destination.

While embodiments described herein define each path entry of a given node in terms of its next node, other embodiments may specify other parameters for a communication packet. Such other parameters may include, for example, the destination and a subsequent node, where the subsequent node is any node between the given node and the destination.

In step240, a security policy specifying a given source and a given destination is identified. The given source and destination may, for example, be specified as elements, components or other nodes. The stated security policy may correspond to some action, such as denying communication packets of a particular dimensional range, that is to be performed by one or more firewalls between the source and the destination.

In step250, a set of possible network paths between the given source and destination is determined based on a sequence of nodes and the path entries of those nodes. In one embodiment, the network paths identify a source node where the source of the specified security policy is located, one or more intermediate nodes, and a destination node where the destination specified by the security policy is located. The network paths are defined by path entries assigned to the source node, the intermediate nodes, and the destination node. In one embodiment, all possible network paths between a given source and a given destination may be defined using path entries.

Step260provides that a selection is made from among the set of possible network paths to identify a smaller set of enforcement paths. For example, as described withFIG. 1, the possible network paths may be presented to a user, who then makes selections of enforcement paths based on the user's knowledge of how a topology is configured. Some network paths may be excluded from enforcing a stated security policy because those network paths would never actually be used to carry communication packets specified by the stated security policy. The user may edit the path entries to make such selection.

In step270, security policies are enforced on the enforcement paths selected in step260. This step may involve translating security policies specified by the user into commands, such as access control list entries, which are then used to configure individual firewalls on the selected enforcement paths.

Rather than select enforcement paths from the possible network paths, embodiments of the invention also provide for enforcement paths to be derived from the possible network paths. For example, modifications or minor deletions may be made to path entries that define the possible network paths in order to select the enforcement paths.

FIG. 3andFIG. 4illustrate example networks for implementing embodiments of the invention. For topologies described byFIG. 3andFIG. 4, path entries may be developed that enable the selection of enforcement paths for security policies. The path entries represent aggregations of router entries for elements and components that are contained within a defined logical node. Since fewer logical nodes will exist than the components and elements that require router entries, it is possible to model a network into logical nodes so as to determine path entries that describe path information amongst the logical nodes. The path entries are far fewer than the routing entries, but contain the similar information as all of the routing information provided for components and elements of the nodes.

InFIG. 3, a network300includes a first network312, a second network314, a third network342, a fourth network344and a fifth network346. Each of the networks include a plurality of components. The networks may correspond to Ethernet LANs or other types of LANs. A first firewall320and a second firewall330are used to enforce security policies on the network300.

A first set of network elements consisting of components in the first network312and second network314are enclosed by the first firewall320and the second firewall330. A second set of elements consisting of components in the third network342, fourth network344and fifth network346are also enclosed by the first firewall320and second firewall330. Since any communication into one of the components in the first set must come from one of the first firewall320or second firewall330, the first set of components is labeled as a first security perimeter310(labeled as P1). Similarly, the second set of components is labeled as a second security perimeter340(labeled as P2).

The first firewall320has a first interface322(labeled as e0) and a second interface324(labeled as e1). The first interface322of the first firewall320directly connects to first security perimeter310. The second interface324of the first firewall320directly connects to second security perimeter340. The second firewall330has a first interface332(labeled as e0) that directly connects to first security perimeter310. The second firewall has a second interface334(labeled as e1) that directly connects to second security perimeter340.

According to an embodiment, network300may be modeled as having a first logical node corresponding to first security perimeter310, a second logical node corresponding to first firewall320, a third logical node corresponding to third firewall330, and a fourth logical node corresponding to second security perimeter340. One or more of the logical nodes may be assigned path entries. Each path entry defines a portion of a possible network path for a designated set of communication packets that may exit the node. Each path entry may have parameters that identify the designated set of communication packets. In one embodiment, a set of communication packets has portions of paths defined by parameters that correspond to destinations of the communication packets, and the next hop for such communication packets.

Path entries may be made applicable to sets of communication packets that are defined by destination address ranges, as such destination addresses are usually part of the header of each communication packet that would enter a node. When a destination of a communication packet is known at a particular node, the next hop for the communication packet to reach its destination may be designated in the path entry so that the path entry defines a partial path for a set of communication packets.

For example, a path entry assigned to first security perimeter310may be:

DestinationNext HopP2FW1.e0 or FW2.e0(1)
This path entry identifies second security perimeter340as a destination for communication packets that are going to be subject to the path entry. For all such communication packets, the next hop in terms of logical nodes is either first firewall320or second firewall330. Thus, the path entry provides for two possible network paths between the node corresponding to first security perimeter310and the node corresponding to second security perimeter340. A first possible network path352is from first security perimeter310through first firewall320via its first interface322and to the second security perimeter340. A second possible network path354is from first security perimeter310through second firewall330via its first interface332and to the second security perimeter340.

The path entries simplify the network300and facilitate the selection of enforcement paths from a set of possible network paths that are identified through logical nodes. The selection of enforcement paths from the set of possible network paths may be based on information that is external to the software that manages the network300.

For example, an administrator may know that the second firewall is configured to not receive communications from either first network312or second network314. The simplified network300enables the administrator to use the information to reduce the number of network paths that are to be used as enforcement paths. In one embodiment, the administrator is presented one or more path entries that identify multiple possible enforcement paths. Each path entry is sufficiently simple to enable the administrator to select enforcement paths. Upon being presented path entry (1), the administrator may select to not enforce security policies between first security perimeter310and second security perimeter340on second firewall330because that firewall will not receive such communications based on the network configurations. Once the administrator selects the enforcement paths, the path entry (1) is modified as follows:

DestinationNext HopP2FW1.e0(2)
The path entry (2) is thus modified to reflect that communications from the first logical node cannot pass through the second firewall330. As such, security policies that regulate communications from components in first security perimeter310do not need to be enforced on the second firewall330.

Once enforcement paths are selected from the set of possible network paths, firewalls that are on the selected enforcement paths may be configured with the desired security policies. In one embodiment, access control list entries are used to configure firewalls that handle communications on the selected enforcement paths. For example, if for a given security policy a component in first network312is specified as the source of a communication packet, and a component in fifth network346is specified as the destination component, then path entry (2) specifies that only first firewall320is to be configured with access control entries that implement the given security policy.

FIG. 4illustrates a network400having a first security perimeter410(labeled as P1), a first firewall420, a second security perimeter430(labeled as P2), a second firewall440, a third security perimeter450(labeled as P3), and a fourth security perimeter460(labeled as P4). The first security perimeter410may correspond to a first network412and a second network414. The fourth security perimeter460contains a third network462and a fourth network464.

Communications that exit first security perimeter410pass through a first interface422(e0) of the first firewall420. Communications that pass from the first firewall420to the second security perimeter430exit the second interface424(e1) of first firewall420. Communications that are exchanged between the third security perimeter450and first firewall420pass through a third interface426(e2) of first firewall420. The second firewall440and the second security perimeter430exchange communications through a first interface442(e0) of the second firewall. The second firewall440and the fourth security perimeter460exchange communications through a second interface444(e1) of the second firewall. Communications that pass between second firewall440and the third security perimeter450exchange communications through a third interface446(e2) of the second firewall.

According to one embodiment, the logical nodes of network400include first security perimeter410, second security perimeter430, third security perimeter450, fourth security perimeter460, first firewall420and second firewall440. Some or all of the nodes may be used to select enforcement paths. It is also possible for some nodes to be combined or ignored when determining enforcement paths.

Given network400, a path entry may be assigned to one of the firewalls. For example, first firewall420may be assigned the following path entry:

DestinationNext HopP4P2or P3(3)
Thus, the path entry designates two possible enforcement paths for communication packets passing through first firewall420and destined for fourth security perimeter460. The simplified expression provided by path entry (3) facilitates selection of one enforcement path over another enforcement path. For example, the path entry that may designate the enforcement path of communication packets passing through first firewall420and destined for fourth security perimeter460may be represented as:

DestinationNext HopP4P3(4)
According to path entry (4), communication packets passing through first firewall420and destined for fourth security perimeter460are to pass through third security perimeter450, but not second security perimeter430. An enforcement path470may be selected for this path entry that fully describes, for purpose of enforcing security policies, communication packets passing from first network412to third network462. The enforcement path470includes the first network412in the first security perimeter410, first interface422of first firewall420, first firewall420, third interface of first firewall426, third security perimeter450, third interface446of the second firewall, second firewall440, second interface444of the second firewall, and the third network462in the fourth security perimeter460.

Using logical nodes such as security perimeters and firewalls for path entries greatly reduces the actual amount of routing information that needs to be considered when configuring security policies on a network. By defining logical nodes as one of firewalls or security perimeters, assigning path entries to logical nodes, and specifying other logical nodes as destinations in each of the path entries, the models described in the above embodiments are accurate in identifying possible enforcement paths, and in enabling selection of actual enforcement paths from the possible enforcement paths based on external information that would not otherwise be available to the management software.

It is also possible for path entries to define different paths for different destinations within the same logical node. For example, the following path entry may be assigned to first firewall420:

DestinationNext HopNetwork 4P2(5)P4P3
According to path entry (5), communication packets directed to fourth network464of fourth security perimeter460will have a different path than communication packets directed to other components or elements of the fourth security perimeter.

The destination may specify a component if that component requires a different path than other elements in the security perimeter.

Not all determined logical nodes of a given network need assigned path entries for embodiments of the invention to be effective. For example, a security perimeter that is connected to only one firewall does not require a path entry assignment, because such a security perimeter has only one possible subsequent hop. In an example provided byFIG. 4, first security perimeter410and fourth security perimeter460do not require path entries to be assigned to them.

4.0 Architecture Overview

FIG. 5is a block diagram illustrating a system that can be used to implement embodiments of the invention. The system includes a policy server510and a repository530. The system may also include a terminal520to operate the policy server510. The policy server510may access a connected network such as shown byFIG. 3andFIG. 4through a network channel515.

In an embodiment, policy server510accesses repository530to execute instructions to identify nodes from elements and components on a given network. In addition, policy server510may access repository530to execute instructions to determine path entries for the identified nodes. The path entries may be used to define network paths between nodes and/or components of the network.

In one embodiment, a characterization of possible network paths for enforcing certain security policies on the network may be presented to the user operating workstation terminal520. The nodes and path entries may be used to provide the characterization of the network paths. The user may be enabled to select enforcement paths that are estimated to be in use when designated communication packets are transmitted on the network.

For example, the user may specify, through terminal520, a destination and source component. In response, policy server510may present the user with path entries that characterize the network path between the source and destination components in terms of nodes on the network. More than one network path may be shown by the path entries. The user may select from only some of the network paths presented by the path entries. One or more security policies between the specified source and destination components may be specified on the selected network paths. The user may make the selection based on knowledge that one or more of the network paths provided by the path entries are unusable.

As another example, the user may be provided path entries that can be used to characterize network paths using nodes. For given source and destination components, the use may formulate one or more network paths by specifying path entries after viewing the nodes and individual path entries.

In either case, policy server510implements security policies on selected network paths based on selections or specifications of path entries made by the user. The implementation of the security policy may involve the policy server510using network channel515to configure firewalls and other security devices. For example, policy server510may configure security devices on selected network paths with access control list entries for purpose of implementing or enforcing a specific security policy between a source and a destination.

Furthermore, the user may access terminal520to manage security policies on the network. The security policies may be identified and managed more readily by policy server510presenting a topology of the network in terms of path entries and nodes. As a result, management decisions and operations can be more easily viewed and implemented.

FIG. 6is a block diagram that illustrates a computer system600upon which an embodiment of the invention may be implemented. Computer system600includes a bus602or other communication mechanism for communicating information, and a processor604coupled with bus602for processing information. Computer system600also includes a main memory606, such as a random access memory (“RAM”) or other dynamic storage device, coupled to bus602for storing information and instructions to be executed by processor604. Main memory606also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor604. Computer system600further includes a read only memory (“ROM”)608or other static storage device coupled to bus602for storing static information and instructions for processor604. A storage device610, such as a magnetic disk or optical disk, is provided and coupled to bus602for storing information and instructions.

The invention is related to the use of computer system600for simplifying the selection of network paths for implementing and managing security policies on a network. According to one embodiment of the invention, simplifying the selection of network paths for implementing and managing security policies on a network is provided by computer system600in response to processor604executing one or more sequences of one or more instructions contained in main memory606. Such instructions may be read into main memory606from another computer-readable medium, such as storage device610. Execution of the sequences of instructions contained in main memory606causes processor604to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement the invention. Thus, embodiments of the invention are not limited to any specific combination of hardware circuitry and software.

Computer system600also includes a communication interface618coupled to bus602. Communication interface618provides a two-way data communication coupling to a network link620that is connected to a local network622. For example, communication interface618may be an integrated services digital network (“ISDN”) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface618may be a local area network (“LAN”) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface618sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

The received code may be executed by processor604as it is received, and/or stored in storage device610, or other non-volatile storage for later execution. In this manner, computer system600may obtain application code in the form of a carrier wave.

5.0 Extensions and Alternatives