Method and system for controlling access to network resources using resource groups

A method and device for configuring a firewall in a computer system employing a rule for controlling access between a source resource and a destination resource only if said source and destination resources belong to the same protection domain. At a central configuration machine, an access control rule is specified, including a scope, for each resource group, the scope, and thus the access control rule is capable of being interpreted by each of the plurality of firewalls differently depending on the value of the scope and network resource characteristics associated with each of the plurality of firewalls.

FIELD OF THE INVENTION

The present invention concerns the field of firewalls in a computer system, and more specifically the configuration of firewalls.

DESCRIPTION OF RELATED ART

A firewall is a machine or group of machines that makes it possible to protect the junction between an internal network and an external network like the Internet against unauthorized, or even malicious, intrusions. It is noted that the Internet consists of a set of interconnected networks and machines around the world, allowing users throughout the world to share information.

The term “machine” in the present specification represents a very broad conceptual unit that includes hardware and/or software. The machines can be very diverse, such as workstations, servers, routers, specialized machines and gateways between networks.

All of the messages flowing between the internal and external network must pass through the firewall, which examines each message and blocks those that do not comply with given access control rules. The firewall is one element of a global security policy, integrated into an increasingly rich applicative environment and designed to protect computer resources.

Firewalls are used, in particular, to prevent unauthorized Internet users from accessing internal networks connected to the Internet, to give a user of an internal network secure access to the Internet, to separate a company's public machines allowing access to the Internet from its internal network, so as to create a partition in a given network so as to protect the partitioned segments of internal networks.

The firewall is embodied, for example, by a dedicated machine that controls access to the various machines of a given internal network.

To do this, the firewall controls which machines and/or which users and/or which services or applications of an internal network can access which machines and/or which users and/or which services or applications of an external network and vice versa.

Machines belonging to the Internet use the TCP/IP protocol. The firewall filters TCP/IP communications. The firewall manipulates applicative data, information transmitted in the part reserved for data in the headers of TCP/IP datagrams.

The filtering criteria are, to give a non-limiting example:the calling address,the address called,the application called.

The complexity of a firewall configuration is illustrated by the following example, which can be applied to most of the partitioned architectures in enterprise networks.

Let us consider the case of an enterprise network comprising n firewalls named NW1, . . . , NWnconnected to subnetworks.

We would like to apply a security policy according to which, in each subnetwork CCi, a workstation (client station) Ciis authorized to access a server Silocated in a subnetwork SSi. The subnetworks CCiand SSiare connected to one and the same firewall NWi.

This example can, of course, be extended to include several workstations that are authorized to access several servers.

With conventional firewall configuration systems, administrators work in two ways:Defining two groups, respectively containing the workstations and the servers. Then defining a rule authorizing the workstation group's access to the server group. This way of working makes it possible to authorize, in a single rule, each station's access to the server connected to the same firewall (Ci→Si), but also authorizes the stations' access to all the other servers connected to other firewalls NWj(Ci→Sj). This is not the desired security policy.Defining in each firewall the specific rules authorizing, one by one, each workstation's accesses to the server that corresponds to it. This way of working quickly becomes complicated, even difficult, to put into practice as the number of firewalls, the number of workstations, or the number of servers increases.

Simplifying the configuration is a priority for a firewall administrator.

The current known solutions for attempting to resolve the problem of complexity in the configuration are the following.

There is a known system marketed under the name Net Partitioner and produced by the Solsoft company.

The Net Partitioner device allows the administrator to graphically represent his entire network, with the installation of the firewalls and the various servers and workstations that belong to it. The machines are represented by icons and their interconnections by lines connecting them.

The administrator also defines, in the form of arrows, the ways in which the machines can access other machines and the applications they host.

This solution makes it possible to define groups of computers, as well as rules for controlling access between these groups. On the other hand, the rules define the access of all the elements of a group to all the elements of another group, which complicates the configuration procedure.

The description of the system, (i.e. all of the machines present in the form of icons and their interconnections in the form of lines), and the specification of the rules applied to the system and represented in the form of arrows, are combined in the same graphical interface. The more machines, and the more connections between these machines, the system comprises, the more difficult it is for the administrator to describe the system via the interface.

Moreover, the Net Partitioner device does not provide for any transfer of rules from said device to the firewalls in question, or for any retrieval of the new security policy. The administrator himself must configure each of the firewalls from the results obtained by the Net Partitioner device.

Therefore, this solution does not make it possible to simplify the configuration procedure.

One object of the present invention is to simplify the configuration of a large number of firewalls.

SUMMARY OF THE INVENTION

In this context, the present invention offers a method for configuring a firewall in a computer system comprising objects, the objects for which an access control policy is established being called resources, characterized in that it groups the objects of the system into protection domains, each firewall ensuring the protection of an internal domain relative to an external domain, and applies to the firewall in question a rule for controlling access between a source resource and a destination resource only if said source and destination resources belong to the same protection domain.

The present invention also relates to the system for implementing said method.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

As shown inFIGS. 1 through 4, the present invention relates to a method for configuring a firewall1in a computer system2.

The computer system2is distributed and comprises objects3, users and firewalls1. An object3is a very broad conceptual unit that includes hardware and/or software. The objects3can be very diverse, such as networks, subnetworks, workstations, servers, routers, specialized machines and gateways between networks, and applications. Only the components of the objects3of the system2that are characteristic of the present invention will be described, the other components being known to one skilled in the art. The objects3between which access control rules constituting the security policy of the system2are defined are called resources4.

As represented inFIG. 1, the firewalls1protect an internal domain5(D1, D2, D3) relative to an external domain6(backbone). An administrator7defines for each firewall1the internal domain5that constitutes the firewall's protection domain. The firewall's protection domain represents what the administrator wishes to protect by means of said firewall relative to what he wants to protect it from, i.e. the external domain.

Each of the two internal5and external6protection domains is constituted by zones8comprising one or more networks or subnetworks9of machines. A zone8is a part of the system2that is separated from the rest of the system by one or more firewalls. The zones8are connected to the firewall1in question by several network interfaces10. The administrator7determines, for each zone8connected to each firewall, whether the zone8is inside the protection domain5of the firewall (internal zone) or whether it is outside it (external zone), i.e., whether it is directly protected by the firewall or whether it is a zone for providing a connection between the firewalls, or between the various protection domains, which is essentially the same thing.

In the exemplary embodiment illustrated inFIG. 1, each protection domain5D1, D2, D3is controlled by a firewall1, respectively NW1, NW2, NW3. Each of the firewalls NW1, NW2, NW3is connected to a zone8comprising an internal subnetwork11, respectively I1, I2, I3, and to a zone8comprising a subnetwork12of the “demilitarized zone” type, respectively DMZ1, DMZ2, DMZ3. The subnetworks11and12are inside the protection domain5.

A subnetwork of the “demilitarized zone” type is a buffer subnetwork, creating a sort of screen between an internal and external network in order to reinforce its protection.

Each firewall1is connected to a zone8of the external domain6comprising a so-called backbone network13. The zone8of the external domain6comprising the network13is called the backbone zone. The backbone zone8constitutes the connection of the internal domain5to the rest of the network in question, and represents the outside of the domain5in question.

According to one development of the invention, the backbone zone8comprises a central configuration machine14from which the global configuration of the system2is performed. The global configuration of the system2can be performed, for example, as explained in the French patent application no. 2,802,662 filed on Dec. 2, 1999 by the present Applicant, the title of which is “METHOD AND DEVICE FOR CENTRALIZED FIREWALL CONFIGURATION IN A COMPUTER SYSTEM”, granted 21 Jun. 2001. The central configuration machine14offers a graphical interface15that allows the administrator7to perform said configuration. The graphical interface15is illustrated inFIGS. 1 through 4.

The present invention is described below in the embodiment of the system illustrated inFIGS. 1 through 4, which consists in a central configuration of the firewalls. The method according to the invention described for said embodiment can be applied to an isolated firewall without a central configuration.

In the embodiment illustrated inFIG. 2, the administrator7enters the definitions of the firewalls1, the domains5,6and the network interfaces10through the graphical interface15. The screen of the interface15is divided into three windows: an object window16on the left side of the screen of the machine14, an attribute window17on the right side of the screen of the machine14, and a rule window18at the bottom of the screen. In the object window16, when a “Netwalls” tab19is selected, all of the firewalls NW1, NW2, NW3of the system2are indicated. In the attribute window17, when a “Properties” tab20is selected, the properties of the firewall highlighted in the left-hand part (in this case NW1) are indicated in a zone table21.

The administrator defines the properties of the firewall1in the following way. The firewall NW1has three network interfaces10, mentioned in the “Name” column22with the zones8indicated in the “Zone” column23: a network interface NW1with the zone of the subnetwork11, a network interface NW1_dmz with the zone of the subnetwork DMZ1, and a network interface NW1_backbone with the backbone zone. The properties are similar for the firewalls NW2and NW3. An “Address” column24in the table21indicates the addresses of the network interfaces whose names are located on the same lines.

An “Is External” column25of the zone table21makes it possible to specify, for each network interface10, whether said network interface is attached to a zone8outside the protection domain5(the value “true”) or inside the protection domain (the value “false”).

In the example in question, the network interfaces NW1_dmz and NW1are attached to zones8(subnetworks DMZ1, I1) inside the protection domain5, while the network interface NW1_backbone (backbone network) is outside the protection domain (configuration similar for the firewalls NW2and NW3).

Each firewall provides access control for both the communications between the domains5and the communications between the zones8inside the domain5for which it is responsible. One part of the security policy concerns access control between the domains; another part of the security policy concerns access control between the zones inside the domain controlled by the firewall.

The invention consists of defining an operation for factoring the access control rules constituting the access control policy so as to minimize the number of filtering rules to be declared by the administrator.

To this end, the administrator7joins into the same groups the objects3of the system2(in the example illustrated, workstations and servers) for which the same security policy is applied. In the example illustrated inFIG. 1, workstations26C1, C2, C3are an integral part of the respective internal subnetworks I1, I2, I3; servers27S1, S2, S3respectively belong to the subnetworks DMZ1, DMZ2, DMZ3. The domain D1groups the zone comprising the internal subnetwork I1with the workstation C1and the zone comprising the subnetwork DMZ1with the server S1. In the example illustrated, only one workstation belongs to the internal subnetwork I1; the subnetwork I1could contain several workstations C11, C12, C13, . . . , C1kand/or any other types of machines. Likewise the subnetwork DMZ1could contain several servers S11, S12, S13, . . . , S1m and/or any other types of machines. The same reasoning is applicable to the other domains and zones.

The administrator7can, for example, group the machines C1, C2, C3into a group of workstations26and the machines S1, S2, S3into a group of servers27.

The invention consists of declaring, among the types of groups defined by the administrator, access control rules whose scope is limited to each firewall or extended to the system2. The administrator specifies for the access control rules whether the scope is local to the firewall or global.

A rule of local scope defines the access relationships between the resources4of two groups, said resources belonging to the same protection domain. The local scope makes it possible to limit the rule to accesses inside the protection domain5.

In the example mentioned above, a rule of local scope defines an access relationship of the group (C1, . . . , Cn) to the group (S1, . . . , Sn) involving an access from the resource Cito the resource Si, without establishing a relationship of Cito Sj, with j different from i. When there are several workstations and servers as see above, the principle is the same: the rule of local scope defines an access relationship of the group (C11, C12, . . . , C1K, . . . , Cn1, Cn2. . . ) to the group (S11, S12, . . . , S1m, . . . , Sn1, Sn2. . . ) using an access from the resource Cikto the resource Sim, without establishing a relationship of Cikto Sjm, with j different from i, no matter what k and m are.

A rule of global scope defines the possible access relationships between two groups in the system2as a whole.

A rule of global scope is saved and can always be used by the administrator to handle general cases of the security policy. Rules of global scope govern the access relationships of the group (C1, . . . , Cn) to the group (S1, . . . , Sn) and establish all the relationships of Cito Sj, for i and j varying from 1 to n. When there are several workstations and servers as seen above, the rule of global scope defines an access relationship of the group (C11, C12, . . . , C1K, . . . , Cn1, Cn2. . . ) to the group (S11, S12, . . . , S1m, . . . , Sn1, Sn2. . . ) using an access from the resource Cikto the resource Simno mater what i, j and m are.

The “local” or “global” scope attribute of each rule is attached to each rule in such a way that each firewall individually knows the scope of the rules.

In the embodiment illustrated inFIGS. 3 and 4, the administrator would like to implement an access control policy in which the resources of each internal subnetwork Ii(i in this case varying from 1 to 3) of each protection domain5can access the resources of the subnetwork DMZ (i in this case varying from 1 to 3) of the same protection domain5, without authorizing access between one internal subnetwork Iiof a given domain and the subnetwork DMZj, with j different from i, of another domain (for example access between the subnetwork I1and the subnetwork DMZ2).

As shown inFIG. 3, the administrator, using the graphical interface15, groups the zones of the internal subnetworks I1, I2, I3into the group of internal subnetworks G_I and the zones of the subnetworks DMZ1, DMZ2, DMZ3into the group G_DMZ. In the object window16, a “Resources” tab28having been selected, it is indicated that the group G_DMZ comprises ANY_DMZ1, ANY_DMZ2, ANY_DMZ3, i.e. all of the objects of the subnetworks DMZ1, DMZ2, DMZ3.

The administrator then defines, in the rule window18, the rules of local or global scope. In the example illustrated inFIG. 4, a rules table28in the rule window18that makes it possible to define the rules is displayed in the attribute window17when a “Rules” tab30is selected. The attribute window17shows that the administrator has defined, by means of the table29of the window18, a rule of “local” scope allowing access from the group G_I to the group G_DMZ, the rule thus defined being displayed in the table29of the attribute window17.

The rules table29comprises a “Name” column31for identifying the access control rule, a “Source” column32for designating the source group of the rule, and a “Destination” column33for designating the destination group of the rule.

The scope of the rule is defined in a “Scope” column34and can have the values “LOCAL” for a local scope or “GLOBAL” for a global scope. In the example illustrated, the scope of the rule has the default value “GLOBAL.”

The method according to the present invention works in the following way:

When the firewall applies the access control (for example during an attempt to establish a connection), the firewall1analyzes the scope attribute of the rule governing the control of the current access.

If the rule is of global scope, it is applied without any additional control: access is authorized or denied based on the instructions given by the rule. This is a standard firewall operation.

If the scope of the rule is local, the firewall determines the incoming and outgoing network interfaces10for the current traffic and analyzes whether these network interfaces are attached to the internal5or external6domain.

If both the incoming and outgoing network interfaces10are attached to the internal domain5, the current traffic is within the firewall's protection domain5; the rule is therefore applied and the access is authorized or denied based on the instructions given by said rule.

If one of the two network interfaces10is attached to the external domain6, the current traffic is not within the firewall's protection domain5; the rule in question is not applicable for the profile of the current traffic.

In the example illustrated, no firewall connecting the domains D1, D2, D3to one another has been provided. The invention is not concerned with linked domains. The interfaces associated with linked domains are automatically attached to an external domain, which means that the “Is External” column has the true value.

In the example illustrated inFIGS. 2 through 5, the method works in the following way.

During an access from the subnetwork I1to the subnetwork DMZ1, the firewall NW1determines that the traffic enters through the network interface10NW1and leaves through the network interface10NW1—dmz. Said network interfaces NW1and NW1—dmz are declared to be inside the protection domain of the firewall in question. The firewall NW1authorizes the access. The mechanism is similar for accesses from the subnetwork I2to DMZ2, through NW2, and from I3to DMZ3through NW3.

During an access from the subnetwork I1to the subnetwork DMZ2, the firewall NW1determines that the traffic enters through the network interface NW1and leaves through the network interface NW1—backbone. The first network interface NW1is declared to be inside the protection domain5, while the second interface NW1—backbone is declared to be outside the protection domain5. The traffic is not limited to the protection domain5, and the firewall NW1does not authorize the access.

In the same way, the firewall NW2detects that the traffic in question enters through the network interface NW2—backbone and leaves through the network interface NW2—dmz. The network interface NW2—backbone is attached to a subnetwork outside the protection domain; the traffic is not limited to the protection domain of the firewall NW2and is blocked by the latter.

The present invention relates to the method for configuring a firewall1in a computer system2comprising objects3, the objects3for which an access control policy is established being called resources4, characterized in that it groups the objects3of the system into protection domains5,6, each firewall1ensuring the protection of an internal domain5relative to an external domain6, and applies to the firewall in question a rule for controlling access between a source resource4and a destination resource only if said source and destination resources belong to the same protection domain5or6.

The method determines the protection domain of the resources4by means of the network interfaces10of the firewall in question, interfaces through which the communications pass in order to reach said resources.

The method defines the zones8comprising networks or subnetworks; it associates the network interfaces10of the firewalls to which said zones are connected with an internal or external domain; it determines the incoming and outgoing network interfaces10of the current traffic; it analyzes whether said network interfaces are attached to an internal or external domain; it applies the rule only if both network interfaces are attached to the same internal domain5, which corresponds to the fact that the resources belong to the same protection domain.

The method composes the groups of objects3for which the access control policy is identical and applies the rule between each of the resources of a source group and a destination group.

The method characterizes the rule with a local or global scope, and it applies the rule to the resources in question only if said resources belong to the same protection domain5or6when the scope of the rule is local, and applies the rule to all of the resources in question when the scope of the rule is global.

The present invention also concerns the device for implementing the method described above.

The present invention also relates to the device for configuring a firewall1in the computer system2, characterized in that it comprises the central configuration machine14that makes it possible to group the objects3of the system into protection domains, each firewall1ensuring the protection of an internal domain5relative to an external domain6, and to apply to the firewall in question a rule for controlling access between a source resource4and a destination resource only if said source and destination resources belong to the same protection domain5or6.

The device comprises the graphical interface15from which an administrator7can enter the protection domains5and6and the access control roles.

The graphical interface allows the administrator7to define a local or global scope for the access control rule, and the machine14applies the rule to the resources in question only if said resources belong to the same protection domain5or6when the scope of the rule is local, and applies the rule to all of the resources in question when the scope of the rule is global.