Domain-based security policies

An example network system includes a plurality of endpoint computing resources, a business policy graph of a network that includes a set of the plurality of endpoint computing resources configured as a security domain, a set of policy enforcement points (“PEPs”) configured to enforce network policies, and a network management module (“NMM”). The NMM is configured to receive an indication of a set of network policies to apply to the security domain, automatically determine a subset of PEPs of the set of PEPs are required to enforce the set of network policies based on physical network topology information readable by the NMM that includes information about the location of the endpoint computing resources and the set of PEPs within the network, and apply the network policies to the subset of PEPs in order to enforce the network policies against the set of endpoint computing resources of the security domain.

TECHNICAL FIELD

This disclosure relates to computer networks and, more particularly, securing endpoint computing resources in a computer network.

BACKGROUND

A computer network typically includes a collection of interconnected computing devices that exchange data and share resources. The devices may include, for example, web servers, database servers, file servers, routers, printers, end-user computers and other devices. The variety of devices may execute a myriad of different services and communication protocols. Each of the different services and communication protocols exposes the network to different security vulnerabilities.

Due to increasing reliance on network-accessible computers, network security has become a major issue for organizations and individuals. To help ensure security of their computers, organizations and individuals may install security devices between public networks and their private networks. Such security devices may prevent unwanted or malicious information from the public network from affecting devices in the private network.

Example security devices include firewalls, intrusion detection and prevention (“IDP”) devices, and secure socket layer (SSL) virtual private network (VPN) devices. Typically, these devices reside at an edge of a network and may be statically configured or provisioned to apply security policies of an organization or individual. When multiple security devices are deployed by an organization to protect computing devices located at various office locations, for example, an administrator typically has to design security policies for the different subnet at the various office locations. Furthermore, each security device must be statically configured or provisioned to apply the security policies. As the number of deployed security devices increases, the likelihood that the administrator will make an error increases and the amount of administrator time required to configure the security devices increases.

By grouping the security devices, an administrator may statically configure or provision multiple security devices with the same configuration information more quickly and reliably. However, the administrator must have knowledge of the network design and must determine which security devices need to be configured in order to protect particular network resources located within a private network or to protect network traffic traveling between private networks. Furthermore, if a client device moves to a different location such as a different private network, the administrator must determine which security devices are affected and reconfigure those security devices.

SUMMARY

In general, this disclosure is directed to techniques for automatically configuring policy enforcement points (e.g., security devices, intranet controllers, subscriber resource devices, or other devices) within a computer network based. For example, this disclosure describes techniques by which endpoint computing resources are segregated into a plurality of security domains and security sub-domains so as to define a business policy graph that is independent of the physical topology of the network, i.e., the policy enforcement points and the physical subnets that define the physical network topology. Network policies may then be configured and applied by a network policy manager to each security domain and sub-domain in accordance with the business policy graph without reliance on the physical network topology. In this way, any given security domain of the business policy graph may be defined in a way that includes endpoint computing resources from a single geographic location or even from two or more different geographic locations even though the endpoint computing resources are located within different subnets of the physical topology of the network as controlled by policy enforcement points within the network. The network policy manager then effectively overlays the abstract business policy graph onto the physical network topology so as to determine the proper configuration for each of the policy enforcement points that effectively define the physical network topology. That is, based on the defined business policy graph, a network policy manager automatically determines which of the policy enforcement points of the business policy graph need to be configured to enforce the network policies for each security domain, generates device-specific configuration information for each policy enforcement device that needs to be configured, and configures the policy enforcement devices based on the device-specific configuration information.

In one example, a method includes receiving business policy graph information that defines a business policy graph of a network, wherein the business policy graph comprises a set of endpoint computing resources configured as a security domain without an indication of any policy enforcement points within the network, wherein the business policy graph is independent of a physical topology of the network, and wherein each of the set of endpoint computing resources is accessible to a user to perform a computing task. The method further includes receiving an indication of a set of network policies to apply to the security domain, and automatically determining, with a network management system, a set of policy enforcement points based on physical network topology information readable by the network management system, wherein the physical network topology information includes information about the location of the set of endpoint computing resources and the set of policy enforcement points within a network. The method also includes applying, with the network management system, the network policies to the set of policy enforcement points in order to enforce the network policies against the set of endpoint computing resources of the security domain.

In another example, a network system includes a plurality of endpoint computing resources, wherein each of the plurality of endpoint computing resources is accessible to a user to perform a computing task, a business policy graph of a network, the business policy graph comprising a set of the plurality of endpoint computing resources configured as a security domain without an indication of any policy enforcement points within the network, wherein the business policy graph is independent from a physical topology of the network, a set of policy enforcement points configured to enforce network policies, and a network management module. The network management module is configured to receive an indication of a set of network policies to apply to the security domain, automatically determine a subset of policy enforcement points of the set of policy enforcement points are required to enforce the set of network policies based on physical network topology information readable by the network management module, wherein the physical network topology information includes information about the location of the plurality of endpoint computing resources and the set of policy enforcement points within a network, and apply the network policies to the subset of policy enforcement points in order to enforce the network policies against the set of endpoint computing resources of the security domain.

In another example, a computer-readable storage medium is encoded with instructions for causing one or more programmable processors to receive business policy graph information that defines a business policy graph of a network, wherein the business policy graph comprises a set of endpoint computing resources configured as a security domain without an indication of any policy enforcement points within the network, wherein the business policy graph is independent of a physical topology of the network, and wherein each of the set of endpoint computing resources is accessible to a user to perform a computing task. The computer-readable storage medium is further encoded with instructions for causing the one or more programmable processors to receive an indication of a set of network policies to apply to the security domain, and automatically determine a set of policy enforcement points based on physical network topology information readable by the network management system, wherein the physical network topology information includes information about the location of the set of endpoint computing resources and the set of policy enforcement points within the network. The computer-readable storage medium is further encoded with instructions for causing the one or more programmable processors to apply the network policies to the set of policy enforcement points in order to enforce the network policies against the set of endpoint computing resources of the security domain.

The techniques of this disclosure may provide one or more advantages. For example, by grouping endpoint computing resources into logical entities, e.g., security domains and sub-domains, so as to form an abstract business policy graph that is independent of the geographic location of those resources and the security devices of the locations, an administrator may not need to rely on or even understand the network topology when deploying network polices to the security domains. The administrator need not determine which policy enforcement points within the network need to be configured nor how to configure the policy enforcement points in order to enforce the network policies. Furthermore, grouping endpoint computing resources into security domains may also eliminate the need to manually define and apply network policies to each of the subnets within the network. In this manner, the techniques of this disclosure may reduce the complexity of managing network security and reduce the operational costs associated with managing the network.

DETAILED DESCRIPTION

FIG. 1is a block diagram illustrating an example enterprise network system2in which a network policy manager (“NPM”)20manages the network policies as applied various network devices located within networks10,12,14. Each of networks10,12,14may be located in a different geographic location or within different subnets of network system2. Networks10,12,14include networking equipment or devices that facilitate the transfer of data within and between networks10,12,14, such as routers, switches, gateways, and hubs. In general, Networks10,12,14enable transmission of content between networks and network devices using one or more packet-based protocols, such as an Internet Protocol/Transmission Control Protocol (IP/TCP). In this respect network10may support the transmission of data via discrete data units, often referred to as “packets.” As a result, networks10,12,14may be referred to as “packet-based” or “packet switched” networks. While described in this disclosure as transmitting, conveying, or otherwise supporting packets, networks10,12,14may transmit data according to any other discrete data unit defined by any other protocol, such as a cell defined by the Asynchronous Transfer Mode (ATM) protocol, or a datagram defined by the User Datagram Protocol (UDP).

In one embodiment, networks10,12,14include policy enforcement points (“PEPs”)24A-24C (collectively, “policy enforcement points24”) that are configured by network policy manager20to enforce network policies. An administrator (“ADMIN”)22configures network policies for network system2by interacting with network policy manager20. Network policy manager20may be a computer or other network device located within one of networks10,12,14or anywhere else within network system2such that network policy manager20may exchange network data, such as configuration information, with one or more of policy enforcement points24. Each policy enforcement point24may comprise one or more of a firewall, an intranet controller, a secure socket layer (SSL) virtual private network (VPN) gateway, a radius server, a subscriber resource device, a unified access control (UAC) device and/or any other type of networking equipment or device that may enforce network policies within networks10,12,14.

In accordance with the techniques described herein, administrator22interacts with network policy manager to define a business policy graph for network2that is independent of its particular physical network topology, i.e., that the network is organized into geographically separate networks10,12,14protected by respective PEPs24. For example, administrator22interacts with network policy manager20to define the business policy graph to include abstract security domains34,36and38, and configures network policies that are enforced against the abstract security domains without regard to physical subnets or PEPs24. The techniques of this disclosure may enable administrator22to define the network policies without knowledge of the device-specific details of the configuration when deployed to PEPs24. The network policies define, for example, the kind of traffic permitted or blocked between two different security domains or actions to be taken on the network traffic between security domains, such as if a user needs to be authenticated or if the traffic needs to be rate-limited, with out regard to which of PEPs24will be required to enforce the policies. In other examples, the policies may define which applications hosted by one or more servers within a domain may be accessed from outside a domain. In more examples, network policies may define which users may access a server, which applications a user may access, or which files or directories a user may access using, for example, a client device.

As illustrated inFIG. 1, networks10,12,14include various network devices including network devices (“ND”)26A-26D (collectively, “network devices26”), server28, and clients32A and32B (collectively, “clients32”). Network devices26include network devices connected to networks10,12,14such as personal computers, laptop computers, mobile telephones, network telephones, personal digital assistants, or another type of endpoint computing device capable of interfacing with and communicating over networks10,12,14. Server28may include email servers, domain controllers, web servers, print servers, printers, network copiers, or other network devices. In some examples, server28includes user accounts29and files30. Server28may utilize user accounts29control access to the resources of server28, such as files30, by users. Clients may include a personal computer, a laptop computer, a network telephone, a television set-top box, a video game system, a point-of-sale device, an intermediate network device, a network appliance, or any other type of device capable of interfacing with and communicating over networks10,12,14. Clients32may exchange network data with server28, e.g., client32A exchanging data with server28over a network link, execute software applications, e.g., application (“APP”)33executing on client32B, and perform other computing tasks for a user.

In accordance with the techniques of this disclosure, administrator22interacts with network policy manager20to group each of network devices26, server28, and clients32are into one or more security domains34,36,38so as to form a business policy graph that is independent of the physical topology of the network. Security domains34,36,38are logical groupings of devices or end-user computing resources within network system2, e.g., a logical grouping of one or more of network devices26, server28, clients32, user accounts29, files30, and application33. As shown in the example ofFIG. 1, security domain34includes network device26A, security domain36includes network device26B, a subset of computing resources of server28and client32A, and security domain38includes network devices26C and26D, a different subset of computing resources of server28, and client32B. The computing resources of server28include user accounts29and files30. Security domain36, for example, may include one or more of user accounts29for controlling access by client32A to one or more of files30while security domain38may include one or more different user accounts29for controlling access to server28by client32B. Administrator22defines what kind of network traffic is permitted to flow through security domains and may configure other network policy options, such as firewall policies, for the traffic passing through each security domain.

Each security domain may by further defined to include security sub-domains. In one example, network system2represents one global security domain and security domains34,36,38each represent a security sub-domain within the global security domain. A security domain having one or more sub-domains may be referred to as a “parent” security domain for the sub-domains one level below the security domain. Administrator22may configure a global network policy to apply to the global security domain and then configure different network policies for each sub-domain. A parent security domain may be a sub-domain of another security domain. That is, any number of sub-domains may exist within the global security domain and any number of levels of sub-domains may exist. For example, security domain36may include N different sub-domains where each of the N different sub-domains may have N levels of sub-domains.

Each sub-domain includes a subset of the endpoint computing resources included in the parent security domain and each sub-domain further inherits the network policies of the parent security domain. Administrator22may elect to allow certain network policies of a parent security domain to be over-ridden by a sub-domain while enforcing other network policies of the parent security domain regardless of the network policy configuration of the sub-domain. Administrator22chooses which network policies must be enforced and which network policies may be over-ridden by a sub-domain on a policy-by-policy basis.

After the administrator configures the security domains and the network policies via network policy manager20, network policy manager20determines which of policy enforcement points24need to be configured, generates device-specific configuration information for each policy enforcement point24that needs to be configured, and issues commands to the appropriate policy enforcement points24to configure each policy enforcement point24.

In this manner, the techniques of this disclosure may enable an administrator to create a logical grouping of network devices and endpoint computing resources that abstracts the network topology to enable an administrator to configure network policies without understanding device-specific configuration requirements and without respect to the physical location of the various elements included in the security domains. By utilizing these techniques, the complexity of managing network security as well as the operational costs associated with managing the network may be reduced.

FIG. 2is a block diagram illustrating and example network policy manager40that may implement the techniques of this disclosure. For purposes of illustration, network policy manager40may be described below within the context of the example network system2ofFIG. 1and may represent network policy manager20. In this example embodiment, network policy manager40includes control unit42and network interface card (“NIC”)44. Network interface card44provides a physical interface for coupling network policy manager40to a network, e.g., network10ofFIG. 1.

Control unit42provides an operating environment for executing policy distribution module46and user interface module48and for storing network policies50, security domain information52, network topology information54, and logs56. Control unit42may include one or more microprocessors (not shown inFIG. 2) that execute software instructions, such as those used to define a software or computer program, stored on a tangible computer-readable storage medium (not shown inFIG. 2). Examples of computer-readable storage media include a storage device (e.g., a disk drive, or an optical drive), or memory (such as Flash memory, random access memory or RAM) or any other type of volatile or non-volatile memory, that stores instructions to cause a programmable processor to perform the techniques described herein. Alternatively, or in addition, control unit42may comprise dedicated hardware, such as one or more integrated circuits, one or more Application Specific Integrated Circuits (ASICs), one or more Application Specific Special Processors (ASSPs), one or more Field Programmable Gate Arrays (FPGAs), or any combination of one or more of the foregoing examples of dedicated hardware, for performing the techniques described herein.

Policies50stores network policies configured by administrator22. Similarly, domains52stores security domain information configured by administrator22. Network topology54includes network topology information, such as which network devices are located within which subnets or networks of an enterprise network system, e.g., network system2ofFIG. 1. Network policy manager40may receive network topology information from administrator22. Network policy manager40may also exchange messages with devices within the network system and automatically generate network topology information based on the messages. Policies50, domains52, network topology54, and logs56may each be stored in the form of one or more tables, databases, linked lists, radix trees, or other suitable data structure.

Administrator22interacts with network policy manager40via user interface module48. For example, administrator22may utilize user interface module48to both configure security domains and network policies for network system2, illustrated inFIG. 1, and deploy the configured network policies to network system2. Example user interfaces generated by user interface module48and presented to administrator22for performing the techniques of this disclosure are illustrated inFIGS. 3-11and13-15.

In one embodiment, network policies include network address information, security domain information, application information, and network protocol information. The network address information includes a network address and may also include a name or other identifier, a description, an expiration date, e.g., valid until Jun. 29, 2014, and user configurable tags. The network address may be in the form of an Internet Protocol (“IP”) address, a host name, or a network prefix. A network prefix is a contiguous group high-order bits that are common among all hosts within a particular network that typically identifies a subnet. An example network prefix is “192.168.4.0”. In this example, the network prefix identifies a subnet of network devices each having an IP address starting with 192.168.4, such as 192.168.4.26. Each set of network address information, e.g., a network address, a name, a description, an expiration date, and tags, may be referred to as a network address object and may be grouped together to form network address object groups.

The security domain information includes a name for the security domain, a description, one or more network address objects or groups, and other properties, such as whether intra-domain traffic is permitted between network devices at different physical locations. Security domains may further abstract the physical network configuration beyond address objects. For example, a security domain may be named “HR Domain” and include all network devices within a human resources department of a company. The HR domain may include an address object that includes network address information about a subset of network devices located in London, England, a different address object that includes network address information about a subset of network devices located in New York City, N.Y., USA, and an address group that includes network address information about all of the network devices located in Sydney, Australia. When creating and deploying security policies, administrator22need only select the HR Domain to select all network devices within the human resources department of the company.

The application information includes information about application layer network protocols and other network protocols, where the application layer refers to layer 7 of the Open System Interconnection model. Example application layer protocols include Hypertext Transport Protocol (“HTTP”), Dynamic Host Control Protocol (“DHCP”), and File Transfer Protocol (“FTP”). Examples of other network protocols include Transport Control Protocol (“TPC”), Remote Copy Protocol (“RCP”), Microsoft RCP (“MS-RCP”), and Internet Control Message Protocol (“ICMP”). Each network protocol may include additional details specific to the particular protocol, such as port numbers, to provide more precise control over the portion of network traffic within each protocol that is included within the application information. The grouping of the application information for one particular application, e.g., the network protocol, the application category, the application name, the application description, and the additional details about the network protocol itself, may be referred to as an application object. Multiple application objects may be logically combined into an application group.

In another embodiment, network policies may include network address information, security domain information, and network device resource information. The network device resource information corresponds to a particular network device identified in the network address information and may include user account information, file or directory information, and/or computer program applications, for example. In one example of this embodiment, administrator22configures a particular file directory stored within a computer server as a security domain by specifying the network address of the computer server in the network address information, specifying the particular file directory in the network device resource information, and then including the network address information corresponding to the computer server within a security domain.

After administrator22configures the security domains and network policies, administrator22or another user deploys the network policies to the security domains. As further illustrated inFIGS. 13-15, administrator22first selects which policy to deploy and then may review the particular policy enforcement points24that are included in deploying the network policy. For each of the required policy enforcement points24, administrator22may elect to view only the pending configuration changes or the complete configuration. Administrator22may also preview the network paths that will be available between the security domains after the network policy is implemented. In some examples, administrator22overrides the automated system and chooses not to configure certain required policy enforcement points24because, for example, of a conflict with another, currently implemented, network policy. Administrator22may schedule the policy deployment to occur at a particular day and time.

In general, policy distribution module46deploys the network policies. In order to deploy the polices, policy distribution module46determines how to deploy the configured network policies to network system2, generates device-specific configuration information based on the configured network policies, and issues commands to one or more of policy enforcement points24to configure the policy enforcement points24in accordance with the device-specific configuration information. In order to determine how to deploy the configured network policies to network system2, policy distribution module46analyzes network policy information from network policies50, security domain information from domains52, and network topology information from network topology54. That is, policy distribution module46uses the network address information within domains52and the network topology information to determine where in network system2the network devices included in the security domain are located and then determines which of policy enforcement points24are required to enforce the network policies against those network devices.

After determining which of policy enforcement points24are required to enforce the network policies, policy distribution module46generates the device-specific configuration information for each of the required policy enforcement points24. In some examples, the device-specific configuration information includes only the configuration changes that need to be made to the required policy enforcement points24. In other examples, the device-specific configuration information includes the complete set of configuration information, including the previously configured parameters not affected by deploying the network policy. Policy distribution module46may be configured to generate updated configuration information or complete configuration information on a device-by-device basis and may generate both types of configuration information within a single policy deployment. Policy distribution module46then issues messages to the required policy enforcement points24via NIC44to configure the required policy enforcement points24, thereby deploying the network policy.

In some embodiments, server28may act as a policy enforcement point for computing resources, such as user accounts, files, and directories, within a security domain. Network topology information54may include detailed information about the resources available to each policy enforcement point, e.g., the files and directories managed by server28. In this embodiment, policy distribution module46determines how to configure server28to enforce the network policies against the selected computing resources and generates configuration information for server28. Policy distribution module46then deploys the network policy to server28by issuing commands to configure server28in accordance with the generated configuration information.

After policy distribution module46deploys the network policy to the required policy enforcement points24, the policy distribution module46notifies administrator22of the status of the policy deployment by, for example, sending administrator22an email, displaying a visual or auditory alert via user interface module48, sending a text message, or by any other means of notifying a person of the status of the policy deployment. Policy distribution module36also maintains a persistent record of policy deployment operations in logs56. Logs56includes, for example, the details of the configuration changes included in the network policy deployment, a user identifier corresponding to an administrator who deployed the network policy, the date and time the network policy was deployed, and the result status of the deployment, e.g., success or failure. Administrator22may review the information stored in logs56, via user interface module48, at any time.

Each network policy for each domain and sub-domain includes its own, separately configured set of network address information and application information, protocol information, and computing resource information, as appropriate for each embodiment. That is, changes made by administrator22to the network policies inherited by the sub-domain are not propagated to the parent security domain. However, if so configured by administrator22, changes made to the network policies of the parent security domain may propagate down to any sub-domains. Options for managing the propagation of changes to the network policies of the parent domain as well as options for managing which, if any, inherited network policies may be modified in the sub-domain are user configurable and may be enforced globally, across all domains, on or an domain-by-domain basis.

In some embodiments, if an endpoint computing resource moves to a different subnet or physical location, network policy manger40is configured to automatically update the network topology information and take one or more actions to update the affect network policy deployment. Using network system2ofFIG. 1as an example, if network device26A is moved from network10to network12, network policy manager40receives updated network topology information. Network policy manager40may actively scan the network system2to determine the current network topology or administrator22may configure network policy manager40with the network topology information.

Upon detecting a change in the network topology information, policy distribution module46determines if any of the policy enforcement points24need to be reconfigured based on the security domain information, the network policy information, and the network topology information. In some examples, a network device may move from one physical location or subnet to a different physical location or subnet without requiring any reconfiguration of the policy enforcement points. For example, in the example illustrated inFIG. 1, if network device26C is moved from network14to network12, policy enforcement points24B and24C may not require any configuration changes. However, in the example above where network device26A moves from network10to network12, network device26A is configured within its own security domain34. Therefore, policy distribution module46determines that the configuration information of policy enforcement points24A and24B needs to be updated.

In one embodiment, network policy manager40is configured to alert administrator22of the required configuration changes without taking any further action until administrator22configures network policy manager40to deploy the required configuration changes. In another embodiment, network policy manager40is configured to automatically update the policy enforcement points24upon detecting a change in network topology. In this embodiment, policy distribution module46updates the configuration of policy enforcement points24A to remove the configuration information associated with the network policies configured with respect to security domain34and causes policy enforcement point24B to be configured to enforce the network policies for security domain34.

Administrator22may also configure sub-domains via user interface module48. For example, administrator22selects a currently configured security domain, e.g., security domain36ofFIG. 1, and indicates the intent to create a sub-domain based on the selected security domain. The selected currently configured security domain may be referred to as a parent security domain to the sub-domain. Administrator22selects a subset of the network devices or endpoint computing resources included in the parent security domain. The network policies configured for the parent security domain are automatically inherited by the sub-domain. Administrator22may elect to modify the inherited network policies by, for example, adding, removing, or changing the application information on which the inherited network policies are based.

When adding or removing an endpoint computing resource, network policy manager40detects the change to the network topology and alerts administrator22. In some examples, administrator22confirms the addition or removal prior to network policy manager40performing any network policy deployment techniques. In other examples, when an endpoint computing resource is removed, network policy manager40is configured to automatically update network policy information, e.g., remove the device from the security domain or address objects, and automatically update the configuration information of the policy enforcement points, as needed. When adding an endpoint computing resource to network system, network policy manager40may be configured to perform any combination of alerting administrator22of the new endpoint computing resource, automatically adding the new endpoint computing resource to a default security domain, and applying the previously configured network policies to the new endpoint computing resource based when the network address of the new endpoint computing resource falls within an already configured security domain.

FIGS. 3-11are screen illustrations of various user interfaces for managing security domains and security policies. For purposes of illustration, each example user interface may be described below within the context of the example network system2ofFIG. 1and network policy manager40ofFIG. 2and may be generated by user interface module48of network policy manager40.

FIG. 3illustrates an example user interface60that is presented to administrator22upon selecting the “manage addresses” option within task bar62. User interface60displays currently configured address objects and address object groups in an icon-based format within display area68. Administrator may switch between icon view and grid view by selecting the corresponding option within view options64. Grid view is illustrated inFIG. 4and will be described with respect toFIG. 4.

Upon administrator22selecting an address object or group, user interface60populates the corresponding information within the address object display area72. As shown inFIG. 3, address object display area72displays address object information for a single address object. However, if administrator22selects an address object group, such as Group1, address object display area72automatically updates to display the multifile template and populates it with information from the selected address object group. Administrator22may select an address object or group and then choose to delete or modify the address object or group by selecting one of the actions within the action area74.

When more address objects and groups are configured than may be visible within address object display area68, pagination70enables administrator22to move between multiple pages and displays the current page information as well as the total number of pages. Administrator may also filter the address objects and groups or search within the set of address objects and groups by entering text into search field66. Search field66may enable administrator22to quickly find a particular address object or group without having to examine multiple pages of address object and groups.

In general, to select an element within user interface60or any subsequent user interface examples illustrated in this disclosure, administrator22may use a computer mouse, touch gestures, keyboard commands, a graphics tablet or any other type of input device capable of interacting with network policy manager40.

FIG. 4illustrates an alternative example user interface80that is presented to administrator22upon selecting the “manage addresses” option. User interface80displays currently configured address objects and address object groups in a grid, e.g., tabular, format and may provide additional information, such as a listing of all of the address objects included in a group, the type of address object, and the configured network address, to administrator22. The additional information enables administrator22to take other actions not available within the example user interface illustrated by user interface60ofFIG. 3. For example, administrator22may remove an address object from an address object group by selecting the address object and then selecting the “remove from group” action.

FIG. 5illustrates an example user interface90for creating or modifying an address object. Administrator22may reach this address object creation interface by selecting the create address option within task bar62of user interface60ofFIG. 3or by selecting an existing address object within address object display area68and then selecting modify address from action area74. When creating a new address object or modifying an existing address object, administrator22may enter a name, description, an expiration date, and various user-defined tags. Administrator22also selects the type of network address included in the address object from address type92and enters a network address corresponding to the selected network address type in network address94. The label for network address94(illustrated as “IP Address” in the example ofFIG. 5) is dynamically updated to reflect the selected address type. For example, if administrator22selects “Host Name” for address type92, the label for network address94is dynamically updated to “Host Name.”

FIG. 6illustrates an example user interface100for creating or modifying an address object group. Administrator22may reach this address object creation interface by selecting the create address group option within task bar62of user interface60ofFIG. 3or by selecting an existing address object group within address object display area68and then selecting modify address from action area74. When creating or modifying address object groups, administrator22enters a group name, description, expiration date, user-defined tags, and selects address objects and address objects groups to add or remove from the address object group being configured. That address objects and groups not included in the address object group being configured are listed within non members102. Administrator22can search or filter the address objects and group listed within non members102using the search box. Address objects and groups that are included in the address object group being configured are listed in members104. After administrator22completes configuration for the address group, administrator22selects the create button. When administrator22is modifying an existing address object group, the create button is replaced with a modified button. If administrator22no longer wants to make changes to the address object group, administrator22selects the cancel button.

FIG. 7is an example user interface110for creating or modifying a security domain. Administrator22selects a security domain object to modify from a user interface substantially similar to user interface60ofFIG. 3, which may be referred to as a manage domains user interface. The manage domains user interface is presented when administrator22selects a “manage domains” option within the task bar, e.g., task bar62ofFIG. 3. In the manage domains user interface, security domain objects are displayed in an icon or grid view and administrator22may select a security domain to modify or delete or select a create domain option to create a new security domain. When administrator22selected create domain, the example user interface110is presented. Administrator22may enter a domain name, a domain description, select previously configured network address objects or groups, and configure other properties for the security domain, such as whether or not to allow intradomain network traffic between devices within the same security domain, but located at different physical locations. When administrator22selects a domain to modify, the fields illustrated in user interface110are pre-populated with the existing configuration information for the selected security domain and the create button is replaced with a modify button. After administrator22makes the desired changes or configures a new domain, administrator22selects the modify or create button and the changes are saved to domains52of network policy manager40ofFIG. 2.

FIG. 8is an example user interface120for viewing and selecting application objects and application object groups. Similar to user interface60, the application objects and groups may be displayed in an icon view or a grid view and may be searched or filtered using a search box. Upon administrator22selecting an application object, application detail display122automatically loads the category and protocol information associated with the selected application object and displays the details to administrator22. Application detail display122may also include additional information about the selected application object, such as the name and description associated with the selected application object. In the example ofFIG. 8, application detail display122does not enable administrator22to modify the selected application object. Rather, administrator22selects the modify application action to modify the selected application object or group.

FIG. 9is an example user interface130for creating or modifying an application object. After administrator selects an application object and selects the modify application action via user interface120ofFIG. 8, for example, administrator22is presented with user interface130. When administrator22is presented with user interface130after selecting an application object and then selecting the modify action, the name, category, protocols, and description fields are dynamically populated with the information corresponding to the selected application object. Administrator22may add or remove protocols associated with application object by selecting the plus and minus elements, respectively.

Administrator22may also be presented with user interface130upon selecting the create application task from the task bar. Administrator22enters the name of the application object, category, a description, and one or more network protocols. The network protocols are entered using the add protocol element134. Administrator22selects one of application level protocol, protocol, and ICMP, for example. Add protocol element134dynamically updates based upon which option administrator22selects. As shown, administrator22selected ICMP, causing the ICMP code and ICMP type fields to be displayed by add protocol element134. If administrator22selects protocol (TCP/RCP/MS-RCP), for example, add protocol element134updates to display fields such as a source port field, a destination port field, an inactivity timeout field, an RPC program number field, and a universally unique identifier (UUID) field, as required. Administrator22may add as many different protocols to the application object as desired. After each protocol is added, the protocol is displayed in the current protocol display area132.

FIG. 10is an example user interface140for creating a network policy. Administrator22selects an endpoint, such as endpoint142, and then selects a security domain from the security domain list144. Upon selecting a security domain from the security domain list144, the description, network, and properties elements are dynamically updated with the appropriate information for the selected security domain. To associate the selected security domain with an endpoint, administrator may, for example, drag and drop the selected security domain onto the desired endpoint. In another example, administrator selects the desired endpoint and then double clicks or, in the case of touch-based input, double taps the desired security domain. Administrator22also assigns a name to the network policy and may select a default security level, e.g., low, medium, or high. In some examples, the default security level pre-populates the application objects associated with the network policy with a set of default application objects corresponding to the selected level of security.

As illustrated inFIG. 10, administrator22selects two security domains and creates a network policy to manage the network traffic between the security domains. For example where a security domain includes files or directories stored on a server and where a second security domain includes user accounts, administrator22may select these security domains to configure network access between the user accounts and the files or directories. For example, administrator configures the network policy to require that any user accounts within the security domain require authentication prior to accessing the file or directories within the other security domain. In other examples, administrator22may select a single security domain and create a network policy that manages the network data being sent and received by the computer resources included in the security domain. Examples of how the network policy manages network data include restricting the permitted network data being sent or received or by requiring authentication or encryption prior to permitting network data from being sent or received.

FIG. 11is an example user interface150for configuring general settings and application objects of a network policy being created or modified by administrator22. In one example, administrator22selects a set of actions to be taken when network data being processed by a policy enforcement point meets one of the criteria defined by the application objects or groups included in the network policy. The set of actions may be referred to as an action profile. In the example action profile152, administrator selects and configures log count and log alert settings. Administrator22adds application objects and groups via applications interface154. For example, by selecting the plus button, administrator22is presented with an application object and group selection interface (not shown) and selects the applicant object or group to add to the network policy. Administrator22also configures whether to allow or deny the network data affected by the application object, e.g., allow or deny http network data when the application object includes an http application layer protocol. Upon completing the configuration of the network address objects, application objects, security domains, and network policies, administrator22may then deploy the network policies to the network, e.g., network system2ofFIG. 1.

FIG. 12is a flow chart illustrating an example method for deploying network policies in a manner consistent with the techniques described in this disclosure. For purposes of clarity, the method shown inFIG. 12will be described with respect to the network system2ofFIG. 1and the network policy manager40ofFIG. 2. User interface module48ofFIG. 2generates user interfaces to guide administrator22through the policy deployment workflow. Example user interfaces generated by user interface module48of network policy manager40that may be used by administrator22to deploy network policies are illustrated inFIGS. 13-15. Administrator22selects a pre-configured network policy to deploy (160). The network policies may include both network policies configured by administrator22or another administrator as well as default network policies configured by a device manufacturer, for example.

After selecting a network policy to deploy, administrator22reviews the policy enforcement points24that will be modified upon network policy deployment (162). Policy distribution module46automatically determines which policy enforcement points are required to deploy the selected network policies based on the security domains included in the network policies and network topology information54. Administrator may refine the policy enforcement points on which the network policies will be deployed by, for example, deselecting one or more policy enforcement points, thereby excluding them from receiving the updated configuration information corresponding to the network policy being deployed.

Administrator22may also choose to review the pending complete device configuration for each policy enforcement point (164). The pending complete device configuration includes the complete configuration for each policy enforcement point, including the pending changes required to deploy the selected network policy and any other device configuration parameters for each policy enforcement point. Administrator22is also given the option to view just the proposed configuration changes for each policy enforcement point (166).

Administrator22then schedules the network policy deployment (168) by, for example, selecting a day or time for policy distribution module46to deploy the network policy. Administrator22may elect to distribute the network policy at some future date and time or administrator may elect to immediately deploy the network policy. In either instance, policy distribution module46deploys the network policy (170) by, for example, generating the device-specific configuration information for each policy enforcement point that requires an updated configuration to deploy the network police and then issuing commands to configure each policy enforcement point in accordance with the generated configuration information. After completing the network policy deployment (170), network policy manager40determines the status of the deployment and notifies administrator of the success or any failures that occurred in deploying the network policy (172). Network policy manager may notify administrator in a variety of manners including, for example, a visual and/or auditory alert, an email message, a text message, or an automated telephone call.

FIGS. 13-15are screen illustrations of various user interfaces for deploying security policies. For purposes of illustration, each example user interface may be described below within the context of the example network system2ofFIG. 1and network policy manager40ofFIG. 2and may be generated by user interface module48of network policy manager40.

FIG. 13is an example user interface180generated by user interface module48and presented to administrator22to facilitate the selection of a network policy to deploy. Administrator22selects a policy and then may either immediately deploy the selected policy, without first reviewing the policy, by selecting the deploy button or administrator22may review the policy and any corresponding configuration changes prior to deploying the policy by selecting the next button.

FIG. 14is an example user interface190for reviewing the policy enforcement device that will be affected by deploying the selected network policy. The device list is automatically populated by policy distribution module46. Policy distribution module46determines which policy enforcement devices to include in the list of affected devices by analyzing the network topology information of network topology54and the security domain information for each security domain included in the selected network policy. In some embodiments, policy distribution module46also examines the proximity to the endpoint computing resources included in the security domain, the policy enforcement point platform, e.g., the type of hardware and software installed on each policy enforcement point, and the software licenses installed on each policy enforcement point. Administrator22may remove a policy enforcement point from being included in the policy deployment by, for example, un-checking the box next to the policy enforcement point's name in the device list. Administrator22may also choose to distribute the network policy rules across one or more devices. In the example illustrated in user interface190, administrator22deselected Device3and expanded the display for Device2to show how Device to will be configured after the selected network policy is deployed.

FIG. 15is an example user interface200for viewing the pending changes, e.g., the differences in configuration for each device between the previous device configuration and the device configuration required to deploy the selected network policy. Administrator22may collapse or expand the pending configuration information for each device by selecting the +/−button next to each device name or by selecting the device name itself. If administrator22decides to deploy the selected network policy, administrator selects the deploy button and then selects the deployment date and time (not show). Policy distribution module46then deploys the selected network policy at the selected date and time by configuring each of the selected policy enforcement devices based on the selected network policy.

FIG. 16is a conceptual diagram illustrating relationships between tables in a database system200that may be used to store network policy and security domain information. Each element represents a table in database system200and each arrow indicates an relationship between the tables. For example, the PolicySetEnt table202includes a description and name field for each policy and is related to the PolicyOneEnt table204. The PolicyOneEnt table204stores an indication as to whether the network policy applies to both sent and received network data using a Boolean field, e.g., is BiDirectional. The PolicyOneEnt table204is related to both the Rule Ent table206and the SecurityDomainEn table212. RuleEnt table206links the network policy with application objects, e.g., ApplicationEnt table214and Application ProtocolEnt table218, and with the user configured settings for the network policy, e.g., PolicySettingsEnt table208and LogSettingsEnt220. While illustrated with only a log settings table, a variety of different policy settings may be configured for each network policy, such as administrator alert settings. SecuirtyDomainEn table212links the network address objects stored in AddressEnt table216and the network address group information stored in AddressGroupEn table210with the network policy.

Although illustrated for purposes of example as a relational database, database system200may store data in a variety of forms including data storage files, one or more database management systems (DBMS) executing on one or more servers, or combinations thereof. The database management systems may be a relational (RDBMS), hierarchical (HDBMS), multidimensional (MDBMS), object oriented (ODBMS or OODBMS) or object relational (ORDBMS) database management systems. database system200may store data, for example, within a single relational database such as SQL Server™ from Microsoft Corporation.

In this manner, the techniques of this disclosure may enable an administrator to create a logical grouping of network devices and endpoint computing resources that abstracts the network topology to enable an administrator to configure network policies without understanding device-specific configuration requirements and without respect to the physical location of the various elements included in the security domains. By utilizing these techniques, the complexity of managing network security as well as the operational costs associated with managing the network may be reduced.