Patent ID: 12224980

DETAILED DESCRIPTION

Aspects of the present disclosure involve a firewall controller that dynamically configures and automatically applies firewalls in a network in order to control network data traffic to and from devices in the network. Generally speaking, a firewall is an appliance (a dedicated combination of hardware and software) running on a device that performs other functions. The firewall is designed to control the flow of network traffic (e.g., Internet Protocol (IP) traffic) to or from a network. Typically, firewalls are used to examine network traffic and enforce firewall “policies” based on rules contained within a ruleset of the firewall. For example, firewalls are often used to combat malicious activities and assaults on computing resources and network-accessible information. A firewall policy represents as set of rules and/or instructions that identify how a firewall should behave. In some instances, a firewall may implement a policy with a set of rules, and in other instances, a firewall may implement a set of policies that are highly complex involving thousands of rules. In the telecommunication services context, firewall policies may further describe network traffic behaviors based upon business needs. Polices articulate both what network traffic is to be controlled and how such traffic is to be controlled.

In various embodiments, the dynamic firewall controller automatically manages and allocates policies of the firewall, such that the system is flexible and efficient. Initially, the dynamic firewall controller may provide access to an initial set of network “services” corresponding to a particular customer, via a web portal, interactive interface(s), graphical-user interface(s), and/or the like (referred to herein as “Portal”). Generally speaking, a network “service” represents a discrete piece of functionality that performs or otherwise implements a particular network function. Such functions may include data center services, Ethernet, managed dedicated fiber(s), private line(s), secure internet services, virtual private LANs, among others. In some embodiments, each network function may be or otherwise involve a standardized interface that is implemented independent of the underlying functionality and/or data. Customers may interact with the Portal to initiate a request to the dynamic firewall controller that defines and implements firewall policies.

FIG.1illustrates an example computing network100for dynamically configuring and automatically applying firewall policies to manage network data traffic, according to one embodiment. The computing network100may be an IP-based telecommunications network, the Internet, an intranet, a local area network, a wireless local network, a content distribution network, or any other type of communications network, as well as combinations of networks. For example, in one particular embodiment, the network100may be a telecommunications network including fiber-optic paths between various network elements, such as servers, switches, routers, and/or other optical telecommunications network devices that interconnect to enable receiving and transmitting of information between the various elements as well as users of the network.

The computing network100includes a dynamic firewall controller102, which may be a processing device that functionally connects (e.g., using communications network100) to one or more client devices104-110included within the computing network100. A user interested in defining a firewall policy may interact with one or more client device(s)104-110to initiate a request, which may be received by dynamic firewall controller102. More particularly, the one or more client device(s)104-110may also include a user interface, such as a browser application, to generate a request for dynamically configuring firewalls and/or firewall policies. In response, the dynamic controller102may transmit instructions that may be processed and/or executed to generate, or otherwise display, a Portal for defining the firewall policies and/or configuring firewalls. The one or more client devices104-110may be any of, or any combination of, a personal computer; handheld computer; mobile phone; digital assistant; smart phone; server; application; and the like. In one embodiment, each of the one or more client devices104-110may include a processor-based platform that operates on any suitable operating system, such as Microsoft® Windows®, Linux®, and/or the like that is capable of executing software.

In some embodiments, firewall configurations and policies, accessible and definable through the Portal may be driven by a resource database103and/or a customer database105. Stated differently, the resource database103may store firewall polices as database records having fields that reference specific firewall configurations. Accordingly, the resource database103may store or otherwise maintain configurations for specific network services corresponding to a particular customer currently receiving services from a telecommunication service provider and for which a firewall is required. Stated differently, the resources database103and/or the customer database105stores information identifying specific customers and the specific network services they are currently being consumed by a customer from the telecommunications service provider. For example, the customer database105may contain information uniquely identifying customer A. The resource database103may include information (capable of being cross-referenced with the customer data in the customer database105) indicating that a customer “A” is currently purchasing two network services including: 1) data center services that enable 24/7 secure data access to proprietary content and media; and 2) content delivery services that provide the proprietary content to users. Thus, the resource database103stores information that identifies customer A, as well as information that articulates the specific configurations for the data center services and content delivery services, including any initial firewall policy configurations required to effectively and securely provide the services.

In one embodiment, the resources database103may further include information required to configure subnets, such as an internet protocol address, an Internet protocol subnet mask, an internet protocol default gateway, a domain name system (DNS) server, and a dynamic host configuration protocol (DHCP) server. A subnet is a network of computing devices that is part of a larger network, such as the Internet. For example, a subnet may include all the computing devices of a particular organization that are maintained in a certain geographic location, or all of the computing devices of the particular organization that are in the same local area network (i.e., the subnet). Having a subnet allows the organization to access the Internet with a single shared network address.

Referring generally again toFIG.1, the dynamic firewall controller102may process any input defining firewall policies passed from the Portal to the dynamic firewall controller102and automatically configure various aspects of a firewall. The dynamic firewall controller102may also take threat inputs from threat intelligence systems (e.g., the “reputation” system at Level (3) @), dynamically generate proper firewall policies, and automatically configure the firewall polices for customers who subscribe to threat protection service. More specifically, the dynamic firewall controller102may automatically make one or more application programming interface (“API”) calls to a network configuration systems engine (“NCS”)112and/or a firewall configuration system engine (“FCS”)114. The NCS112includes logic for configuring various aspects of the routers and switches of a subnet (or otherwise) that may require configuration in accordance with the firewall policy. For example, if the firewall policy involves a subnet, the firewall policy may include configurations for router that defines an Address, network ID, subnet ID, subnet mask, and the like, any of which may be needed to manage network traffic to and from the subnet. In other embodiments, the NCS112may configure firewall devices directly.

The FCS114includes logic for configuring various aspects of any firewalls that require configuration. Accordingly, the APIs include or otherwise define various routines and protocols for performing various activities at the NCS112and the FCS114to configure firewalls of the devices in the clouds, or other networks122(illustrated as devices in cloud network(s)122). In some embodiments, the dynamic firewall controller102may queue any requests received to define and/or otherwise configure a firewall policy in a dynamic scheduler116. For example, if a customer is interested in only implementing a firewall policy for a given period of time, or interested in implementing a firewall policy at, or for, a specific period of time (e.g., a time window during which the firewall policy is applicable), the requests may be maintained in a queue at the dynamic scheduler116and automatically passed to the dynamic firewall controller102at the appropriate time for processing.

FIG.2provides an illustrative example of a cloud computing network200containing devices for which firewall policies may be defined and implemented to control to network data traffic, according to one embodiment. The illustrated embodiment will be described in the context of a telecommunication service provider providing network services to a business enterprise referred to as a “customer”. Assume a customer has three branch locations: one in Denver, Colorado, one in Chicago, Illinois, and one in New York City, New York. In the illustrated embodiment, the branches are configured into multiple and separate subnets204,206, and208with firewall protections210,212,214, and216. To enable communication between the various subnets204,206, and208, the customer purchased VPN services and Ethernet from the telecommunications service provider211. Each subnet204,206, and208, includes firewall(s) to manage network traffic between the subnets204,206, and208. For example, the subnet204may correspond to the customer's human resources computing systems (e.g., hardware and/or software), the subnet206may correspond to the customer's engineering computing resources, and the subnet208may correspond to the customer's customer sales data and management computing resources.

At some point, the customer may want to implement a firewall policy (e.g., network layer policies) that describes network traffic behaviors between the subnets204,206, and208, based upon business needs of the customer. For example, the customer may want to implement a firewall policy that states that subnet206corresponding to the engineering office and related computing systems should not access resources of subnet204corresponding to the customer's human resources and computing systems. Stated differently, the customer may implement a firewall policy that blocks network traffic from subnet206to subnet204or otherwise limits traffic by specifying a limited set of connections. As another example, the resources with each subnet204,206, and208may be equipped to detect threats and other malicious activity for network traffic coming from a particular domain, external to the subnets, such as a malicious domain218. Upon detection of the threat and/or malicious activity, the customer may want to be able to dynamically implement a firewall policy that blocks all network traffic coming from the domain. Alternatively, the customer may implement a firewall policy that re-routes the detected traffic to a predetermined network, such as a honeynet, for analysis or other actions. To manage such firewall configurations, the customer may interact with the client devices104-110(illustrated inFIG.1) to access the Portal and provide firewall policy configurations to the dynamic firewall controller102. For example, the customer may interact with the client devices104-110to implement configurations that automatically block traffic from the malicious domain.

Referring now toFIG.3and with reference toFIG.1, an illustrative process300to dynamically configure and automatically apply firewall policies to manage network data traffic is provided. As illustrated, process300begins with receiving input defining a firewall policy for a subnet of network devices currently deployed within a communications network (operation302). Referring toFIG.1, a graphical user-interface, accessible through a browser at a client device, may be generated, initialized, or otherwise in communication with the dynamic firewall controller102. Subsequently, the dynamic firewall controller102may access the customer information that identifies one or more of the network services and corresponding computing components currently being provided to the customer and integrate such information within the graphical user-interface, along with any current or available firewall configurations. The graphical user-interface may be provided for display to the one or more client devices104-110. Stated differently, the graphical user-interface may provide various components, buttons, menus, and/or other functions to help the user identify configurations for various network and/or telecommunication services currently being provided to the customer and thereby allow the customer to provide input defining the firewall policy. In some embodiments, referring toFIG.1, external APIs117provided by the dynamic firewall controller102may be used by customers or other applications to trigger firewall policy change inputs.

In various embodiments, a user may provide input for a firewall policy that relates to one or more ports, communication protocols, or services, among other alternatives that describe how network traffic may be managed. For example, such input may include one or more source IP addresses, destination IP addresses, source ports, destination ports, and/or protocols that may be used to match/filter incoming traffic. In a specific example, the firewall policy may require a particular port be blocked. The firewall policy may open a specific series of ports to enable various computing components of a subnet to communicate with a network service using the ports. As yet another example, the firewall policy may block a port, adjust a communication protocol, apply one or more security settings, enable or disable a service, or any combination thereof. The policies and configurations may be applicable to a network, such as a subnet, or a network device for a particular period of time.

In other embodiments, the NCS112and/or the FCS114may detect environment changes within a subnet (e.g., changes resulting from one or more devices being connected/disconnected or upgraded) and dynamically update the firewall configuration based on the detected environment changes.

Referring again toFIG.3, the received input is automatically processed to implement the policy at a firewall(s) and/or corresponding network components of the subnet without interruption to the various devices within the subnet and/or without telecommunication service interruption at the subnet (or elsewhere) (operation304). Referring toFIG.1, the input is provided to the NCS112and/or the FCS114, either of which automatically implement the configurations at the various devices corresponding to a customer. In one embodiment, the dynamic firewall controller102makes application programming interface (“API”) calls to the NCS112and/or the FCS114to push firewall policies to various network elements included in the subnet. In other embodiments, the NCS112and/or the FCS114may automatically invoke specific processes that correspond to specific network elements and/or devices included within the subnet to configure firewall policies.

In some embodiments, before implementing the firewall policy changes, the configurations included in the policy may be validated and/or otherwise verified against erroneous and/or illogical automatic configuration changes based on the type changes being made to a particular subnet and/or devices within the subnet. For example, the NCS112may perform so-called “dry runs” to check and validate proposed firewall policy changes against a set of known rules without making actual changes on network elements. Stated differently, during a dry-run, the NCS112may execute instructions which, under normal circumstances, would implement permanent firewall policy changes to the network elements and/or devices. However, during the dry-run, no changes are actually implemented at the network elements. Instead, data corresponding to the execution of the firewall policy change instructions is captured and analyzed to validate that the proposed firewall policy changes would be implemented as expected at the network elements and/or devices of the subnet. In other embodiments, the NCS112may execute the proposed firewall policy changes against replicated virtual devices to simulate the changes in a virtual environment. More specifically, a virtual environment that includes the same network elements of the subnet, all of which emulate the function of the devices in the subnet may be provisioned. Subsequently, the proposed firewall policy changes may be executed by the NCS112and within the virtual environment to determine how the proposed changes would affect the network elements and/or devices and overall subnet. Under either circumstance, the proposed firewall policy changes may be validated before being implemented at applicable network elements and/or network devices.

Referring again toFIG.3, the newly configured firewall is initialized and/or activated in accordance with the new configurations and subsequently used to manage network traffic to and from the network components of the subnet (operation306). More specifically, the dynamic firewall controller automatically begins to manage network traffic to and from the subnets204,206and208to ensure network traffic is in compliance with the updated firewall policy.

FIG.4illustrates an example of a suitable computing and networking environment400that may be used to implement various aspects of the present disclosure described inFIG.1-3. As illustrated, the computing and networking environment400includes a general purpose computing device400, although it is contemplated that the networking environment400may include one or more other computing systems, such as personal computers, server computers, hand-held or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, digital signal processors, state machines, logic circuitries, distributed computing environments that include any of the above computing systems or devices, and the like.

Components of the computer400may include various hardware components, such as a processing unit402, a data storage404(e.g., a system memory), and a system bus406that couples various system components of the computer400to the processing unit402. The system bus406may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. For example, such architectures may include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus.

The computer400may further include a variety of computer-readable media408that includes removable/non-removable media and volatile/nonvolatile media, but excludes transitory propagated signals. Computer-readable media408may also include computer storage media and communication media. Computer storage media includes removable/non-removable media and volatile/nonvolatile media implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules or other data, such as RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that may be used to store the desired information/data and which may be accessed by the computer400. Communication media includes computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. For example, communication media may include wired media such as a wired network or direct-wired connection and wireless media such as acoustic, RF, infrared, and/or other wireless media, or some combination thereof. Computer-readable media may be embodied as a computer program product, such as software stored on computer storage media.

The data storage or system memory404includes computer storage media in the form of volatile/nonvolatile memory such as read only memory (ROM) and random access memory (RAM). A basic input/output system (BIOS), containing the basic routines that help to transfer information between elements within the computer400(e.g., during start-up) is typically stored in ROM. RAM typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit402. For example, in one embodiment, data storage404holds an operating system, application programs, and other program modules and program data.

Data storage404may also include other removable/non-removable, volatile/nonvolatile computer storage media. For example, data storage404may be: a hard disk drive that reads from or writes to non-removable, nonvolatile magnetic media; a magnetic disk drive that reads from or writes to a removable, nonvolatile magnetic disk; and/or an optical disk drive that reads from or writes to a removable, nonvolatile optical disk such as a CD-ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media may include magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The drives and their associated computer storage media, described above and illustrated inFIG.4, provide storage of computer-readable instructions, data structures, program modules and other data for the computer400.

A user may enter commands and information through a user interface410or other input devices such as a tablet, electronic digitizer, a microphone, keyboard, and/or pointing device, commonly referred to as mouse, trackball or touch pad. Other input devices may include a joystick, game pad, satellite dish, scanner, or the like. Additionally, voice inputs, gesture inputs (e.g., via hands or fingers), or other natural user interfaces may also be used with the appropriate input devices, such as a microphone, camera, tablet, touch pad, glove, or other sensor. These and other input devices are often connected to the processing unit402through a user interface410that is coupled to the system bus406, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A monitor412or other type of display device is also connected to the system bus406via an interface, such as a video interface. The monitor412may also be integrated with a touch-screen panel or the like.

The computer400may operate in a networked or cloud-computing environment using logical connections of a network interface or adapter414to one or more remote devices, such as a remote computer. The remote computer may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer400. The logical connections depicted inFIG.4include one or more local area networks (LAN) and one or more wide area networks (WAN), but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

When used in a networked or cloud-computing environment, the computer400may be connected to a public and/or private network through the network interface or adapter414. In such embodiments, a modem or other means for establishing communications over the network is connected to the system bus406via the network interface or adapter414or other appropriate mechanism. A wireless networking component including an interface and antenna may be coupled through a suitable device such as an access point or peer computer to a network. In a networked environment, program modules depicted relative to the computer400, or portions thereof, may be stored in the remote memory storage device.

The foregoing merely illustrates the principles of the disclosure. Various modifications and alterations to the described embodiments will be apparent to those skilled in the art in view of the teachings herein. It will thus be appreciated that those skilled in the art will be able to devise numerous systems, arrangements and methods which, although not explicitly shown or described herein, embody the principles of the disclosure and are thus within the spirit and scope of the present disclosure. From the above description and drawings, it will be understood by those of ordinary skill in the art that the particular embodiments shown and described are for purposes of illustrations only and are not intended to limit the scope of the present disclosure. References to details of particular embodiments are not intended to limit the scope of the disclosure.