Patent ID: 7882229

Claim:
A computer program product for managing a security policy for a multiplicity of networks, said computer program product comprising: a computer readable storage device(s); first program instructions to record, for each of said multiplicity of networks, (a) a type of said each network, (b) whether said each network is a source and/or a destination network, and (c) a list of IP protocol(s) supported by said each network; second program instructions to record, for said each network, a multiplicity of permitted message flows for which a firewall for said each network is configured, each of said permitted message flows comprising a combination of IP protocol, destination network and source network; third program instructions to automatically identify a multiplicity of possible combinations of said multiplicity of networks, wherein each of said possible combinations comprises a source network and a destination network; fourth program instructions to automatically determine, based on a type of said each network, a subset of said possible combinations, each of said possible combinations in said subset comprising two networks which are permitted to communicate with each other based on the respective types of said two networks; fifth program instructions to automatically determine, for each of said possible combinations in said subset, (a) what IP protocol(s) are supported by said networks in said each possible combination in said subset, and (b) whether respective firewalls for said networks in said each possible combination in said subset permit message flows having IP protocols supported by said networks in said each possible combination of said subset; and sixth program instructions, based on determinations by both said fourth and fifth program instructions, to automatically determine which combinations of said multiplicity of networks comprise networks which are both (a) entitled to communicate with each other based on types of networks within each combination of said multiplicity of networks and (b) able to communicate with each other based on IP protocols supported by networks in each combination of said multiplicity of networks and IP protocols of permitted message flows through a firewall(s) for networks in each combination of said multiplicity of networks; and wherein said first, second, third, fourth, fifth and sixth program instructions are stored on said computer readable storage device(s).