Patent ID: 8028334

Claim:
A firewall rule generation method for an Information Technology (IT) system, said method comprising: providing a list L X of I computers X i (i=1, 2, . . . I), said I being at least 2; providing a list L S of J software components S ij (j=1, 2, . . . , J) installed on computer X i , said J being a function of i and J is at least 1, each software component of the J software components independently adapted to transmit and/or receive data in accordance with a data communication protocol; providing a list L P of M ports P ijm (m=1, 2, . . . , M) on which software component S ij is listening, said M being a function of i and j and M is at least 1; providing a list L Y of N clients Y ijmn (n=1, 2, . . . , N), said N being a function of i, j, and m and N is at least 1; computer X i and client Y ijmn configured to have data transmitted therebetween; for data transmission between each computer X i (i=1, 2, . . . I) on the list L X and each associated client Y ijmn (n=1, 2, . . . , N; m=1, 2, . . . , M; j=1, 2, . . . , J) on the list L Y : a processor of a computer system generating at least one firewall rule allowing said data transmission between X, and Y ijmn if an Internet Protocol (IP) address (IPAddrX i ) of computer X, and an IP address (IPAddrY ijmn ) of client Y ijmn are not on a same subnet of the IT system, wherein for each firewall rule of the at least one firewall rule that allows data transmission from X i to Y ijmn the source component of said each firewall rule comprises IPAddrX i and the destination component of said each firewall rule comprises IPaddrY ijmn , and wherein for each firewall rule of the at least one firewall rule that allows data transmission from Y ijmn to X i the source component of said each firewall rule comprises IPAddrY ijmn and the destination component of said each firewall rule comprises IPAddrX i , and generating a first communication protocol wrapper that opens a Transmission Control Protocol (TCP) connection between a first client on the list of clients and a first computer on the list of computers, the first computer having a port not allowed by a security policy and being used by a software component installed on the first computer.