# US 11,122,091 B2 · Network security and management system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,091 B2 - Document ID: US11122091B2 - Status: Granted - Kind: B2 - Application number: 16/385,665 - Filed: 2019-04-16 - Published: 2020-10-22 - Granted: 2021-09-14 - Earliest claimed: 2019-04-16 - Assignees: FireMon, LLC - Applicants: FireMon, LLC - Inventors: Jeremy Ned Martin; Matthew R. Dean; Timothy R. Garrett; Sean Michael Mills; Lindsay V. Brechler; Jason Wendel; Hugh D. Brown; Patrick G. Clark; Joseph P. Brazil, Jr. - Web page: https://patentgrep.com/patent/US11122091B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 41/12: Discovery or management of network topologies - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L 61/256: NAT traversal - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/0263: {Rule management} - H04L 61/2514: between local and global IP addresses - H04L 61/2517: using port numbers - H04L 61/4511: using domain name system [DNS] - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for managing network security for a plurality of networks. Each of the networks comprises one or more networked devices, and each of the networks includes one or more security devices configured to monitor data traffic into and out of the networks. Abstracted access rules are created to define access between the networked devices. Each of the access rules are compiled into a security rule that uses object definitions of the networked devices to define access between the networked devices. The security rules are compiled and transmitted to the security devices for implementation. ## Claims ### Claim 1 A system for managing network security, said system comprising: a plurality of networks, each comprising one or more networked devices; a plurality of security devices configured to monitor data traffic into and out of the plurality of networks; and a computing device in communication with the plurality of security devices, the computing device comprising at least one processing element and at least one memory element, the at least one processing element configured to execute a computer program stored in the at least one memory element such that the computing device is configured to: (a) import device configuration data into a management system from the plurality of security devices, wherein the device configuration data comprises network topologies for the plurality of networks, wherein the network topologies include object definitions for the networked devices included in the plurality of networks, (b) create an abstracted asset definition for the networked devices of the plurality of networks, with each asset definition comprising an alphanumeric identifier corresponding with an object definition of the respective networked device, (c) create one or more abstracted access rules, wherein the access rules implement access requirements that define intentions for communication between the networked devices included in the plurality of networks, and wherein the access rules incorporate the asset definitions within the access rules such that the access rules define access between the abstracted asset definitions of the networked devices included in the plurality of networks, wherein the access requirements are provided by a user of the management system to define the intentions for communication between the networked devices included in the plurality of networks, (d) compile each of the access rules into one or more security rules, wherein the security rules use the object definitions to define access between the networked devices included in the plurality of networks, (e) identify for each security rule, which security device from the plurality of security devices is responsible for monitoring data traffic between the networked devices defined in the security rule, (f) transmit the one or more security rules to the security devices identified in step (e). ### Claim 2 (depends on 1) The system of claim 1, wherein the plurality of security devices comprise firewalls. ### Claim 3 (depends on 1) The system of claim 1, wherein the one or more security rules comprise firewall rules. ### Claim 4 (depends on 1) The system of claim 1, wherein the networked devices included in the plurality of networks comprise networked computing devices that include processing elements for processing the data traffic. ### Claim 5 (depends on 1) The system of claim 1, wherein the device configuration data further comprises security policies for the plurality of security devices. ### Claim 6 (depends on 1) The system of claim 1, wherein the one or more security rules comprise updated security rules, and wherein the device configuration data further comprises previously-implemented security rules. ### Claim 7 (depends on 1) The system of claim 1, wherein the object definitions of the networked devices included in the plurality of networks comprise internet protocol (IP) addresses. ### Claim 8 (depends on 1) The system of claim 1, wherein the access rules comprise a first asset definition as a source and a second asset definition as a destination. ### Claim 9 (depends on 8) The system of claim 8, wherein the access rules further comprise an abstracted service definition indicative of a communication protocol used for access between the source and the destination. ### Claim 10 (depends on 8) The system of claim 8, wherein the access rules further comprise an action indicative of whether the access between the source and the destination is allowed or denied. ### Claim 11 (depends on 1) The system of claim 1, wherein for the security devices identified in step (e), the computing device is further configured to determine whether network address translations (NATs) are applicable for the identified security devices. ### Claim 12 (depends on 1) The system of claim 1, wherein the computing device is further configured to format the one or more security rules according to command structures and/or syntaxes required for implementation by the plurality of security devices. ### Claim 13 (depends on 1) The system of claim 1, wherein the computing device is configured to import device configuration data from the plurality of security devices on a periodic basis. ### Claim 14 (depends on 1) The system of claim 1, wherein the computing device is configured to transmit the one or more security rules to the identified security devices on a periodic basis. ### Claim 15 (depends on 1) The system of claim 1, wherein one or more of the plurality of networks comprise local area networks. ### Claim 16 (depends on 1) The system of claim 1, wherein the computing device is in communication with the plurality of security devices via a communications network. ### Claim 17 (depends on 16) The system of claim 16, wherein the communications network comprises a wide area network. ### Claim 18 (depends on 1) The system of claim 1, wherein the computing device is in communication with the plurality of security devices via one or more application programming interfaces (APIs). ### Claim 19 (depends on 1) The system of claim 1, wherein the access rules comprise one or more tags, wherein each tag comprises two or more asset definitions. ### Claim 20 (depends on 1) The system of claim 1, wherein the computing device is further configured to receive, from a user of the management system, updated abstracted access rules configured to implement update access requirements. ### Claim 21 A computer-implemented method for performing network security management for a plurality of networks, each comprising one or more networked devices, wherein each of the networks includes one or more security devices configured to monitor data traffic into and out of the plurality of networks, said method comprising the steps of: (a) importing device configuration data into a management system from the plurality of security devices, wherein the device configuration data comprises network topologies for the plurality of networks, wherein the network topologies include object definitions for the networked devices included in the plurality of networks; (b) creating an abstracted asset definition for the networked devices of the plurality of networks, with each asset definition comprising an alphanumeric identifier corresponding with an object definition of the respective networked device; (c) creating one or more abstracted access rules, wherein the access rules implement access requirements that define intentions for communication between the networked devices included in the plurality of networks, and wherein the access rules incorporate the asset definitions within the access rules such that the access rules define access between the abstracted asset definitions of the networked devices included in the plurality of networks, wherein the access requirements are provided by a user of the management system to define the intentions for communication between the networked devices included in the plurality of networks; (d) compiling each of the access rules into one or more security rules, wherein the security rules use the object definitions to define access between the networked devices included in the plurality of networks; (e) identifying for each security rule, which security device from the plurality of security devices is responsible for monitoring data traffic between the networked devices defined in the security rule; and (f) transmitting the one or more security rules to the security devices identified in step (e). ### Claim 22 (depends on 21) The computer-implemented method of claim 21, further including the step of comparing each of the created access rules with a set of compliance rules to determine if the access rules are appropriate for implementation. ### Claim 23 (depends on 21) The computer-implemented method of claim 21, further including the step of comparing each security rule with the device configuration data to determine if new or modified security rules should be transmitted to the security devices identified in step (e). ### Claim 24 A non-transitory computer-readable storage medium with an executable program stored thereon for performing network security management for a plurality of networks, each comprising one or more networked devices, wherein each of the networks includes one or more security devices configured to monitor data traffic into and out of the plurality of networks, wherein when the program is executed by a processor, the processor is configured to: (a) import device configuration data into a management system from the plurality of security devices, wherein the device configuration data comprises network topologies for the plurality of networks, wherein the network topologies include object definitions for the networked devices included in the plurality of networks; (b) create an abstracted asset definition for the networked devices of the plurality of networks, with each asset definition comprising an alphanumeric identifier corresponding with an object definition of the respective networked device; (c) create one or more abstracted access rules, wherein the access rules implement access requirements that define intentions for communication between the networked devices included in the plurality of networks, and wherein the access rules incorporate the asset definitions within the access rules such that the access rules define access between the abstracted asset definitions of the networked devices included in the plurality of networks, wherein the access requirements are provided by a user of the management system to define the intentions for communication between the networked devices included in the plurality of networks; (d) compile each of the access rules into one or more security rules, wherein the security rules use the object definitions to define access between the networked devices included in the plurality of networks; (e) identify for each security rule, which security device from the plurality of security devices is responsible for monitoring data traffic between the networked devices defined in the security rule; and (f) transmit the one or more security rules to the security devices identified in step (e). ### Claim 25 (depends on 24) The non-transitory computer-readable storage medium of claim 24, wherein the processor is further configured to compare each of the created access rules with a set of compliance rules to determine if the access rules are appropriate for implementation. ### Claim 26 (depends on 24) The non-transitory computer-readable storage medium of claim 24, wherein the processor is further configured to compare each security rule with the device configuration data to determine if new or modified security rules should be transmitted to the security devices identified in step (e).