Laying out security zone policies for information technology and operational technology devices on hybrid networks
AssigneeFortinet, Inc.
InventorAasef Iqbal
Life of this patent
Estimating the term…
Abstract
From deep packet inspection, it is determined whether each of the plurality of network devices is part of the IT segment or the OT segment by examining a physical network address, a data type and a network protocol of one or more of the network packets. A network hierarchy is dynamically generated that maps the IT segment with interconnected IT levels having IT devices relative to the OT segment with interconnected OT levels having OT devices. A plurality of security zones is set up from the IT layout and the OT layout. Each of the plurality of security zones has a corresponding one or more security zone policies. The network hierarchy is output and overlaid with the plurality of security zones for display to a user.
Claims16
A computer-implemented method in network segmentation firewall in a hybrid enterprise network, wherein the hybrid enterprise network includes an information technology (IT) segment and an operational technology (OT) segment, for automatically laying out security zone policies for IT and OT devices, the method comprising:
- performing deep packet inspection on network packets to identify a plurality of network devices within the hybrid enterprise network;
- determining whether each of the plurality of network devices is part of the IT segment or the OT segment by examining a physical network address, a data type and a network protocol of one or more of the network packets, wherein the IT segment has multiple levels and the OT segment has multiple levels;
- laying out IT devices within the IT levels of the IT segment, and identifying each IT device connection to a conduit between the IT levels, based on the examination of network packets;
- laying out OT devices within the OT levels of the OT segment, and identifying each OT device connection to a conduit between the OT levels, based on the examination of network packets;
- dynamically generating a network hierarchy that maps the IT segment with interconnected IT levels having IT devices relative to the OT segment with interconnected OT levels having OT devices;
- setting up a plurality of security zones from the IT layout and the OT layout, wherein each of the plurality of security zones has a corresponding one or more security zone policies;
- and
- outputting the network hierarchy overlaid with the plurality of security zones for display to a user.
A non-transitory computer-readable medium in a network segmentation firewall in a hybrid enterprise network, wherein the hybrid enterprise network includes an information technology (IT) segment and an operational technology (OT) segment, for automatically laying out security zone policies for IT and OT devices, the method comprising:
- performing deep packet inspection on network packets to identify a plurality of network devices within the hybrid enterprise network;
- determining whether each of the plurality of network devices is part of the IT segment or the OT segment by examining a physical network address, a data type and a network protocol of one or more of the network packets, wherein the IT segment has multiple levels and the OT segment has multiple levels;
- laying out IT devices within the IT levels of the IT segment, and identifying each IT device connection to a conduit between the IT levels, based on the examination of network packets;
- laying out OT devices within the OT levels of the OT segment, and identifying each OT device connection to a conduit between the OT levels, based on the examination of network packets;
- dynamically generating a network hierarchy that maps the IT segment with interconnected IT levels having IT devices relative to the OT segment with interconnected OT levels having OT devices;
- setting up a plurality of security zones from the IT layout and the OT layout, wherein each of the plurality of security zones has a corresponding one or more security zone policies;
- and
- outputting the network hierarchy overlaid with the plurality of security zones for display to a user.
A network segmentation firewall in a hybrid enterprise network, wherein the hybrid enterprise network includes an information technology (IT) segment and an operational technology (OT) segment, for automatically laying out security zone policies for IT and OT devices, the network segmentation firewall comprising:
- a processor;
- a network interface communicatively coupled to the processor and to the hybrid enterprise network;
- and
- a memory, communicatively coupled to the processor and storing:
- a packet inspector to perform deep packet inspection on network packets to identify a plurality of network devices within the hybrid enterprise network;
- a network level module to determine whether each of the plurality of network devices is part of the IT segment or the OT segment by examining a physical network address, a data type and a network protocol of one or more of the network packets, wherein the IT segment has multiple levels and the OT segment has multiple levels;
- an IT segment module to layout IT devices within the IT levels of the IT segment, and identify each IT device connection to a conduit between the IT levels, based on the examination of network packets;
- an OT segment module to layout OT devices within the OT levels of the OT segment, and identify each OT device connection to a conduit between the OT levels, based on the examination of network packets;
- a security zone module to dynamically generate a network hierarchy that maps the IT segment with interconnected IT levels having IT devices relative to the OT segment with interconnected OT levels having OT devices, and sets up a plurality of security zones from the IT layout and the OT layout, wherein each of the plurality of security zones has a corresponding one or more security zone policies;
- and
- an interface display module to output the network hierarchy overlaid with the plurality of security zones for display to a user.
Dependencies are inferred from the claim text.