Back to results
US 2003/0120955 A1Published application
Method and apparatus for managing a firewall
AssigneeLucent Technologies Inc.
InventorsYair Bartal, Alain Jules Mayer, Avishai Wool
Life of this patent
Estimating the term…
Loading patent…
Loading patent…
AssigneeLucent Technologies Inc.
InventorsYair Bartal, Alain Jules Mayer, Avishai Wool
Estimating the term…
A method and apparatus are disclosed for managing a firewall. The disclosed firewall manager facilitates the generation of a security policy for a particular network environment, and automatically generates the firewall-specific configuration files from the security policy simultaneously for multiple gateways. The security policy is separated from the vendor-specific rule syntax and semantics and from the actual network topology. Thus, the security administrator can focus on designing an appropriate policy without worrying about firewall rule complexity, rule ordering, and other low-level configuration issues. In addition, the administrator can maintain a consistent policy in the presence of intranet topology changes. The disclosed firewall manager utilizes a model definition language (MDL) and an associated parser to produce an entity relationship model. A model compiler translates the entity-relationship model into the appropriate firewall configuration files. The entity-relationship model provides a framework for representing both the firewall-independent security policy, and the network topology. The security policy is expressed in terms of “roles,” which are used to define network capabilities of sending and receiving services. A role may be assumed by different hosts or host-groups in the network. A visualization and debugging tool is provided to transform the firewall-specific configuration files into a graphical representation of the current policy on the actual topology, allowing the viability of a chosen policy to be evaluated. A role-group may be closed to prevent the inheritance of roles.
A method for generating a configuration file for at least one firewall in a network, said network including a plurality of hosts, said method comprising the steps of:
A method of generating a security policy for a network, said network including a plurality of hosts, said method comprising the steps of:
A compiler for generating a configuration file for a firewall in a network, said network including a plurality of hosts, comprising:
A system for generating a security policy for a network, said network including a plurality of hosts, said system comprising:
Dependencies are inferred from the claim text.