Graphical network security policy management

A method for establishing a security policy that is enforced by a network device such as a router, the method comprising the steps of:

• displaying a user interface, wherein the user interface comprises a first window that includes graphical symbols tat can be manipulated to define the security policy;
• receiving editing commands that manipulate one or more symbols in the set of graphical symbols whereby the security policy is established based on the editing commands;
• displaying a symbolic representation of the security policy in a second window of the user interface;
• and
• generating a set of instructions that are executable by the network device, whereby the network device enforces the security policy according to the symbolic representation, comprising the steps of generating a source script that defines the policy in a scripting language;
• and
• displaying the source script in a window of the user interface.

A method for associating a security policy with a network device, the method comprising the steps of:

• displaying a first icon on a user interface, wherein the first icon is associated with a first, pre-defined security policy;
• displaying a second icon on the user interface, wherein the second icon identifies the network device;
• receiving user input that instructs the user interface to position the first icon near the second icon, comprising receiving user input that drags the first icon over the second icon;
• and
• in response thereto, applying the first security policy to the network device that is associated with the second icon.

A method for associating a security policy with a network device, the method comprising the steps of:

• displaying a first icon on a user interface, wherein the first icon is associated with a first, pre-defined security policy;
• displaying a second icon on the user interface, wherein the second icon identifies the network device;
• receiving user input that instructs the user interface to position the first icon near the second icon;
• in response thereto, applying the first security policy to the network device that is associated with the second icon;
• displaying a network tree in a pane of the user interface, wherein the network tree includes a plurality of first icons organized in a hierarchy, in which each of the first icons represents one of a plurality of network objects in a network;
• and
• displaying a policy tree in a pane of the user interface, wherein the policy tree includes a plurality of second icons organized in a hierarchy, in which each of the second icons represents a pre-defined security policy that can be associated with and enforced by one of the network objects.

A method of establishing a representation of a network security policy, the method comprising the computer-implemented steps of:

• storing a decision tree in a memory, wherein the decision tree is constructed by assembling one or more graphical symbols representing policy actions and policy conditions;
• modifying one or more properties of one or more of the graphical symbols to create a logical representation of the policy;
• transforming the logical representation into a textual script that represents the policy;
• displaying the script;
• when the policy representation is saved, translating the script into machine instructions that govern operation of a network device.

A computer-readable medium carrying one or more sequences of instructions for controlling a network device, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

• defining a set of symbols that identify logical operations that can be carried out by the network device;
• defining an information communication policy for the network device by graphically interconnecting one or more of the symbols into a symbolic representation of the policy;
• and
• generating a set of instructions based on the symbolic representation of the policy, wherein the set of instructions causes the network device to selectively pass or reject messages according to the policy, comprising the steps of generating a source script that defines the policy in a scripting language;
• and
• displaying the source script in a window of the user interface.

A computer data signal embodied in a carrier wave, the computer data signal carrying one or more sequences of instructions for controlling a network device, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of,

• defining a set of symbols that identify logical operations that can be carried out by the network device;
• defining a data communication policy for the network device by graphically interconnecting one or more of the symbols into a symbolic representation of the policy;
• and
• generating a set of instructions based on the symbolic representation of the policy, wherein the set of instructions causes the network device to selectively pass or reject messages according to the policy, comprising the steps of generating a source script that defines the policy in a scripting language;
• and
• displaying the source script in a window of the user interface.

A computer apparatus comprising:

• a processor;
• and
• a memory coupled to the processor, the memory containing one or more sequences of instructions for controlling a network device, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of:
• defining a set of symbols that identify logical operations that can be carried out by the network device;
• defining a data communication policy for the network device by graphically interconnecting one or more of the symbols into a symbolic representation of the policy;
• and
• generating a set of instructions based on the symbolic representation of the policy, wherein the set of instructions causes the network device to selectively pass or reject messages according to the policy, comprising the steps of generating a source script that defines the policy in a scripting language;
• and
• displaying the source script in a window of the user interface.