RU2573782C1 - System and method of setting up computer system according to security policy - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: system for setting up a computer system according to a security policy comprises policy application means for determining computer system configuration data and subsequent transmission thereof to instruction generating means, setting up the computer system according to a selected security policy, checking the proper operation of the computer system after the setup; a security policy database; instruction generating means for selecting a security policy according to the defined computer system configuration and existing security policies from the security policy database, generating an instruction upon the change of the defined computer system configuration, where at least one executable instruction is generated in the form of a self-launching file; files and distribution packages are added to the generated instruction for the correct execution of the generated executable instruction.

EFFECT: corporate network security.

10 cl, 3 dwg

Description

Technical field

The invention relates to systems and methods for applying security policies.

State of the art

Currently, personal computer systems of users are increasingly used for business purposes in the organization’s office. With this approach, it is important that the information security of the organization’s computer infrastructure is not compromised.

In order to temporarily and safely enter an employee’s computer system into the organization’s computer infrastructure, it is necessary to differentiate access to information. Access control is usually implemented using security policies. To apply security policies to a computer system, many actions must be performed. The requirements of the policies can be, for example, installing or removing software (software), disabling or activating a specific device, such as a Bluetooth adapter, configuring the connection or operation of programs and devices, etc.

Not all, even experienced, employees have the ability to perform the above list of actions, configure their personal computer system in accordance with the requirements of the organization’s infrastructure security policy and start working on a personal computer system in the office. Many manufacturers of devices and software, complexity of settings, limited access to information about settings - these and other reasons make it difficult to configure an unknown computer system.

You should also consider the current state of the computer system. In cases where a computer system has a number of programs and settings, the presence of which is a requirement of a security policy, the process of setting up a new computer system in accordance with the requirements of security policies can be greatly simplified.

Currently, there are a number of solutions designed to optimize the process of applying security policies.

US Pat. No. 6,799,197 B1 describes the deployment of a security policy on a computer system. Security policies are deployed using the agent and policy management server. To deploy the policy, an installation package is generated, which is subsequently transferred and installed on the device. Security policies are managed through a public network, the Internet, or email.

The publication US 7665125 B2 presents an algorithm for determining and setting a security policy for a mobile computer system based on user data. The server (including the web server) determines the necessary policy and the role of the mobile computer system for the user. The agent then installs and configures the applications as part of the security policy using the installation packages for the security policy.

These solutions allow only partially simplifying the configuration of a new computer system in accordance with the requirements of a security policy. The present invention provides a more effective solution to the problem of optimizing the process of applying security policies.

Disclosure of invention

The invention relates to systems and methods for configuring a computer system in accordance with the requirements of security policies. The technical result of the present invention is to ensure the security of the corporate network by setting up a computer system using which an attempt was made to access the corporate network in accordance with the security policy.

The specified technical result is achieved by setting up a computer system by generating and following instructions for changing the configuration of a computer system.

A system for configuring a computer system in accordance with a security policy that contains: at least one computer system using which an attempt was made to access a corporate network; means for applying policies designed to determine configuration data of said computer system and then transmit them to a tool for generating instructions, configure said computer system in accordance with a selected security policy by executing at least one instruction for changing a specific configuration of said computer system; Security policy database for storing security policies for computer systems means for generating instructions for selecting a security policy applicable to said computer system in accordance with a specific configuration of said computer system and existing security policies from a database of security policies, generating at least one instruction for changing a specific configuration of said computer system to configure the said computer system in accordance with the selected security policy and the transmission of the generated instructions and a policy enforcement tool.

In the particular case of the system implementation, the policy enforcement tool determines the configuration of the said computer system by collecting information at least about the type of computer system and the state of the software and devices of the said computer system.

In another particular embodiment of the system, the means of applying policies to determine the configuration of said computer system sends a link to said computer system.

In another particular case of implementing the system, the policy enforcement tool, when clicking on the link, downloads and runs a control program on the mentioned computer system.

In the particular case of system implementation, the means of applying policies using the running control program determines the configuration of the computer system.

In another particular case of the system implementation, the policy enforcement tool, when clicking on the link, starts the execution of scripts on the page.

In another particular case of system implementation, the means of applying policies using running scripts determines the configuration of the said computer system.

In the particular case of system implementation, the policy enforcement tool, using the running control program, executes at least one instruction for changing a specific configuration of the said computer system.

In another particular case of implementing the system, the means of applying policies using running scripts on a page from a link executes at least one instruction for changing a specific configuration of the said computer system.

In another particular case of the system implementation, the policy enforcement tool, after setting up said computer system, checks the correct operation of said computer system.

A method for setting up a computer system in accordance with a security policy, in which using a computer system access to a corporate network; using the policy enforcement tool, the configuration of the computer system is determined; using the tool for generating instructions, select a security policy applicable to said computer system in accordance with a specific configuration of said computer system and existing security policies; using the tool for generating instructions form at least one instruction for changing a specific configuration of said computer system to configure said computer system in accordance with the selected security policy; using the policy enforcement tool, configure the computer system in accordance with the selected security policy by executing at least one instruction for changing a specific configuration of the computer system.

In the particular case of the method, the configuration of said computer system is carried out by collecting information, at least about the type of computer system and the state of the software and devices of said computer system.

In another particular case of the implementation of the method for determining the configuration, a link is sent to the computer system.

In another particular case of the implementation of the method, when clicking on the link, a control program is downloaded and launched on the said computer system.

In the particular case of implementing the method using the running control program, the configuration of said computer system is determined.

In another particular case of the implementation of the method, when clicking on the link, scripts are launched on the page.

In another particular case, the implementation of the method using running scripts determines the configuration of the aforementioned computer system.

In the particular case of implementing the method using the control program, at least one instruction for changing a specific configuration of said computer system is executed.

In another particular case of implementing the method using executable scripts on a page from a link, at least one instruction for changing a specific configuration of said computer system is executed.

In the particular case of implementing the method, after setting up said computer system, the correct operation of said computer system is checked.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 shows a block diagram of a computer system configuration system in accordance with a security policy.

FIG. 2 illustrates the operation algorithm of a computer system configuration system in accordance with a security policy.

FIG. 3 represents an example of a general purpose computer system.

Although the invention may have various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood, however, that the purpose of the description is not to limit the invention to its specific embodiment. On the contrary, the purpose of the description is to cover all changes, modifications that are included in the scope of this invention, as defined by the attached formula.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details necessary to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined in the scope of the attached claims.

Under the computer infrastructure of the organization means the totality of all the computer systems used by the organization to work.

A computer system is a device or a group of interconnected or adjacent devices, one or more of which, acting in accordance with the program, carries out automated data processing.

Organizations with differentiated access rights to information apply security policies. Security policy is a set of security guidelines, rules, procedures and practices that govern the management, protection and distribution of valuable information.

The computer systems used by the organization’s employees are configured with security policies in mind. An employee using an unconfigured computer system to work in an organization does not have full access to the corporate network. In the event that an employee of the organization decides to use his own personal computer system to gain access to sensitive information, it becomes necessary to configure his personal computer system in accordance with security policies.

In order to quickly configure the computer system in accordance with the requirements of security policies, use the computer system configuration system in accordance with the security policy.

FIG. 1 shows a block diagram of a computer system configuration system in accordance with a security policy. The computer system configuration system in accordance with the security policy consists of at least one computer system 110, using which an attempt was made to access the corporate network, tools for applying policies 120, tools for generating instructions 130, security policies database 140, software databases 150.

The user begins to work with the computer system 110, using which makes an attempt to access the corporate network. The policy enforcement tool 120 is intended to determine the configuration of said computer system 110, transmitting data about a specific configuration of said computer system 110 to the instruction generating tool 130. In addition, the policy enforcement tool 120 is intended to configure said computer system 110 in accordance with a selected security policy by performing at least one instruction for changing a specific configuration of said computer system 110.

Thus, after using the computer system 110 an attempt was made to access the corporate network, the policy enforcement tool 120 initiates a configuration determination of the computer system 110.

The configuration can include information about the type of computer system and the status of the software and devices of the computer system at the time of determination. By type, a computer system can be, for example, virtual, mobile, stationary, etc. By a state is meant a version of software, an operating system, the presence of plug-ins, etc., also by a state are understood the settings of devices that are included in the computer system, for example, network cards USB readers, etc.

In one embodiment, in order to determine the type and state of said computer system 110, the policy enforcement tool 120 sends it a message that contains a link. The user, following the link, confirms the desire to configure the mentioned computer system to work on the corporate network.

A link can be a part of a document (email, SMS, MMS, etc.) that refers to another element (command, text, title, note, image) in the document itself, to another object (file, directory, application) located on a local disk or on a network resource, or on elements of this object. A link may also contain commands for invoking scripts, programs, libraries, or plugins built into the browser or used in the OS.

In one embodiment, the configuration of the computer system 110 may be performed using a control program. In this case, the message contains a link, upon clicking on which the control program is downloaded and launched on the said computer system 110.

Under the control program understand software designed to control the process of setting up a computer system in accordance with the requirements of security policy. The control program is part of the policy enforcement tool 120 and may partially perform intended functions, for example: collecting information about the type and condition of said computer system 110, transmitting information about the type and condition of said computer system 110 to packet forming 130, at least one instructions for changing a specific configuration of said computer system 110.

In another embodiment, the determination of the type and state of an unknown computer system 110 may be carried out by running scripts on a page by clicking on a link. Scripts can be implemented using Java or Ajax, JavaScript commands, ActiveX libraries, Net Framework, etc. Scripts are generated by means of applying policy 120 and can partially perform intended functions, for example: collecting information about the type and status of the mentioned computer system 110, transmitting information about the type and condition of said computer system 110 to the packet forming means 130, to execute at least one instruction for changing a specific configuration of said computer system 110.

After determining the configuration of said computer system 110, the policy enforcement tool 120 transmits the specific configuration data to the instruction generating tool 130.

The tool for generating instructions 130 is intended to select a security policy applicable to said computer system in accordance with a specific configuration of said computer system 110 and existing security policies from the security policy database 140. In addition, the tool for generating instructions 130 is intended to generate at least one instructions for changing a specific configuration of said computer system 110 to configure said computer system 110 to suit with the selected security policy. Also, the packet forming means 130 is intended to transmit at least one instruction for changing a specific configuration of said computer system 110 to the policy enforcement tool 120.

The database of security policies 140 is designed to store security policies for computer systems that are used in the infrastructure of the organization.

Having received data about a specific configuration of said computer system 110, the packetizer 130 selects a security policy. In accordance with existing security policies from the database of security policies 140 and information about a specific configuration of said computer system 110, the tool for generating instructions 130 selects a security policy applicable to said computer system 110.

Then, based on the requirements of the selected security policy, the tool for generating instructions 130 creates instructions that contain executable code designed to perform actions to change a specific configuration of the said computer system.

One example of an action might be updating a specific program or operating system as a whole, including changing current settings. When determining the type and status of an unknown computer system, an installed version of Microsoft Outlook 14.0.7109.5000 SP1 Home edition without plugins was detected. To accept the security policy, the user must work in Microsoft Outlook version 14.0.7109.5000 SP2 Corporate edition with the Attachments Processor plugin installed. Accordingly, it is necessary to perform an action to update an older version of the software, the second step to perform may be to install the Attachments Processor plugin. Actions can be connected, including with the configuration of devices, such as a network card or VPN connection.

For example, an action called “Microsoft Outlook Update” can be represented as an algorithm:

1. Uninstall the current version of Microsoft Outlook 14.0.7109.5000 SP1 Home edition.

2. Install the required version of Microsoft Outlook version 14.0.7109.5000 SP2 Corporate edition.

Based on the algorithm for the execution of the action, they form an instruction and determine the files and software distributions, for example, a distribution with the desired version of Outlook.

Actions can be described in the form of various algorithms. If the structure of the operating system allows, then the action algorithm under the name "Microsoft Outlook Update" can be as follows:

1. Delete files that belong to the old version of Microsoft Outlook.

2. Delete changes made to the operating system (registry, services, libraries, etc.) that relate to the old version of Microsoft Outlook.

3. Rewrite the list of files related to the new version of Microsoft Outlook with the Attachments Processor plugin installed.

4. Create changes to the operating system (registry, services, libraries, etc.) that apply to the new version of Microsoft Outlook with the Attachments Processor plugin installed.

In this case, an executable instruction formed on the basis of the above algorithm can refer to files of the new version of Microsoft Outlook with the Attachments Processor plugin installed. The instruction may also contain subfunctions that perform changes in the OS.

Files or distributions can be stored both in open sources and in a database. Database software 150 is designed to store files, scripts, software descriptions that are used in working with the corporate network and are necessary for the correct execution of executable instructions.

To configure the computer system 110 in accordance with the selected security policy, it may be necessary to carry out several instructions. Based on the algorithm of actions, instructions can be packaged and transmitted in the form of a self-starting archive or package. Also, files and distributions from the software database 150 can be added to the package.

After generating the instructions, the means for generating instructions 130 passes the instructions to the policy enforcement tool 120.

In turn, after receiving the instructions, the policy enforcement tool 120 configures the computer system in accordance with the selected security policy. The adjustment is carried out in the course of following the instructions received and changing a specific configuration of the computer system.

The control program can also be used to configure said computer system 110. The policy enforcement tool, using the launched control program, executes at least one instruction for changing a specific configuration of said computer system.

In another case, the policy enforcement tool 120 for configuring said computer system 110 uses script execution on a page. In this case, the instructions may be self-extracting and self-executing. The policy enforcement tool 120 sends self-extracting instructions to said computer system 110 by which it configures said computer system.

Additionally, the policy enforcement tool 120 may be designed to verify the health of said computer system 110 after applying the selected security policy.

After completing all the instructions, the policy enforcement tool 120 can additionally perform a health check of the said computer system 110. After setting up and checking the said computer system will satisfy all the requirements and conditions of the security policy and can be used in working with the corporate network without restrictions.

FIG. 2 illustrates the operation algorithm of a computer system configuration system in accordance with a security policy. At step 210, the user begins to work with the computer system 110, using which makes an attempt to access the corporate network. At step 211, the policy enforcement tool 120 determines the configuration of said computer system 110. Then, the policy enforcement tool sends data about the specific configuration of said computer system 110 to the instruction generating engine 130. At step 212, the instruction generating tool 130 selects a security policy applicable to said computer system 110 in according to the specific configuration of said computer system 110 and existing security policies. At step 213, the instruction generation tool 130 generates at least one instruction for changing a specific configuration of said computer system 110 to configure said computer system 110 in accordance with the selected security policy. Then, the tool for generating instructions 130 transmits at least one instruction for changing the specific configuration of the computer system 110 to the policy enforcement tool 120. At step 214, the policy tool 120 configures the computer system 110 in accordance with the selected security policy by executing at least at least one instruction for changing a specific configuration of said computer system 110.

FIG. 3 represents an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains a read-only memory computer system (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to computer system 20 via serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 3. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external computer system, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and do not have to display the exact network configuration, that is, in reality there are other ways to establish a technical connection means of communication of one computer with another.

Claims (10)

1. The system configuration of a computer system in accordance with a security policy that contains:
a) at least one computer system using which an attempt was made to access the corporate network;
b) a means of applying policies designed to:
- definition of data on the configuration of the said computer system and their subsequent transmission to the means of forming instructions, where the configuration of the said computer system means at least one of:
- data on the type of said computer system at the time of determination,
- data on the state of the software of the said computer system at the time of determination,
- data about the devices of the said computer system at the time of determination,
- settings of said computer system in accordance with the selected security policy by following at least one generated instruction for changing a specific configuration of said computer system,
- performing checks on the correct operation of said computer system after configuration.
c) a database of security policies designed to store security policies for computer systems;
g) means of forming instructions intended for:
- selecting a security policy applicable to said computer system in accordance with a specific configuration of said computer system and existing security policies from a database of security policies,
- forming at least one instruction for changing a specific configuration of said computer system for setting up said computer system in accordance with the selected security policy, where during formation the following actions are performed:
- based on the requirements of the selected security policy, at least one device or software is identified from a specific configuration of the said computer system, on which it is necessary to perform at least one action to change the specific configuration of the said computer system,
- based on the requirements of the selected security policy and on the basis of a specific configuration of said computer system, at least one action to change a specific configuration of said computer system is determined,
- create at least one executable instruction, in the form of a self-starting file, which contains executable code to perform at least one action to change a specific configuration of the said computer system,
- files and distributions for the identified at least one device or software necessary for the correct execution of the created executable instruction are added to the created instruction;
- transferring the generated instruction to the policy enforcement tool. 2. The system of claim 1, wherein the policy enforcement tool for determining the configuration of said computer system sends a link to said computer system. 3. The system according to claim 2, in which the means of applying policies when clicking on the link starts the execution of scripts on the page. 4. The system of claim 3, in which the means of applying policies using running scripts determines the configuration of the said computer system. 5. The system of claim 4, wherein the means of applying policies using running scripts on a page from a link executes at least one instruction for changing a specific configuration of said computer system. 6. A method for configuring a computer system in accordance with a security policy in which:
a) using a computer system provide access to the corporate network;
b) using the means of applying policies determine the configuration of the said computer system, where the configuration of the said computer system means at least one of:
- data on the type of said computer system at the time of determination,
- data on the state of the software of the said computer system at the time of determination,
- data on the devices of the said computer system at the time of determination;
c) using the tool for generating instructions, select a security policy applicable to the computer system in accordance with the specific configuration of the computer system and existing security policies;
d) using the tool for generating instructions form at least one instruction for changing a specific configuration of the said computer system to configure the computer system in accordance with the selected security policy, where during the formation the following actions are performed:
- based on the requirements of the selected security policy, at least one device or software is identified from a specific configuration of the said computer system, on which it is necessary to perform at least one action to change the specific configuration of the said computer system,
- based on the requirements of the selected security policy and on the basis of a specific configuration of said computer system, at least one action to change a specific configuration of said computer system is determined,
- create at least one executable instruction, in the form of a self-starting file, which contains executable code to perform at least one action to change a specific configuration of the said computer system,
- files and distributions for the identified at least one device or software necessary for the correct execution of the created executable instruction are added to the created instruction;
e) using the policy enforcement tool, configure the computer system in accordance with the selected security policy by following at least one instruction to change the specific configuration of the computer system;
f) using the policy enforcement tool, they verify the correct operation of the said computer system after configuration. 7. The method according to claim 6, in which, in step b), a link is sent to the computer system to determine the configuration. 8. The method according to p. 7, in which at step b), when clicking on the link, start the execution of scripts on the page. 9. The method of claim 8, wherein in step b) the configuration of said computer system is determined by running scripts. 10. The method according to p. 9, in which at step d) using executable scripts on the page from the link execute at least one instruction for changing a specific configuration of said computer system.

Images