WO2023075584A2 - Method for deploying a new firewall security policy in a computer network - Google Patents

Abstract

The present invention relates to a method for deploying a new firewall security for computer networks in order to attenuate the various risks of a current policy. The procedure involves updating an initial security policy (I) on the basis of an algorithm that automates this procedure and minimizes the inherent security risks at the time a new security policy (T) is deployed. This is achieved by creating an intermediate policy (R) that progressively receives the new rules (T) to be implemented and in a specific order. The deployment procedure according to the invention comes to an end when the policy (R) is equal to the target policy (T).

Description

A method of deploying a new Firewall security policy in a computer network.

The invention relates to the field of arrangements for secret or secure communications; Network security protocols

Patent application CN108650222A discloses a method for updating firewall security policies by updating firewall rules based on extended filtering.

Patent application US2006010491A1 relates to a firewall system protecting a community of devices and method for updating firewall rules within the system. This method consists of a filter of messages to and from the network to which the device implementing the method is connected. This method comprises at least the following steps: - detection of the addition, removal and banishment of a device from the community; - the detection of changes in the network address of a device in the community; - the triggering of a new calculation of the rules in response to the change in the local security policy.

Microsoft patent US2008148380A1 discloses a method for dynamically updating firewall settings. According to its embodiment, the method includes receiving a policy rule that includes a reference to a predefined container that specifies an allowed range of values of at least one firewall parameter allowed under the policy rule , receiving a firewall parameter value and populating the predefined container with the firewall parameter value if the firewall parameter value is within the allowed value range, thereby updating the policy rule.

The present invention relates to a method for deploying a new firewall security policy for computer networks and in order to overcome the various risks of a current policy. This is an approach to updating an initial security policy (I) based on an algorithm that automates this process and minimizes the inherent security risks when deploying a new security policy (T ). This by creating an intermediate policy (R) which gradually receives the new rules of (T) to be implemented and in a very specific order. The deployment approach according to the invention ends when the policy (R) is equal to the target policy (T).

Due to the insecurity of the internet and intranet, the use of firewalls is a popular solution to overcome the problems of illegal access to information.

Currently, firewall policies can contain thousands of rules due to the huge size and complex structure of modern networks. This makes manually configuring these policies a mission impossible, even for experienced network administrators.

Therefore, these policies require automated tools that provide a user-friendly environment to securely specify, configure, and deploy a target policy. It is for all these reasons that we thought of developing a new safe and effective strategy that will allow us to update these policies. Indeed, the fruit of our invention is a client/server application that meets all these requirements since it is based on an algorithm without equivalent in the technological world. In addition, our solution helps improve the ability to monitor security threats at each site through periodic audits.

According to a particular embodiment of the invention, the administrator must authenticate himself with an identifier and a password via an authentication window as shown in . He must specify the path of the file containing the two initial and target policies by clicking on the “Browse” command. Then he clicks on the "Deploy" button to start the algorithm that supports the update process.

According to a particular embodiment of the invention, a verification of the success of the deployment of the update is carried out (the "Check" button). To do this, one of two tooltips is displayed . First, we specify the network path of a file containing the "Current Policy" at site level 1. And then we provide the network path of a file containing the "Target Policy" at the head office level. After choosing the two files we want, we compare them. These two files which must not be identical in order to change the running policy "Current policy".

According to a particular embodiment of the invention, it is possible to compare the performance of our solution with the "SanitizeIT" reference solution (the "Plot" button). Indeed, by clicking on the "Plot" button in the graphical interface of the application, a graph is displayed comparing the variation in the performance of the security policies using the two algorithms: Enhanced-Greedy-2-Phase Deployment and SanitizeIT as shown in .

From the displayed curve, it can be concluded that Enhanced-Greedy-2-PhaseDeployment is more efficient than SANITIZEIT and the execution time is almost linear. Also, SANITIZEIT seems to have a polynomial runtime.

To reinforce security, an audit is launched periodically in order to find new vulnerabilities in the network of each site. Following this operation, the administrator is required to design and then deploy a new security policy that meets the needs of the site audit concerned. It can be concluded that network security is a continuous process as shown in the .

On the economic level, our project will contribute to the financial development at the level of turnover of any company having firewalls at the level of its branches.

The deployment of a firewall policy should have the following characteristics: accuracy, confidentiality, security and speed:

- Accuracy: A deployment is accurate if it successfully implements the target policy on the firewall. After an exact deployment, the target policy becomes the running policy. Accuracy is an essential requirement for any deployment.

Confidentiality: Confidentiality refers to securing communication between a management tool and a firewall. Due to the sensitive nature of the information transmitted during a deployment, communication between the management tool and the firewall must be confidential. Confidentiality can be achieved using encrypted communication protocols such as SSH or SSL.

Safe: A deployment is safe if no legal packets are discarded and no illegal packets are accepted during the deployment.

Speed: A deployment should happen in the shortest possible time, so that the desired end state is reached as quickly as possible. A deployment algorithm must have an optimal uptime, so that it is applicable even for very large security policies. Slow deployment is unpleasant for users and may defeat the purpose of deployment.

The present invention will be described through the detailed figures of the preferred embodiment, with reference to the figures.

represents our own algorithm that we designed and which constitutes the heart of the invention

illustrates administrator authentication with a username and password. This step is very important because the update process must be done only by the administrator.

displays the performance of our solution with the reference solution "SanitizeIT".

summarizes the complete process of updating a firewall security policy. Indeed, this process begins with the verification of the identity of the person who will be responsible for bringing about this operation, passing through the discovery of faults at the network level and finally, through the design and deployment of a new policy which will correct the faults found previously.

The mentioned steps are explained as follows: 1: Admin needs to authenticate to be able to access our solution interface. 2: A security audit is done by our software in order to find the faults at the network level of each site. 3: Design of a new security policy that meets the needs of the audit. 4: Automatic deployment of the policy designed in step 3 at the concerned site firewall level.

logical process of the method

The algorithm presented in the constitutes the heart of our invention. It is designed to automatically deploy a target policy "T" from an initial policy "I" through a current policy "R". Indeed, our application is based entirely on set algorithm.

Deploying a policy is the process by which edit commands for the policy are put on the firewall such that the target policy becomes the running policy
A network administrator or management software executes commands on the firewall to transform the running policy R (Running) into a target policy T (Target). The set of commands supported by a firewall is called its policy editing language. Typically, a firewall uses the following subset of editing commands:

(app r) appends rule r to the end of R.
(del r) removes r from R.
(del i) deletes the rule at position i of R.
(ins ir) inserts r at position i.
(mov ij) moves rule i to position j in R.

Claims (5)

1. A firewall security policy deployment method consisting of the following steps:

   • Authentication by an administrator.

   • Audit to identify security vulnerabilities at the network level of each site.
   • Design and creation of the file containing the new security policy that will respond to the detected vulnerabilities.
   • Deployment of the new security policy according to the following process (figure 1):
     • Take as parameters the initial policy (I) and the target policy (T).
     • Creation of an intermediate policy (R) being empty at the start of the process and which is filled during the execution of the method.
     • Gradually insert the rules of the target policy into the called intermediate policy (R).
     • Completion of the deployment when the intermediate policy (R) is equal to the target policy (T).
2. Firewall security policy deployment method according to claim 1 characterized in that if a rule in (T) already exists in (I) this will be moved to the position predefined by (T) in (R).
3. Firewall security policy deployment method according to claim 1 characterized in that if a rule in (I) does not exist in (T) it will be deleted in (R).
4. Firewall security policy deployment method according to claim 1 characterized in that if a rule in (T) is redundant, it will be deleted.
5. Firewall security policy deployment method according to claim 1 characterized in that the automatic deployment of the end-to-end firewall security policies, i.e. the server located at the headquarters level which constitutes the source of the updates. to the firewall at the site level or branch that will receive updates from the source.

Images