Claims
- 1. In a network security system having a plurality of bubbles, where each bubble has a bubble and a plurality of bubble partitions, a method of creating a structured access list template, the method comprising:
dividing a first access list template into a plurality of sections, where each section includes rules that implement a function; creating an inbound local rule group for the bubble; creating an outbound local rule group for the bubble; creating an inbound remote rule group for the bubble; and creating an outbound remote rule group for the bubble.
- 2. A method as defined in claim 1, further comprising arranging the inbound local rule group and the outbound local rule group in one of the plurality of sections.
- 3. A method as defined in claim 1, further comprising arranging the inbound remote rule group and the outbound remote rule group in one of the plurality of sections.
- 4. A method as defined in claim 1, further comprising arranging the inbound local rule group and the outbound local rule group in the first access list.
- 5. A method as defined in claim 1, further comprising arranging the inbound remote rule group and the outbound remote rule group from another bubble access list template in the first access list.
- 6. A method as defined in claim 1, further comprising dividing a second access list template into a plurality of sections, where each section includes rules that implement a function.
- 7. A method as defined in claim 6, further comprising arranging the inbound local rule group and the outbound local rule group in the second access list.
- 8. A method as defined in claim 6, further comprising arranging the inbound remote rule group and the outbound remote rule group from another bubble access list template in the second access list.
- 9. In a network having a plurality of bubbles, a method of creating a uniform network security policy, comprising:
determining the number of levels of host security policy for the network; determining the number of levels of network security policies for the network; determining a minimum standard for each level of host security policy and network security policy; and assigning each of the plurality of bubbles a host level and a network level that satisfies the minimum standard.
- 10. A method as defined in claim 9, wherein the host level is assigned to a particular bubble according to the host security policy enforced at the least secure host of the particular bubble.
- 11. A method as defined in claim 9, wherein the network level is assigned to a particular bubble according to the network security policy enforced at the least secure bubble boundary of the particular bubble.
- 12. A method as defined in claim 9, further comprising selecting a matrix cell to associate with a particular bubble to receive the host security policy and the network security policy.
- 13. A method as defined in claim 12, wherein the network security policy is defined by the matrix cell.
- 14. A method as defined in claim 9, further comprising assigning a particular bubble to a matrix cell to define the host security policy and the network security policy.
- 15. In a network security system having a plurality of bubbles where each bubble has a plurality of bubble partitions, a plurality of bubble boundary devices configured to connect the plurality of bubble partitions, and a bubble registry configured to connect to the plurality of bubble boundary devices, a method of configuring each of the plurality of bubble boundary devices, comprising:
creating an address table that includes a plurality of addresses corresponding to devices in a bubble partition; creating a protocol table that includes a list of network services and whether each of the network services are granted or denied access to the bubble partition; creating an access list template using the address table and the protocol table; using the bubble registry, generating an access list from the access list template; and providing the access list to one of the plurality of bubble boundary devices.
- 16. A method as defined in claim 15, further comprising creating a black list of addresses.
- 17. A method as defined in claim 16, wherein the black list of addresses corresponds to devices that are unable to successfully send data to any one of the plurality of addresses corresponding to devices in the network security system.
- 18. A method as defined in claim 15, further comprising modifying the access list using business language descriptions.
- 19. A method as defined in claim 15, further comprising storing the address table and the protocol table in the bubble registry.
- 20. A method as defined in claim 15, wherein providing the access list includes distributing the access list into the bubble boundary device from the bubble registry.
- 21. A method as defined in claim 15, wherein providing the access list includes polling the bubble registry for the access list using the bubble boundary device.
- 22. A method as defined in claim 15, further comprising verifying that the specified access list has been applied to the correct one of the plurality of bubble boundary devices.
- 23. A method as defined in claim 15, further comprising modifying the address table, the protocol table, and the access list template.
- 24. A method as defined in claim 15, further comprising regenerating the access list using the access list template and the bubble registry.
- 25. A method as defined in claim 15, further comprising using a centrally defined network security policy to automate the generation of the access list.
- 26. A method as defined in claim 25, further comprising automatically distributing the access list to one of the plurality of bubble boundary devices.
CROSS-REFERENCE TO RELATED APPLICATION
[0001] This application claims priority from U.S. provisional patent application Serial No. 60/204,229, filed May 15, 2000, which is herein incorporated by reference for all purposes.
Provisional Applications (1)
|
Number |
Date |
Country |
|
60204229 |
May 2000 |
US |