公开(公告)号：US09948679B2

公开(公告)日：2018-04-17

申请号：US14976338

申请日：2015-12-21

Applicant: Cisco Technology, Inc.

Inventor： Zachary D Siswick ,  Umesh Kumar Miglani ,  Daniel Hollingshead ,  Karyll Catubig ,  Yedidya Dotan ,  Denis Knjazihhin

IPC: H04L29/06 ,  G06F3/0481 ,  G06F3/0484

CPC classification number: H04L63/20 ,  G06F3/04817 ,  G06F3/04842 ,  H04L63/02 ,  H04L63/102

Abstract: In a computer implemented method, selectable device icons that represent respective network security devices are generated for display. Responsive to a selection of one of the device icons, selectable interface icons that represent respective network interfaces used by the network security device represented by the selected device icon are generated for display. Responsive to a selection of one of the interface icons, selectable policy icons that represent respective security polices applied to the network interface represented by the selected interface icon are generated for display. Responsive to a selection of one of the policy icons, selectable object group icons that represent respective groups of security rule objects used in the network security policy represented by the selected policy icon are generated for display.

公开(公告)号：US20170317999A1

公开(公告)日：2017-11-02

申请号：US15139750

申请日：2016-04-27

Applicant: Cisco Technology, Inc.

Inventor： Denis Knjazihhin ,  Yedidya Dotan ,  Christopher Duane ,  Jason M. Perry

IPC: H04L29/06 ,  G06F9/44 ,  H04L29/08

CPC classification number: H04L63/08 ,  G06F9/4416 ,  G06F21/575 ,  H04L63/0884 ,  H04L67/28

Abstract: Presented herein are techniques for remotely releasing bootstrap credentials to a cloud management proxy device. In particular, a cloud management proxy device that is associated with a cloud system commences a boot operation. The cloud management proxy device then initiates a remote credential release process to obtain the bootstrap credentials, which are useable by the cloud management proxy device to complete the boot operation. Upon completion of the remote credential release process, the bootstrap credentials are received from a remote credential manager system.

公开(公告)号：US20170230425A1

公开(公告)日：2017-08-10

申请号：US15498927

申请日：2017-04-27

Applicant: Cisco Technology, Inc.

Inventor： Denis Knjazihhin ,  Yedidya Dotan ,  Burak Say ,  Robin Martherus ,  Sachin Vasant

IPC: H04L29/06

CPC classification number: H04L63/20 ,  G06F21/604 ,  H04L41/28 ,  H04L63/10 ,  H04L63/102

Abstract: A management entity generates for display multiple icons, each icon representing an actor or a resource in a networking environment, and defines a generic security policy by receiving user input in the form of a line drawn between a first icon representing an actor and a second icon representing a resource to control abilities between the actor and the resource. The management entity translates the generic security policy to multiple native security policies each of which is based on a corresponding one of multiple native policy models associated with corresponding ones of multiple security devices, and supply data descriptive of the multiple native security policies to the corresponding ones of the security devices to configure the corresponding ones of the security devices to implement the native security policies.

公开(公告)号：US20160212169A1

公开(公告)日：2016-07-21

申请号：US14600495

申请日：2015-01-20

Applicant: Cisco Technology, Inc.

Inventor： Denis Knjazihhin ,  Yedidya Dotan ,  Burak Say ,  Robin Martherus ,  Sachin Vasant

IPC: H04L29/06

CPC classification number: H04L63/20 ,  G06F21/604 ,  H04L41/0843 ,  H04L41/0893 ,  H04L63/10

Abstract: A management entity receives from multiple security devices corresponding native security policies each based on a native policy model associated with the corresponding security device. Each security device controls access to resources by devices associated with the security device according to the corresponding native security policy. The management entity normalizes the received native security policies across the security devices based on a generic policy model, to produce a normalized security policy that is based on the generic policy model and representative of the native security polices.

Abstract translation: 管理实体从多个安全设备接收对应的本地安全策略，每个基于与相应的安全设备相关联的本地策略模型。 每个安全设备根据相应的本地安全策略控制与安全设备相关联的设备对资源的访问。 管理实体基于通用策略模型，在安全设备之间规范化接收到的本地安全策略，以生成基于通用策略模型并代表本机安全策略的规范化安全策略。

公开(公告)号：US20160212168A1

公开(公告)日：2016-07-21

申请号：US14600473

申请日：2015-01-20

Applicant: Cisco Technology, Inc.

Inventor： Yedidya Dotan ,  Christopher Duane ,  Denis Knjazihhin

IPC: H04L29/06

CPC classification number: H04L63/20 ,  G06F21/10 ,  H04L63/0227 ,  H04L63/0254 ,  H04L63/102

Abstract: A management entity generates selectable security policy classifications each identifying security policies that share common security rules. Each of the security policies is applied by a corresponding one of different security devices to control access to a resource. The management entity creates a new policy template that includes all of the security policies identified by selected ones of the policy classification selections and then creates a new security policy based on the new policy template. The management entity applies the new security policy to a security device over a network.

Abstract translation: 管理实体生成可选择的安全策略分类，每个分类标识共享公共安全规则的安全策略。 每个安全策略由相应的一个不同的安全设备应用来控制对资源的访问。 管理实体创建一个新的策略模板，其中包括由选定的策略分类选择标识的所有安全策略，然后基于新的策略模板创建新的安全策略。 管理实体通过网络将新的安全策略应用于安全设备。

公开(公告)号：US10666683B2

公开(公告)日：2020-05-26

申请号：US15663757

申请日：2017-07-30

Applicant: Cisco Technology, Inc.

Inventor： David Sward ,  Denis Knjazihhin ,  Keying Bi ,  David Sounthiraraj ,  Ashok Javvaji ,  Jared Smith ,  Yedidya Dotan

IPC: H04L29/06 ,  G06F3/0484 ,  H04L29/08 ,  G06F3/0482

Abstract: In one embodiment, a system includes a processor, and a memory to store data used by the processor, the processor being operative to prepare a first user interface including a security policy selection section, interpret user input data to include performing at least one security policy selection action in the security policy selection section yielding selection of a first security policy for a first device, and update the first user interface yielding an updated first user interface including the first security policy, and a first security policy activation key for inputting into a second user interface to be generated when the first device is installed, the first security policy activation key being associated with providing authentication for downloading the first security policy to the first device.

公开(公告)号：US10075439B1

公开(公告)日：2018-09-11

申请号：US15158998

申请日：2016-05-19

Applicant: Cisco Technology, Inc.

Inventor： Ryan J. Mullens ,  Sachin Vasant ,  Raphael Luckom ,  Denis Knjazihhin ,  Yedidya Dotan

IPC: H04L9/32 ,  H04L29/06 ,  H04L12/24 ,  H04L12/931 ,  H04L29/08 ,  G06F8/65

CPC classification number: H04L63/0884 ,  G06F8/65 ,  H04L9/3247 ,  H04L41/082 ,  H04L63/0281 ,  H04L63/0442 ,  H04L63/126 ,  H04L67/327 ,  H04L67/34 ,  H04L2209/72

Abstract: A method is provided in which a development environment sends commands to an on-premises device that are signed by both (a) development environment and by (b) an execution environment (trusted source), and account for versioning. In so doing, the on-premises device that receives the command is able to authenticate both the sending entity, i.e., a production server, and the source of the command files to determine that the command is a valid configuration/upgrade package that may be safely installed and executed.

公开(公告)号：US10038697B2

公开(公告)日：2018-07-31

申请号：US14807120

申请日：2015-07-23

Applicant: Cisco Technology, Inc.

Inventor： Yedidya Dotan ,  Christopher Duane ,  Daniel Hollingshead ,  Denis Knjazihhin

IPC: H04L29/06

CPC classification number: H04L63/101 ,  H04L63/0263 ,  H04L63/20

Abstract: First and second security rules are accessed in a configuration file. Comparison points for comparing the first and second security rules are determined. Each comparison point identifies respective rule parameters of the first and second security rules. Respective weights are assigned to the comparison points. For each comparison point, the respective rule parameters are compared against each other to produce a corresponding comparison score indicative of a level similarity. Each comparison score is weighted by the weight assigned to the comparison point corresponding to the comparison score. The weighted comparison scores are combined into a total score indicative of an overall level of similarity between the first and second security rules.

公开(公告)号：US20170353459A1

公开(公告)日：2017-12-07

申请号：US15426702

申请日：2017-02-07

Applicant: Cisco Technology, Inc.

Inventor： Joe Lawrence ,  Jason M. Perry ,  Yedidya Dotan ,  Denis Knjazihhin ,  Umesh Kumar Miglani

IPC: H04L29/06

CPC classification number: H04L63/10 ,  H04L63/0263 ,  H04L63/20

Abstract: A management entity communicates over a network with devices on which security rules are configured to control network access. Data that indicates a hit count for each security rule across the devices is repeatedly collected from the devices. The indicated hit counts for each security rule are aggregated over different repeating time intervals to produce repeatedly aggregated hit counts for respective ones of the different repeating time intervals. The security rules are generated for display on a user interface screen as selectable options. Responsive to a selection of one of the security rules, a selected security rule and most recently aggregated hit counts for the different repeating time intervals for the selected security rule are generated for concurrent display on the user interface screen. The display of the most recently aggregated hit counts for the selected security rule is updated as time progresses.

公开(公告)号：US09787722B2

公开(公告)日：2017-10-10

申请号：US14755228

申请日：2015-06-30

Applicant: Cisco Technology, Inc.

Inventor： Denis Knjazihhin ,  Yedidya Dotan ,  Zachary D. Siswick ,  Christopher Duane ,  Daniel Hollingshead

IPC: H04L29/00 ,  H04L29/06 ,  G06F17/30 ,  G06F21/60 ,  G06F21/57

CPC classification number: H04L63/20 ,  G06F17/30106 ,  G06F17/30598 ,  G06F21/57 ,  G06F21/604

Abstract: An integrated development environment (IDE) preprocesses a configuration file including security rules. The preprocessing maps object names in the security rules to associated object values based on object definitions for the object names. Responsive to the configuration file being opened in an editor, the IDE provides the editor with access to preprocessing results. Each security rule in the opened configuration file is searched for object names. The IDE links each object name found in the search to an associated object value mapped thereto by the mapping performed during the preprocessing. The IDE receives a selection of an object name in a security rule of the opened configuration file and generates for display the associated object value linked to the selected object name.