公开(公告)号：US09948679B2

公开(公告)日：2018-04-17

申请号：US14976338

申请日：2015-12-21

Applicant: Cisco Technology, Inc.

Inventor： Zachary D Siswick ,  Umesh Kumar Miglani ,  Daniel Hollingshead ,  Karyll Catubig ,  Yedidya Dotan ,  Denis Knjazihhin

IPC: H04L29/06 ,  G06F3/0481 ,  G06F3/0484

CPC classification number: H04L63/20 ,  G06F3/04817 ,  G06F3/04842 ,  H04L63/02 ,  H04L63/102

Abstract: In a computer implemented method, selectable device icons that represent respective network security devices are generated for display. Responsive to a selection of one of the device icons, selectable interface icons that represent respective network interfaces used by the network security device represented by the selected device icon are generated for display. Responsive to a selection of one of the interface icons, selectable policy icons that represent respective security polices applied to the network interface represented by the selected interface icon are generated for display. Responsive to a selection of one of the policy icons, selectable object group icons that represent respective groups of security rule objects used in the network security policy represented by the selected policy icon are generated for display.

公开(公告)号：US09992232B2

公开(公告)日：2018-06-05

申请号：US15131604

申请日：2016-04-18

Applicant: Cisco Technology, Inc.

Inventor： Daniel Hollingshead ,  Sachin Vasant ,  Yedidya Dotan ,  Umesh Kumar Miglani ,  Denis Knjazihhin

IPC: H04L29/06 ,  H04L12/24

CPC classification number: H04L63/20 ,  H04L41/0893 ,  H04L63/0263

Abstract: Presented herein are techniques for creating a policy block comprised of a group of lines of rules/statements across configuration files for network devices. An algorithm is provided that determines when multiple policies are to be merged together into one policy. In one embodiment, data is uploaded from a network that includes a plurality of network devices. The data represents policy rules configured on the plurality of network devices. The data representing the policy rules is compared for similarities in order to group together policy rules based on their similarities. Data is stored representing a plurality of clusters, each cluster representing a group of policy rules that have been grouped together. One or more configuration policies are generated to be applied across the plurality of network devices using the data representing each of the plurality of clusters, while maintaining context of policy rule processing.

公开(公告)号：US20170054757A1

公开(公告)日：2017-02-23

申请号：US14976338

申请日：2015-12-21

Applicant: Cisco Technology, Inc.

Inventor： Zachary D. Siswick ,  Umesh Kumar Miglani ,  Daniel Hollingshead ,  Karyll Catubig ,  Yedidya Dotan ,  Denis Knjazihhin

IPC: H04L29/06 ,  G06F3/0484 ,  G06F3/0481

CPC classification number: H04L63/20 ,  G06F3/04817 ,  G06F3/04842 ,  H04L63/02 ,  H04L63/102

Abstract: In a computer implemented method, selectable device icons that represent respective network security devices are generated for display. Responsive to a selection of one of the device icons, selectable interface icons that represent respective network interfaces used by the network security device represented by the selected device icon are generated for display. Responsive to a selection of one of the interface icons, selectable policy icons that represent respective security polices applied to the network interface represented by the selected interface icon are generated for display. Responsive to a selection of one of the policy icons, selectable object group icons that represent respective groups of security rule objects used in the network security policy represented by the selected policy icon are generated for display.

Abstract translation: 在计算机实现的方法中，生成表示相应的网络安全设备的可选设备图标用于显示。 响应于选择一个设备图标，生成表示由所选择的设备图标表示的网络安全设备使用的各个网络接口的可选接口图标以供显示。 响应于选择一个接口图标，生成表示应用于由所选接口图标表示的网络接口的相应安全策略的可选择策略图标以进行显示。 响应于选择一个策略图标，生成表示由所选择的策略图标表示的网络安全策略中使用的各组安全规则对象的可选择对象组图标以进行显示。

公开(公告)号：US20160344738A1

公开(公告)日：2016-11-24

申请号：US14807120

申请日：2015-07-23

Applicant: Cisco Technology, Inc.

Inventor： Yedidya Dotan ,  Christopher Duane ,  Daniel Hollingshead ,  Denis Knjazihhin

IPC: H04L29/06

CPC classification number: H04L63/101 ,  H04L63/0263 ,  H04L63/20

Abstract: First and second security rules are accessed in a configuration file. Comparison points for comparing the first and second security rules are determined. Each comparison point identifies respective rule parameters of the first and second security rules. Respective weights are assigned to the comparison points. For each comparison point, the respective rule parameters are compared against each other to produce a corresponding comparison score indicative of a level similarity. Each comparison score is weighted by the weight assigned to the comparison point corresponding to the comparison score. The weighted comparison scores are combined into a total score indicative of an overall level of similarity between the first and second security rules.

Abstract translation: 在配置文件中访问第一个和第二个安全规则。 确定比较第一和第二安全规则的比较点。 每个比较点标识第一和第二安全规则的相应规则参数。 相应权重分配给比较点。 对于每个比较点，将相应的规则参数彼此进行比较以产生指示水平相似度的相应比较分数。 每个比较分数由对应于比较分数的比较点的权重加权。 加权比较分数被组合成指示第一和第二安全规则之间的总体相似程度的总分数。

公开(公告)号：US10038697B2

公开(公告)日：2018-07-31

申请号：US14807120

申请日：2015-07-23

Applicant: Cisco Technology, Inc.

Inventor： Yedidya Dotan ,  Christopher Duane ,  Daniel Hollingshead ,  Denis Knjazihhin

IPC: H04L29/06

CPC classification number: H04L63/101 ,  H04L63/0263 ,  H04L63/20

Abstract: First and second security rules are accessed in a configuration file. Comparison points for comparing the first and second security rules are determined. Each comparison point identifies respective rule parameters of the first and second security rules. Respective weights are assigned to the comparison points. For each comparison point, the respective rule parameters are compared against each other to produce a corresponding comparison score indicative of a level similarity. Each comparison score is weighted by the weight assigned to the comparison point corresponding to the comparison score. The weighted comparison scores are combined into a total score indicative of an overall level of similarity between the first and second security rules.

公开(公告)号：US09787722B2

公开(公告)日：2017-10-10

申请号：US14755228

申请日：2015-06-30

Applicant: Cisco Technology, Inc.

Inventor： Denis Knjazihhin ,  Yedidya Dotan ,  Zachary D. Siswick ,  Christopher Duane ,  Daniel Hollingshead

IPC: H04L29/00 ,  H04L29/06 ,  G06F17/30 ,  G06F21/60 ,  G06F21/57

CPC classification number: H04L63/20 ,  G06F17/30106 ,  G06F17/30598 ,  G06F21/57 ,  G06F21/604

Abstract: An integrated development environment (IDE) preprocesses a configuration file including security rules. The preprocessing maps object names in the security rules to associated object values based on object definitions for the object names. Responsive to the configuration file being opened in an editor, the IDE provides the editor with access to preprocessing results. Each security rule in the opened configuration file is searched for object names. The IDE links each object name found in the search to an associated object value mapped thereto by the mapping performed during the preprocessing. The IDE receives a selection of an object name in a security rule of the opened configuration file and generates for display the associated object value linked to the selected object name.

公开(公告)号：US20170208094A1

公开(公告)日：2017-07-20

申请号：US15131604

申请日：2016-04-18

Applicant: Cisco Technology, Inc.

Inventor： Daniel Hollingshead ,  Sachin Vasant ,  Yedidya Dotan ,  Umesh Kumar Miglani ,  Denis Knjazihhin

IPC: H04L29/06 ,  H04L12/24

CPC classification number: H04L63/20 ,  H04L41/0893 ,  H04L63/0263

Abstract: Presented herein are techniques for creating a policy block comprised of a group of lines of rules/statements across configuration files for network devices. An algorithm is provided that determines when multiple policies are to be merged together into one policy. In one embodiment, data is uploaded from a network that includes a plurality of network devices. The data represents policy rules configured on the plurality of network devices. The data representing the policy rules is compared for similarities in order to group together policy rules based on their similarities. Data is stored representing a plurality of clusters, each cluster representing a group of policy rules that have been grouped together. One or more configuration policies are generated to be applied across the plurality of network devices using the data representing each of the plurality of clusters, while maintaining context of policy rule processing.

公开(公告)号：US20160344773A1

公开(公告)日：2016-11-24

申请号：US14755228

申请日：2015-06-30

Applicant: Cisco Technology, Inc.

Inventor： Denis Knjazihhin ,  Yedidya Dotan ,  Zachary D. Siswick ,  Christopher Duane ,  Daniel Hollingshead

IPC: H04L29/06 ,  G06F17/30

CPC classification number: H04L63/20 ,  G06F17/30106 ,  G06F17/30598 ,  G06F21/57 ,  G06F21/604

Abstract: An integrated development environment (IDE) preprocesses a configuration file including security rules. The preprocessing maps object names in the security rules to associated object values based on object definitions for the object names. Responsive to the configuration file being opened in an editor, the IDE provides the editor with access to preprocessing results. Each security rule in the opened configuration file is searched for object names. The IDE links each object name found in the search to an associated object value mapped thereto by the mapping performed during the preprocessing. The IDE receives a selection of an object name in a security rule of the opened configuration file and generates for display the associated object value linked to the selected object name.

Abstract translation: 集成开发环境（IDE）预处理包括安全规则在内的配置文件。 预处理根据对象名称的对象定义将安全规则中的对象名称映射到关联对象值。 响应于在编辑器中打开的配置文件，IDE为编辑器提供对预处理结果的访问。 搜索打开的配置文件中的每个安全规则的对象名称。 IDE通过在预处理期间执行的映射将搜索中找到的每个对象名称链接到映射到其上的关联对象值。 IDE在打开的配置文件的安全规则中接收对象名称的选择，并生成用于显示链接到所选对象名称的关联对象值。