International Business Machines Corporation

Jeffrey B Cates

Kimberly Tekavec Bailey

Mark T Wright

Diane Iupe Shannon

Linwood H Overby, Jr

Scott Christopher Moonen

Wuchieh James Jong

Keith J Welter

A method automatically captures network resources of each individual system of a networked system. The method defines a reusable object name for each class of network resources captured from the individual systems. Each class of network resources has at least one common feature. The method automatically maps each network resource having a particular class of each individual system to the reusable object name defined for that particular class. Embodiments enable individual system-specific resources, such as IP addresses, to be mapped to reusable objects. In some embodiments, reusable objects names may be combined to form higher-level configuration objects, such as network configuration rules.

Automatic generation of reusable network configuration objects

A system automatically captures network resources of each individual system of a networked system. The method defines a reusable object name for each class of network resources captured from the individual systems. Each class of network resources has at least one common feature. The system automatically maps each network resource having a particular class of each individual system to the reusable object name defined for that particular class. Embodiments enable individual system-specific resources, such as IP addresses, to be mapped to reusable objects. In some embodiments, reusable objects names may be combined to form higher-level configuration objects, such as network configuration rules.

A hierarchical administrative system centrally controls configuration of network security policy for a group of information handling systems (IHSs) by multiple tier levels of administration. The highest tier level of administration builds policies that fulfill IT security policy intent. Higher level administrators may scope subordinate administrators to a group of IHSs or a single IHS. Higher level administrators may allow subordinate administrators to perform system specific customization of the policy based on permissions that the higher level administrator grants. Customization may include completing partially-built rule conditions with IP address and port, completing partially-built rule actions, and adding or deleting rules based on IHS unique applications or security requirements. A security enforcement tool may enforce customizations of network security policy. A security policy administration tool along with the security enforcement tool may detect attempts to work around the administrative system, and alerts higher tier level administrators and/or takes remedial action.

Tiered network policy configuration with policy customization control

A self-adjusting Internet Key Exchange (IKE) daemon negotiation throttle minimizes retransmission processing during Security Association (SA) negotiation requests. The self-adjusting IKE daemon receives a request for a new negotiation to be performed by a negotiation system; determines if the negotiation system is in congestion; and if the negotiation system is determined to be in congestion: determines if a token is available in a token bucket; and if a token is available in the token bucket, removes the token from the token bucket; and performs the new negotiation.

Growing community of inventors

Raleigh, NC, United States of America

Jeffrey B Cates