Unisys Corporation

Michael C Leap

Robert A Johnson

Philippe Jolly

Richard W Phelps

Michael J Didomenico

Michael Di Domenico

Emily M Shoup

Jared Poetter

Eugene J Gretter

Sarah K Inforzato

Edward T Cavanagh

Michael J Saunders

Brittney Burchett

Diane E Schaefer

Robert Buckwalter

George Karian

Dmitriy Yarmaliuk

Michael J DiDomenico

Cody Finn

A network model includes nodes, node property sets, authorization groups and authorization servers. The node property sets define how the nodes operate and authenticate. The nodes are member of the node property sets. The authorization groups are associated with the node property set. And, authorization servers are member of the authorization groups. In addition, a network model in a secure network environment has at least one community of interest. The network model includes at least one node being a member of a node property set that defines how the node operates and authenticates.

Network model utilizing property sets

A method of creating secure endpoints on a network includes registering by a node using a random selection algorithm to choose which server to register to; receiving by the node a property set ID of a property set that the node is a member of; and authorizing by the node using the property set ID to look up its authorization details in the property set. A method of creating secure endpoints on a secure network having at least one community of interest, includes registering by a node using a random selection algorithm to choose which server to register to; receiving by the node a property set ID of a property set that the node is a member of; and authorizing by the node through an authorization server using the property set ID to look up its authorization details in the property set; wherein the node and the authorization server are a member of the at least one community of interest.

Method of creating secure endpoints on a network

Methods and systems for providing integration between an enterprise security management configuration tool and third party network traffic software are disclosed. By defining a software interface through which configuration data for third party networking devices can be queried and configuration data accessed, the enterprise security management configuration tool can compare overall network traffic to the configuration provided by the third party networking software to assess an overall security level within an enterprise network.

Third party integration with enterprise security management tool

Electronic display with a graphical user interface

Methods and systems for configuring a common security policy for a plurality of nodes included within an enterprise network. Example methods can include grouping nodes within profiles based on IP address, in addition to concordance data. Additionally, nodes may be added to profiles based on a classification of the node being common to classifications of nodes within the profile. Still further, profiles may be grouped into a solution based at least in part on classification of the profile, in addition to grouping of profiles into solutions based on affinitization using concordance data. The methods described also include determining a common security policy to apply to each of the nodes within the profile.

Object scope definition for enterprise security management tool

Methods and systems for defining a solution within an enterprise security management configuration server is disclosed. One method includes, based on network concordance data, grouping a plurality of nodes within an enterprise network into a plurality of profiles and identifying one or more channels among the plurality of profiles within a project of an enterprise security management configuration tool. The method also includes displaying the plurality of profiles in a configuration user interface, and automatically identifying one or more solutions among the plurality of profiles. The method further includes collapsing each of the one or more solutions into a single icon within the configuration user interface, each single icon representing a solution.

Solution definition for enterprise security management

Methods and systems for configuring security management settings within an enterprise network are disclosed. One method includes receiving network concordance data at an enterprise security management configuration tool from a plurality of nodes within an enterprise network, and, based on the network concordance data, classifying each of the plurality of nodes based on an affinitization between the two or more nodes. The method also includes defining a profile for one or more nodes or grouped nodes, and defining one or more solutions within the enterprise security management configuration tool, the one or more solutions each including one or more nodes of the plurality of nodes. The method also includes receiving a deployment selection identifying at least one of the one or more solutions, and, in response to the deployment selection, generating a security settings file describing security settings for each of the one or more nodes.

Enterprise security management tool

Methods and systems for configuring a security policy for an enterprise within an enterprise security management tool are disclosed. In some aspects, such systems receive a definition of at least one custom classification within a user interface of the enterprise security management configuration tool, including a name of a profile and network activity associated with one or more nodes to be included within the profile. Such systems also generate a security settings file to be applied within the enterprise, the security settings file including, for each profile, a common security policy to each of the nodes included in the profile. The profiles to which the security settings file is applied include the profile defined by the at least one custom classification.

Custom node and profile classifications for enterprise security management tool

Methods and systems for providing an emergency incident response are described. Data is received from a plurality of heterogeneous data feeds each having a native format and including one or more publically-available data feeds. Event data is extracted from the received data, the event data representing one or more events from one or more of the plurality of heterogeneous data feeds, and the event data is translated from the native format into a standardized analysis format. Further, an existence and a priority level of at least one emergency incident contemporaneous with the event data and based at least in part on the event data is determined, the priority level being selected from among a plurality of predefined priority levels, and a graphical user interface including a message describing the at least one determined emergency incident is displayed.

Emergency incident detection platform

Methods and systems for configuring a security topology in an enterprise security management configuration tool are disclosed. One method includes manipulating an icon representing one or more nodes in a configuration user interface of an enterprise security management configuration tool to associate the one or more nodes into a manual grouping of nodes in an enterprise network; and, after manipulating the icon, selecting, from a tool palette of the configuration user interface, an automatic association tool, the automatic association tool determining an association among a plurality of nodes into a plurality of automated logical groupings of nodes. In some cases, the manual grouping of nodes is different from the plurality of automated logical groupings, and the automatic association tool preserves the manual grouping of nodes.

User interface features for enterprise security management

Methods and systems for determining public events are described. Data is received from a plurality of heterogeneous data feeds each having a native format. Event data objects are generated based on the received data, the event data objects each including at least a human readable message, an event time, and an event location. The human readable message of each of the event data objects is parsed into keywords, and the event data objects are grouped into one or more public events based on the keywords, time, location, and a sentiment based on the keywords. The public events are filtered based on a filter score, and the event data objects are clustered based on sentiment, location, and time. A density of the clustered event data objects is determined, and the validity of the public events is determined by a comparison of the density to a predetermined density threshold.

Public event detection platform

Methods and systems for assigning security settings to one or more nodes within an enterprise network are disclosed. One method includes receiving network concordance data at an enterprise security management configuration tool from a plurality of nodes within an enterprise network, and receiving, in a configuration user interface, a selection of an affinitization level selected from a plurality of discrete affinitization levels, each of the discrete affinitization levels corresponding to a different extent to which nodes within an enterprise are grouped into profiles. The method also includes automatically grouping each of the plurality of nodes identified in the network concordance data into a plurality of profiles based on the selected affinitization level, and applying a common security policy to each of the nodes included in one of the plurality of profiles.

Growing community of inventors

Malvern, PA, United States of America

Michael C Leap