Intent-based network with improved correspondence between intent and secure gestures

Abstract

Embodiments of the present disclosure relate to intent-based networks with improved correspondences between intent and secure gestures. The intent includes at least a given form of providing communication, the computer-implemented method for configuring a communication network based on a given intent comprising: determining, by a given orchestration engine, a candidate network configuration from the given intent, causing the given intent to be implemented when the candidate network configuration is implemented; determining, according to the intention and / or the candidate network configuration, a change to a security attitude of the network caused by the candidate network configuration; determining, based on a given criterion, whether there is a sufficient correspondence between the intent and the change to the secure pose; in response to determining that the correspondence is insufficient, determining a correction to the given intent such that when a new candidate network configuration is determined by the orchestration engine based on the correction, there is a better correspondence between the corrected intent and the resulting change to the security attitude of the network; and implementing the new candidate network configuration in the communication network.

Description

Field of the Invention

[0001] The present invention relates to intent-based networking, in which a given abstract intent for providing communications is converted into a concrete network configuration by an orchestration engine. Background Art

[0002] Intent-based networking is the process of using advanced (artificial) intelligence, analytics, and orchestration to improve network operations. Operators describe the business outcomes they want to achieve; the network translates these goals into the configuration necessary to achieve them.

[0003] The point of intent is to accomplish the desired communication. Operators do not need to worry too much about security issues. This is done in part automatically by the orchestration engine, which translates intent into concrete network configurations. Intent-based networking solutions may take security properties and policies into account when translating intent into actual configurations, but the consequences of intent (especially security-related consequences) need to be known by the network operator, even if managed automatically. This means that security is expressed almost exclusively at the configuration level, that is, in the space of concrete configurations. These concrete configurations must be a mixture of configuration elements for providing the desired communication on the one hand and configuration elements for providing security on the other hand. For network operators who primarily speak the language of intent, this mixture is difficult to disentangle.

[0004] The goal of the present invention is to make the security configuration resulting from the implementation intent easier to understand and easier to maintain, thereby improving the overall security posture of the network that implements the network configuration derived from the abstract intent.

[0005] This object is achieved by a method according to the independent claim. Further advantageous embodiments are specified in the dependent claims. Summary of the invention

[0006] The present invention provides a computer-implemented method for securely configuring a communication network based on a given intent. The intent includes at least providing a given form of communication. In particular, the given form of such communication can be between two given entities, or from one entity to multiple other entities, such as to the public Internet. For example, an intent can include transmitting certain data from a first entity to one or more second entities, or providing a network service or data by a first entity to one or more second entities, or to multiple second entities (such as to the public Internet). Here, an entity can be a computer, other device, or software application. An intent is a high-level description of a desired result. For example, it can be derived from the design of a current application.

[0007] In the process of the method, starting from a given intent, a given orchestration engine determines a candidate network configuration. When this candidate configuration is implemented, this causes the given intent to be implemented. The candidate configuration is technically specific and reflects the given intent. In particular, it may include configuration information for network resources, computing, and I / O devices.

[0008] Based on the intent and / or based on the candidate network configuration, one or more changes to the security posture of the network resulting from the candidate network configuration are determined. For example, in order to provide for the flow of data between entities, the security rules of the network need to allow the data flow in some manner. For example, if a first participant wants to send data to a second participant, the second participant may accept a direct connection from the first participant, or the first participant may be granted write access to place data in a network share while the second participant is granted read access.

[0009] Based on at least one given criterion, determine whether there is a sufficient correspondence between intent and changes to the security posture. That is, determine whether the changes to the security posture are sufficiently reflected in the intent. For example, it can be checked whether each change to the security posture reasonably and clearly anticipates a given intent. For example, if the intent is to publish a certain file on the network, then it is clear that the network server needs to be publicly available on the Internet and the network server needs read access to the file.

[0010] If the correspondence between the change to the security posture and the intent is insufficient, at least one revision to the given intent is determined in such a way that when a new candidate network configuration is determined by the orchestration engine based on the revision, there is a better correspondence between the revised intent and the resulting change to the security posture of the network. This new candidate configuration is implemented in the communication network.

[0011] The inventors have found that a better correspondence between intents on the one hand and security postures on the other hand makes the security postures resulting from a given intent more understandable to the network operator. Previously, configuration elements related to security only appeared in a certain way above configuration elements related to providing only the desired communication. In the intent space, they were not visible to the network operator. Therefore, given a set of intents, it is difficult to monitor whether the security configuration of the network as a whole still meets all requirements. For example, the orchestration engine can convert the intent to make a specific set of files publicly available into the launch of a network server that exposes an entire directory or even an entire drive, with the desired files simply publicly available. In addition, the use of a specific video conferencing tool may require opening certain ports in the corporate firewall so that the participants of the meeting can communicate directly with each other. There are many more example applications where the default configuration works "out of the box" at the cost of granting more access rights than are absolutely necessary. To make the application work with minimal access rights, a more refined security configuration is required.

[0012] If security configurations are more transparent and visible in the intent space, it will be easier for network operators to adapt. In many cases, it is not possible to enjoy the full functionality of an application and the maximum security posture at the same time. Instead, some trade-offs will be necessary. That is, in order to improve the security posture, some functionality, performance, or ease of use must be sacrificed.

[0013] For example, a network operator may provide an intent to provision network resources to allow a certain bandwidth quality of service between two network devices. Straightforward intent-based network orchestration can satisfy this by pushing the right configuration into the network infrastructure and being implemented. More advanced intent-based network infrastructures may pull in additional (security) policies and the current network configuration to conclude that this communication flow can be isolated from the rest of the network without changing the outcome of the intent.

[0014] However, if intent-based network orchestration reaches this conclusion and automatically applies isolation to the flow, the intent does not fully match the actual resulting configuration. A better approach is to include the expectation for isolation in the intent. However, reasoning about the possibility or necessity of isolation occurs at a different level. Therefore, previously, such reasoning was not easily reflected in the intent. According to the present invention, a revision to the original given intent is determined. This revision can explicitly include the expectation for isolation.

[0015] In a particularly advantageous embodiment, at least one revision of a given intent includes an explicit intent to cause at least one selected change to the security posture according to the determined change. Thus, given this explicit intent, the selected change to the security posture is reasonably and clearly expected. This increases awareness and allows better monitoring of whether changes to the security posture are really acceptable, taking into account the importance of a given intent. In particular, changes can be better validated against specific security policies, such as a policy that does not allow machines used for production work to expose any network services to unauthenticated public access. In addition, some newly created intents may require approval from higher authorities, such as the head of the IT department or even management, before the resulting changes can be implemented in the network. For example, when a user selects a password, the estimated time (or dollar amount in cloud computing fees) for cracking the password can be displayed. The user can then decide whether to risk granting full access to his account to anyone willing to spend the money. In an extreme example, he might be met with a message like this: "Look, the standard version of software that anyone can download for free can crack this password faster than you can type it again into the confirmation box. Do you really want to use it?" In a corporate environment, a limit could be enforced whereby a password must cost at least a certain amount of money, or take longer to crack than the interval between regular password changes.

[0016] In other particularly advantageous embodiments, at least one modification to a given intent is selected to reduce or eliminate changes to the security posture compared to a candidate network configuration. That is, the security configuration is not only converted to its intent, but also improved. For example, each permission granted in the security configuration can be automatically tested to see if it is really necessary. For example, by default, the use of a communication application may require a specific set of permissions to enable all of its features, but the company using the application will rarely use the full set of features. Permissions that are only necessary for features that are not used anyway can be avoided. In this way, the security posture can automatically turn to the principle of least privilege: the most secure service is one that is not exposed (or not started at all) unless absolutely required. In addition, if the intent requires a certain type of service to be available (such as a web server), the modification may cause restrictions so that the web server with the least functionality required for the task at hand is exposed. For example, if only some static files are served, there is no need to expose a full-featured web server that has the functionality of more dynamic websites but also has a considerable attack surface to exploit. Instead, a simple web server that can't do anything except serving static files can be exposed.

[0017] In particular, at least one change to the security posture may include granting access rights to at least one network resource to a limited range of client machines and / or personnel. Reducing changes include reducing the range of machines and / or personnel, and / or reducing the amount of network resources to which access rights are granted. This can significantly reduce the exposed attack surface. For example, a large portion of security vulnerabilities are privilege escalation vulnerabilities, where an attacker with limited access rights to a resource (such as a normal user account on a computer) can extend such access rights to an unwanted level. But if the attacker does not have any access rights, then he cannot exploit the vulnerability. Thus, for example, reducing changes may include disabling any guest or other unauthenticated access to network resources. Furthermore, exploiting many vulnerabilities requires at least the ability to initiate a network connection (or at least send packets) to the service. Therefore, restricting access to a service at the network level (such as by filtering based on resource IP ranges) may not provide complete security for the service on its own, but may block a significant portion of attacks from the outside world. In many applications, it is not actually necessary to open a service to the world.

[0018] In other particularly advantageous embodiments, during the process of determining whether there is a sufficient correspondence between an intention and a change to the security posture, for at least one individual change to the security posture, it is checked whether the individual change complies with a predetermined policy. If this is the case, there are two options to proceed. For example, the individual changes that comply with the predetermined policy may be located in a predetermined list.

[0019] The first option is to determine that explicit intent causing individual changes is required for sufficient correspondence between intent and changes to the security posture. That is, the network operator should be fully aware of the security implications that the original given intent had. By approving the implementation of new candidate configurations based on the revised intent, the network operator acknowledges and approves these security implications. The security implications may also prompt the network operator to introduce more secure configurations, such as reorganizing machines with Internet-facing services into a "demilitarized zone" with limited access to the internal network.

[0020] The second option is to determine that the individual change in question must be reduced or eliminated for sufficient correspondence between the intent and the change to the security posture. That is, unless the intent is modified with the goal of reducing or eliminating the change, the change to the security posture is not considered to fully correspond to the intent.

[0021] Thus, in a given network, there may be a "yellow list" of changes to the security posture that only need to be explicitly reflected in the intent, and / or a "red list" (or "dirty dozen") of changes to the security posture that are intolerable and need to be corrected before implementation on the network. This approach may be similar to a "security co-pilot", informing the network operator about security risks and, depending on the severity of these risks, giving him the choice of explicitly acknowledging these risks and therefore consciously taking them on, or even requiring him to mitigate them.

[0022] A security co-pilot can be a component that walks the entire process from high-level intent formulation to the resulting configuration and configuration change analysis. It can perform the reasoning itself with predefined security policies or use attached tools to perform security analysis of the resulting network configuration. The result of this process is an understanding of the relationship between high-level intent and the security properties of configuration changes.

[0023] This understanding can then be reflected at the intent level to the network operator working on their intent. This provides immediate and actionable feedback to improve intent regarding security attributes, or include implicit security attributes in intent to properly reflect them and make them visible and maintainable.

[0024] Enabling technologies for the safety co-pilot’s understanding, reasoning, and intention formulation can be:

[0025] Natural language processing of intent and formulation of intent;

[0026] Large language models (such as ChatGPT), used to provide user interfaces or intent formulation;

[0027] Security analysis of network configuration (e.g. using third-party tools); and

[0028] Matching of security configuration and security policy.

[0029] The tool can present itself in a user interface for intent configuration. When the network operator configures the intent, the tool can reason about the formulated intent in the background and provide security guidance in the form of suggestions or warnings at the intent level without requiring the network operator's security expertise to act directly.

[0030] This is already useful during the initial intent configuration, but especially when changes or additions are made to the intent configuration afterwards, differential analysis will provide deeper insight into security-relevant changes and allow or even force network operators to account for these changes.

[0031] In particular, at least one change to a security posture that complies with a predetermined policy, for example, by appearing on a predetermined ("yellow" or "red") list, can include granting public access rights to at least one resource in the network. In many network services (such as network servers, network shares, or remote access servers), public access rights are enabled by default, but are not required for the intended job. For example, if it is known which countries employees from need remote VPN access, then access rights can be restricted to those countries. This may be only a few countries, so attacks from most countries can be blocked from the outset. At a more granular level, many services are configured by default to grant access rights to all authenticated users, even though there may be only a limited number of users who need to use them. Therefore, network operators may be forced to confirm that everyone is really required to have access rights, or forced to restrict access to specified users.

[0032] As an alternative to, or in conjunction with, "yellow" and "red" lists of changes to the security posture, such individual changes may be rated using a quantitative metric (e.g., measuring their severity). For example, it may be specified that if this rating (either for an individual change or cumulatively for all changes) exceeds a predetermined threshold, then the correspondence between intent and changes to the security posture is insufficient.

[0033] In other particularly advantageous embodiments, evaluating changes to the security posture and / or determining remediations is based at least in part on a security policy that governs the determination of candidate network configurations based on a given intent. Previously, when an orchestration engine translated an intent into a network configuration, the network configuration was a sort of "convolution" of the original intent with the security policy. This security policy can now be more evident in the space of the original intent, making it easier to check compliance with this policy.

[0034] In other particularly advantageous embodiments, at least one modification to a given intent is queried from a trained machine learning model. The orchestration engine converts the intent into a candidate network configuration and also modifies the security posture accordingly. The machine learning model can learn some inverse function of this process so that it can map changes to the security posture to corresponding modifications to the intent.

[0035] In another particularly advantageous embodiment, in the process of determining at least one modification to a given intent, a new correspondence between the intent and the change to the security posture can be determined for a plurality of candidate modifications. That is, for a new intent obtained by applying at least one modification to the original given intent, a candidate network configuration is determined by the orchestration engine in a usual manner. The changes to the security posture contained in the candidate network configuration are then checked for how they correspond to the modified intent. In particular, this process can be performed in an automated manner for many candidate modifications spanning an appropriate search space. The candidate modification with the best new correspondence between the intent and the change to the security posture is then selected as the modification to be finally applied to the original given intent. In this way, the correspondence between the intent and the change to the security posture can be optimized without using a gradient-based numerical optimization method. Since the problem is a "mixed integer problem", that is, some variables of the problem are discrete, it is difficult to apply such a method: for example, you can only grant or not grant specific access rights; you cannot grant access rights of 0.4 or 0.6 degrees.

[0036] Regardless of the manner in which new remediation suggestions are obtained, the goal may always be that when a remediation intent is provided to a given orchestration engine, this will only result in changes to the security posture that satisfy at least one predetermined criterion regarding the correspondence between those changes and the remediation intent.

[0037] As previously mentioned, in other particularly advantageous embodiments, the network operator is prompted to confirm the revised intent that generated the new candidate configuration before the new candidate configuration is implemented in the communication network. In this way, the network operator can explicitly approve the change to the security posture at the intent level (i.e., in the same space where the original given intent was formulated).

[0038] In particular, a plurality of new candidate configurations may be determined based on different candidate modifications. The network operator may be prompted to select a candidate modification. In this way, a preselection of new candidate modifications may be determined that all have sufficient correspondence with changes to the security posture in the resulting candidate configuration. Based on the preselection, the network operator may make a final selection of the intended modification based on any particular needs.

[0039] In particular, multiple new candidate configurations, and thus multiple new candidate revisions, may represent different trade-offs between the range of desired functionality on the one hand and the security posture of the network on the other hand. As mentioned before, it is usually not possible to enjoy the full range of available functionality and the highest level of security at the same time. At least one or both sides have to make sacrifices. The network operator can choose to sacrifice the aspect that is least harmful to the specific application at hand. That is, the pre-selection of alternatives is generated in an automated manner, and the network operator only needs to make one decision that is particularly difficult to automate.

[0040] Because it is computer-implemented, the method can be embodied in the form of software. Therefore, the present invention also relates to a computer program with machine-readable instructions, which, when executed by one or more computers and / or computing instances, cause one or more computers and / or computing instances to perform the above method. Examples of computing instances include virtual machines, containers, or serverless execution environments in the cloud. The present invention also relates to a machine-readable data carrier and / or a download product with a computer program. A download product is a digital product with a computer program that can be sold, for example, in an online store to be immediately completed and downloaded to one or more computers. The present invention also relates to one or more computing instances with a computer program and / or with a machine-readable data carrier and / or a download product. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In the following, the present invention is described using the accompanying drawings, without any intention to limit the scope of the present invention. The accompanying drawings show:

[0042] Figure 1 : An exemplary embodiment of a method 100 for configuring a communication network based on a given intent;

[0043] Figure 2 :For an exemplary given meaning Figure 2 An illustration of the effect of method 100 is provided. DETAILED DESCRIPTION

[0044] Figure 1 It is used based on a given intention Figure 2 A schematic flow chart of an embodiment of a method 100 for configuring a communication network 1 is provided. Figure 2 At least a given form of providing communication is included. In particular, such communication may be between two given entities 1a, 1b, or from one entity to a plurality of other entities, such as to the public Internet. It is not required that both entities 1a and 1b are located in the network 1; instead, one of them may reside outside the network 1, such as on the Internet.

[0045] In step 110, a given orchestration engine 3 Figure 2Determine a candidate network configuration 4. When this candidate network configuration 4 is implemented in the communication network 1, Figure 2 is realized.

[0046] In step 120, according to the intention Figure 2 and / or determining, based on the candidate network configuration 4 , one or more changes 5 to the security posture of the network resulting from the candidate network configuration 4 .

[0047] In step 130 , it is determined whether there is a sufficient correspondence between the intention and the modification 5 to the security posture based on at least one given criterion.

[0048] According to block 131, for at least one individual modification 5 to the security posture, it can be checked whether the individual modification 5 complies with a predetermined policy. If this is the case (true value is 1), it can,

[0049] According to block 132, it is determined that an explicit intent is required to cause an individual change 5 for the purpose of intent. Figure 2 and a sufficient correspondence between the change 5 to the security posture (if the individual change 5 is on the "yellow list" as described above), or

[0050] According to block 133, it is determined that individual changes 5 must be reduced or eliminated for the intended Figure 2 and a sufficient correspondence between changes 5 to the security posture (if the individual change 5 is on the "red list" as described above).

[0051] For example, individual changes 5 that comply with a predetermined policy may be located in a predetermined list.

[0052] According to block 131 a , the at least one modification 5 in compliance with the predetermined policy may include granting public access rights to at least one resource in the network 1 .

[0053] In step 140, in response to determining the intention Figure 2 The correspondence between the change 5 to the security posture is insufficient (the truth value is 0 at step 130), and it is determined that Figure 2 The goal is to Figure 2 When the new candidate network configuration 4a is determined by the orchestration engine 3, the modified Figure 2 , there is a better correspondence between 2a and the resulting change 5a to the security posture of network 1.

[0054] According to block 141, for a given Figure 2 The at least one modification 2a may comprise an explicit intention to cause a modification of at least one selection of the security posture according to the determined modification 5 .

[0055] According to block 142, for a given Figure 2 At least one modification 2a of may be selected to reduce or eliminate changes 5 to the security posture compared to the candidate network configuration 4 .

[0056] In particular, according to block 142a, at least one change 5 to the security posture may include granting access rights to at least one network resource to a limited range of client machines and / or personnel. According to block 142b, reducing the change 5 includes reducing the range of machines and / or personnel, and / or reducing the amount of network resources to which access rights are granted.

[0057] According to block 143, for a given Figure 2 At least one correction 2a of can be queried from a trained machine learning model. In particular, such a machine learning model can receive one or more changes 5 to the security posture as input and produce the sought correction 2a as output.

[0058] According to block 144, for a plurality of candidate revisions 2a, it is possible to determine which revisions are of interest. Figure 2 , 2a and the resulting new correspondence between the change 5 to the security posture. According to block 145, it is possible to select Figure 2 , the candidate correction 2a* having the best new correspondence between 2a* and the change 5 to the security posture is taken as correction 2a.

[0059] According to block 146, a plurality of new candidate configurations 4a may be determined based on the different candidate revisions 2a. In particular, according to block 146a, the plurality of new candidate configurations 4a may represent different trade-offs between the range of desired functionality on the one hand and the security posture of the network 1 on the other hand.

[0060] In the attached Figure 1 In the example shown in FIG. 1 , in step 150, the network operator confirms the intention to generate a new candidate configuration 4a. Figure 2 , 2a, in order to approve the new candidate configuration 4a before applying it to the communication network 1.

[0061] In particular, according to block 151 , the network operator may be prompted to select a candidate revision 2 a from the plurality of candidate revisions 2 a that have been determined according to block 146 .

[0062] In step 160 , the new candidate configuration 4 a is implemented in the communication network 1 .

[0063] Figure 2 An exemplary embodiment is described Figure 2 In this example, given the intention Figure 2It includes providing a service 1c from a first entity 1a to a second entity 1b.

[0064] When the intention Figure 2 One candidate network configuration 4, when processed by a given orchestration engine 3, is to expose service 1c on system 1d so that system 1d can provide it to second entity 1b when second entity 1b sends request R. This achieves the goal according to the original intent - making the service available from first entity 1a to second entity 1b. But the change 5 to the security posture includes that anyone in the world can send request R to system 1d and use service 1c.

[0065] This method 100 makes these changes 5 care Figure 2 transparent at the level of Figure 2 Amendment 2a of the Figure 2 Better correspondence with change 5 to security posture.

[0066] exist Figure 2 In the example shown, Figure 2 The modification 2a causes the candidate network configuration 4 to be amended to a new candidate network configuration 4a. The service 1c is placed on a system 1e with access control, marked by a lock. The first entity 1a provides a key to the second entity 1b. With this key, the second entity 1b can use the service 1c from the system 1e. The change 5a to the security posture is that there is no public access to the service 1c.

[0067] Reference numerals

[0068] 1 Communication Network

[0069] 1a, 1b Entity

[0070] 1c Files to be transferred

[0071] 1d Internet-facing web server

[0072] 1e Network Attached Storage

[0073] 2 Given Intent

[0074] 2a. Giving Intentions Figure 2 Correction

[0075] 2a* Optimal correction 2a

[0076] 3 Orchestration Engine

[0077] 4 Based on intention Figure 2 Candidate network configurations for

[0078] 4a New candidate network configuration based on modification 2a

[0079] 5 Changes to Network 1’s Security Posture

[0080] 5a New changes to the security posture after revision 2a

[0081] 100 Method for configuring a communication network 1 110 Determine candidate network configuration 4

[0082] 120 Identify changes to security posture5

[0083] 130 Confirm your intention Figure 2 Is the correspondence sufficient?

[0084] 131 Check if change 5 complies with the predetermined policy

[0085] 131a Public access rights as items that comply with predetermined policies

[0086] 132 Determine the need for clarity of intent

[0087] 133 Identify need for reduction / elimination

[0088] 140 Confirmation Amendment 2a

[0089] 141 Clear intention as amendment 2a

[0090] 142 Reduction or elimination of change 5 as amendment 2a 142a The scope of access rights granted is changed as 5 142b Reduce range as a reduction of change 5 143 Querying Revision 2a from Machine Learning Models 144 Evaluate multiple candidate fixes 2a*

[0091] 145 Select the best candidate correction 2a*

[0092] 146 Determine multiple candidate configurations 4a

[0093] 146a Different trade-offs between functionality and security 150 Prompt network operator to confirm 151 Choose between multiple candidate revisions 2a 160 Implementing new candidate network configuration 4a R Request

Claims

1. A computer-implemented method (100) for configuring a communication network (1) based on a given intention (2), the intention (2) comprising at least providing a given form of communication, the method (100) comprising the following steps: Determining (110) a candidate network configuration (4) according to the given intent (2) through a given orchestration engine (3), and causing the given intent (2) to be realized when the candidate network configuration (4) is realized; Based on the intent (2) and / or based on the candidate network configuration (4), determining (120) one or more changes (5) to the security posture of the network (1) resulting from the candidate network configuration (4); determining (130) whether there is a sufficient correspondence between the intention (2) and the modification (5) to the security posture based on at least one given criterion; In response to determining that the correspondence is insufficient, determining (140) at least one revision (2a) to the given intent (2) such that when a new candidate network configuration (4a) is determined by the orchestration engine (3) based on the revision (2a), a better correspondence exists between the revised intent (2, 2a) and the resulting change (5a) to the security posture of the network (1); as well as The new candidate network configuration (4a) is implemented (160) in the communication network (1).

2. A method (100) according to claim 1, wherein at least one modification (2a) of the given intention (2) includes (141) an explicit intention, wherein the explicit intention is used to cause at least one selected change to the security posture based on the determined change (5).

3. The method (100) according to any one of claims 1 to 2, wherein at least one modification (2a) to the given intention (2) is selected (142) for reducing or eliminating changes (5) to the security posture compared to the candidate network configuration (4).

4. The method (100) of claim 1, wherein: At least one change (5) to the security posture includes (142a) granting access rights to at least one network resource to a limited range of client machines and / or persons; and Reducing the changes (5) includes (142b) reducing the scope of machines and / or personnel, and / or the amount of network resources to which access rights are granted.

5. The method according to any one of claims 1 to 4, wherein determining whether there is a sufficient correspondence between the intention (2) and the change (5) to the security posture comprises: For at least one individual modification (5) to the security posture, checking (131) whether the individual modification (5) complies with a predetermined policy; And if that's the case, For sufficient correspondence between intentions (2) and changes (5) to the security posture, determining (132) the explicit intentions required to cause the individual changes (5); or For adequate correspondence between intent (2) and changes (5) to the security posture, it is determined (133) that the individual changes (5) should be reduced or eliminated.

6. The method (100) of claim 5, wherein at least one modification (5) in accordance with the predetermined policy comprises (131a) granting public access to at least one resource in the network (1).

7. The method (100) according to any one of claims 1 to 6, wherein evaluating the change to the security posture (5) and / or determining the correction (2a) is at least partially based on a security policy, and the security policy management determines the candidate network configuration (4) according to the given intention (2).

8. The method (100) according to any one of claims 1 to 7, wherein at least one modification (2a) to the given intention (2) is queried (143) from a trained machine learning model.

9. The method (100) according to any one of claims 1 to 8, wherein determining at least one modification (2a) to the given intention (2) comprises: determining (144), for a plurality of candidate revisions (2a), a new correspondence resulting between the intention (2, 2a) and the change (5) to the security posture; as well as The candidate revision (2a*) having the best new correspondence between the intention (2, 2a*) and the modification (5) to the security posture is selected (145).

10. The method (100) according to any one of claims 1 to 9, further comprising: Prior to implementing (160) the new candidate configuration (4a) in the communication network (1), a network operator is prompted (150) to confirm the modification intention (2, 2a) generating the new candidate configuration (4a).

11. The method (100) of claim 10, wherein a plurality of new candidate configurations (4a) are determined (146) based on different candidate revisions (2a), and the network operator is prompted (151) to select one candidate revision (2a).

12. The method (100) of claim 11, wherein the plurality of new candidate configurations (4a) represent (146a) different trade-offs between the range of desired functionality on the one hand and the security posture of the network (1) on the other hand.

13. A computer program comprising machine-readable instructions which, when executed by one or more computers and / or computing instances, cause the one or more computers and / or computing instances to perform the method (100) according to any one of claims 1 to 12.

14. A non-transitory machine-readable data carrier and / or a download product having a computer program as claimed in claim 13.

15. One or more computers and / or computing instances having a computer program as claimed in claim 13 and / or having a machine-readable data carrier and / or a download product as claimed in claim 14.

Images