METHOD AND DEVICE FOR CONFIGURING AN ACCESS CONTROL SYSTEM

Description

[0001] The invention relates to a computer-implemented method and a device for configuring an access protection system suitable for regulating a data communication connection of a computer-implemented application between a first computer network and a second computer network. Furthermore, the invention is directed to a device, a test system, an access protection system, a computer program product, and a computer-readable data carrier. EP3232639 A1 discloses a method for creating filter rules for a firewall for controlling the information flow between two systems in the avionics environment based on captured test network packets. US2018176261 A1 discloses a method for creating distributed firewall rules based on monitored network traffic for a series of virtual machines forming an application.

[0002] A communication connection between computer systems, computers, or networks is typically protected by an access protection system, such as a firewall or security gateway, which typically controls the transmission of data packets from one network to another. A secure configuration of such an access protection system is generally based on the least privilege principle, meaning that only communication required by a system behind the access protection system is permitted or enabled via the access protection system.

[0003] The definition of necessary communication connections and the corresponding configuration of the access protection system is usually done manually and can therefore be complex and error-prone, especially in agile software development.

[0004] It is therefore an object of the present invention to simplify the configuration of an access protection system that controls a data communication connection between computers or computer networks.

[0005] This object is achieved by the measures described in the independent claims. Advantageous developments of the invention are presented in the dependent claims.

[0006] According to a first aspect, the invention relates to a computer-implemented method for configuring an access protection system suitable for regulating a data communication connection of a computer-implemented application between a first computer network and a second computer network, wherein the computer-implemented application is provided, an image of the first computer network is provided in a test system and the computer-implemented application is executed therein, a data communication connection between the image of the first computer network and the second computer network, which is necessary for the execution of the computer-implemented application, is determined by a sensor, a configuration rule for the access protection system for permitting the data communication connection of the computer-implemented application between the first computer network and the second computer network is derived from the data communication connection determined by the sensor, and the configuration rule for configuring the access protection system is output.

[0007] It is an advantage of the present invention that a configuration rule for an access protection system for communication between a first and a second computer network can be determined automatically. For this purpose, a computer-implemented application, such as a software or application or an executable program, is executed, and from this it is determined which connections or communication relationships at the network level are required for the application or software to a second computer network. The computer-implemented application can preferably be executed in a production environment comprising at least a first and / or a second computer network, or in a test system comprising at least one image of the first computer network. The production environment can be understood in particular as the network environment with real conditions.A test system, or hereinafter also referred to as a test environment, can be understood in particular as a (software) development environment. The test system can, in particular, be provided and / or configured in advance. An "image of a computer network" can, in particular, be understood as a reconstruction of the computer network or a part of the computer network, comprising all relevant network components and connections, which is implemented, for example, in the test system.

[0008] It is assumed in particular that a data communication connection, i.e. an exchange or sending and / or receiving of data, between the first computer network and the second computer network in a production environment takes place via at least one access protection system, such as a firewall or a security gateway. At least one configuration rule is to be determined for this access protection system on the basis of the data communication connection or data traffic detected by a sensor. The configuration rule can comprise an entry and / or access rule and should in particular be formulated in such a way that this data communication connection is permitted when the computer-implemented application is executed in the production environment. A sensor can, for example, be part of a network interface or an access protection system or be understood as a separate device which in particular only forwards data traffic and records it in the process.In particular, a sensor can also be designed as software so that, for example, data traffic occurring between two computer networks can be read and communication relationships can be derived from it.

[0009] The test system can be shielded from other communication relationships or protected. For example, the test system is a so-called "sandbox" environment. This has the particular advantage that only those communications relevant to the computer-implemented application take place in the test system. The effect of the executed communication of the computer-implemented application, such as connection requests, can be recorded within the test system. A computer-implemented application can be executed in the test system without damaging, modifying, or disrupting a system.

[0010] The image of the first computer network in the test system can in particular be similar to that in the production environment, e.g. with regard to network topology or architecture. The test system is in particular set up such that data communication originating from a computer-implemented application can be imaged or simulated and recorded using a sensor. The image of the first computer network can, for example, be connected to the second computer network via a network interface so that data communication between the two networks can take place and be recorded. This has the particular advantage that, on the one hand, a computer-implemented application is executed in a protected test system, but, on the other hand, data communication with the second computer network can be analyzed under real conditions with regard to the second computer network.

[0011] At least one rule for an access control system in the production environment is derived from a recorded data communication connection of the computer-implemented application. "Derive" can be understood, for example, as "determine," "calculate," "obtain," "determine," "restrict," "infer," "conclude," "infer," "infer," or similar.

[0012] Unless otherwise stated in the following description, the terms "determine", "perform", "provide", "occur", "calculate", "computer-aided", "calculate", "determine", "generate", "configure", "reconstruct" and the like preferably refer to actions and / or processes and / or processing steps that change and / or generate data and / or convert the data into other data, wherein the data can be represented or present in particular as physical quantities.

[0013] In the context of the invention, "computer-aided" or "computer-implemented" can be understood as meaning, for example, an implementation of the method in which, in particular, a processor carries out at least one method step of the method.

[0014] In the context of the invention, a processor can be understood as, for example, a machine or an electronic circuit. A processor can be, in particular, a central processing unit (CPU), a microprocessor, or a microcontroller, for example, an application-specific integrated circuit or a digital signal processor, possibly in combination with a memory unit for storing program instructions, etc.

[0015] In particular, the computer-implemented method can be realized in a cloud, whereby both the production environment and the test system can be implemented in the cloud.

[0016] In an advantageous embodiment of the computer-implemented method, an image of the second computer network can additionally be provided in the test system, and the data communication connection of the computer-implemented application can be determined by a sensor only between the image of the first computer network and the image of the second computer network.

[0017] In particular, both the first computer network and the second computer network, with which, for example, the computer-implemented application establishes a communication connection, can be mapped in the test system. This has the advantage, for example, that all communication between the two networks takes place in a shielded environment, meaning it cannot be disrupted by unwanted communication. Furthermore, multiple second computer networks can also be mapped in the test system.

[0018] In an advantageous embodiment of the computer-implemented method, the configuration rule can be derived such that, according to the configuration rule, only a trusted and / or permitted data communication connection of the computer-implemented application is permitted via the access protection system.

[0019] This allows, in particular, a configuration rule for the access protection system to be derived according to the least-privilege principle. Only those connections of a computer-implemented application that are permitted, required for the application, and / or trusted are executed and recorded. The configuration rule can then advantageously allow only these connections.

[0020] In an advantageous embodiment of the computer-implemented method, a data communication connection from the second computer network or the image of the second computer network to the image of the first computer network can be prevented in the test system.

[0021] Preferably, a data communication connection, for example, access by another software or computer-implemented application, to the image of the first computer network cannot be enabled or permitted in the test system. This can be achieved, for example, by only executing predefined computer-implemented applications in the test system.

[0022] In an advantageous embodiment of the computer-implemented method, the data communication connection of the computer-implemented application between the image of the first computer network and the second computer network or the image of the second computer network can be simulated in the test system.

[0023] The data communication connection between the computer networks, and in particular external communication, can be at least partially simulated in the test system by means of a computer-aided simulation of the data communication connection. For example, a request from a computer-implemented application can be processed with only a simulated response, such as simulated return values. Furthermore, in particular, only a portion of a computer network can be mapped in the test system, with communication relationships being at least partially simulated.

[0024] In an advantageous embodiment of the computer-implemented method, a data communication connection of the computer-implemented application, which is established between the first computer network and the second computer network via more than one access protection system, can be determined by more than one sensor, and for each of these access protection systems, a configuration rule for permitting the data communication connection of the computer-implemented application can be derived.

[0025] For example, in the test system, the implemented data communication connection between the image of the first computer network and the second computer network, or the image of the second computer network, can be established via more than one network node, e.g., a router, to the second computer network. The corresponding network nodes and the corresponding communication across them can be determined, for example, by at least one sensor, and a configuration rule can be derived for each of the network nodes.

[0026] In an advantageous embodiment of the computer-implemented method, the type of data communication connection of the computer-implemented application can be determined.

[0027] For example, information or details, such as a communication protocol, can be recorded for data communication from a sensor.

[0028] In an advantageous embodiment of the computer-implemented method, a communication characteristic can be determined from the type of data communication connection of the computer-implemented application and a configuration rule for the access protection system can be derived therefrom.

[0029] For example, a communication protocol can be used to determine which type of communication should be permitted via the access control system or which type of communication is typical. The access control system can use this protocol to check whether a given communication is typical.

[0030] In an advantageous embodiment of the computer-implemented method, the configuration rule can be provided from the test system to a productive environment that is at least similar to the test system for configuring the access protection system.

[0031] The configuration rule determined from the recording of the data communication connection of the computer-implemented application in the test system can preferably be automatically deployed to the production environment for configuring the access protection system.

[0032] In an advantageous embodiment of the computer-implemented method, the access protection system can be configured according to the configuration rule.

[0033] In particular, the access protection system can be automatically configured, i.e. set or programmed, according to the configuration rule.

[0034] In an advantageous embodiment of the computer-implemented method, a configuration instruction for configuring the access protection system according to the configuration rule can be determined and output for a configuration of the access protection system.

[0035] For example, a computer-readable configuration script can be created that includes the configuration rule and can be used to control the access protection system in order to configure it in the production environment according to the configuration rule.

[0036] In an advantageous embodiment of the computer-implemented method, the configuration rule and / or the configuration instructions can be digitally signed.

[0037] A digital signature can, for example, contain time information, information about the test system, or the name of a user or the computer-implemented application. The digital signature can thus serve, in particular, as integrity protection. In particular, the configuration rule and / or configuration instructions can be verified using the digital signature, e.g., before they are implemented in the production environment.

[0038] According to a further aspect, the invention relates to a device for configuring an access protection system suitable for regulating a data communication connection of a computer-implemented application between a first computer network and a second computer network, comprising: a first provision module configured to provide the computer-implemented application and an image of the first computer network in a test system, an application module configured to execute the computer-implemented application in the image of the first computer network in the test system, a sensor configured to determine a data communication connection between the image of the first computer network and the second computer network that is necessary for executing the computer-implemented application, a derivation module configured to derive a configuration rule for the access protection system for permitting the data communication connection of the computer-implemented application between the first computer network and the second computer network based on the data communication connection determined by the sensor, and an output module configuredthe configuration rule for configuring the access protection system. ,

[0039] In particular, the sensor can detect the data communication connection of the computer-implemented application in the test system or in the production environment.

[0040] In an advantageous embodiment, the device may comprise a configuration module configured to configure the access protection system according to the configuration rule.

[0041] The device is particularly designed to carry out the steps of a computer-implemented method according to the invention.

[0042] According to a further aspect, the invention relates to a test system comprising a device according to the invention.

[0043] Preferably, the test system, also referred to as test environment, can be coupled to a configuration module.

[0044] According to a further aspect, the invention relates to an access protection system which is suitable for regulating a data communication connection of a computer-implemented application between a first computer network and a second computer network and which is configured according to a method according to the invention.

[0045] Furthermore, the invention relates to a computer program product that can be loaded directly into a programmable computer, comprising program code parts that are suitable for carrying out the steps of a method according to the invention and a computer-readable data carrier on which the computer program product is stored.

[0046] In particular, a computer program product according to the invention can be provided by a network service, a computer system, a server system, a distributed computer system, a cloud-based computer system, and / or a virtual computer system. The provision can be made, for example, as a download in the form of a program data block and / or command data block, preferably as a file, in particular as a download file, of the complete computer program product. Such a computer program product is read in, for example, using a provision device, in particular in the form of a computer-readable data carrier, and executes the program commands, so that the method according to the invention is executed on a computer.

[0047] Exemplary embodiments of the method according to the invention, the device according to the invention, the access protection system according to the invention, and the test system according to the invention are illustrated by way of example in the drawings and are explained in more detail in the following description. They show: Fig. 1 shows a flow diagram of a method according to the invention; Fig. 2 shows a schematic representation of an embodiment of a method according to the invention; Fig. 3 shows a second schematic representation of a second embodiment of a method according to the invention; Fig. 4 shows a third schematic representation of a third embodiment of a method according to the invention; Fig. 5 shows a fourth schematic representation of a fourth embodiment of a method according to the invention; and Fig. 6 shows a schematic representation of an embodiment of a device according to the invention in block diagram.

[0048] Corresponding parts are provided with the same reference numerals in all figures.

[0049] Figure 1shows a flow diagram of a method according to the invention for configuring an access protection system which regulates or controls a data communication connection of a computer-implemented application, such as an application or software, between a first computer network and a second computer network, such as restricting access or allowing data packets to pass through. The first computer network is connected to the second computer network, for example, via the access protection system, such as a firewall. The software or application can in particular be executed in the first computer network and require a data communication connection to the second computer network. For example, a computer-implemented application can control a technical system in the first computer network, wherein the computer-implemented application requests parameter data from a database arranged in the second computer network.According to the invention, at least one configuration rule for configuring the access protection system is to be determined. The method can be carried out in a productive environment or in a test environment, also referred to as a (software) development environment, which in particular is at least partially similar to the productive environment. In particular, a computer-implemented application can be tested or developed in the test system, i.e. in a test environment, and then installed in the productive environment. The productive environment is in particular the software environment where the computer-implemented application is fully executed. The test system is preferably shielded, i.e. for example only trusted and / or necessary communication connections are permitted. Data communication into the test system can in particular be prevented, or only data communication out of the test system can be enabled.

[0050] In the first step S1 of the method, a computer-implemented application is provided. Subsequently, at least one configuration rule for the access protection system is to be determined that permits a data communication connection originating from the computer-implemented application between the first and second computer networks.

[0051] In the next step S2a or S2b, the computer-implemented application is executed in the production environment or in the test environment. In step 2a, the computer-implemented application is executed in the first computer network, i.e., in the production environment. Alternatively, in step 2b, an image of the first computer network or at least a portion of the first computer network is provided in a test environment, and the computer-implemented application is executed therein. The image of the first computer network in the test environment is preferably similar to the first computer network in the production environment with regard to network topology. The first computer network or the test system is connected to the second computer network.

[0052] In particular, the computer-implemented application is executed in such a way that all communication relationships with other applications in the first computer network or in the image of the first computer network and with the second computer network that are necessary or desired during execution can be determined.

[0053] In the next step S3, each required data communication connection of the computer-implemented application in the first computer network or in the image of the first computer network and / or each connection to the second computer network is recorded by means of a sensor, i.e. it is determined, for example, which data communication connection is established by the computer-implemented application. The type of data communication connection, such as the communication protocol, can also be recorded, and from this information, for example, typical access patterns can be derived. In particular, the data communication connection between the first computer network and the second computer network is to be recorded, which runs in the production environment via the access protection system to be configured. For example, a sensor can be installed at the location of the access protection system and thus determine the data communication connection.

[0054] In the next step S4, at least one configuration rule for the access protection system is derived based on the data communication connection between the two computer networks detected by the sensor, which is required for running the computer-implemented application. A communication characteristic can be determined from the type of data communication, e.g. which data is transmitted, requested, or sent. For example, in order to only permit the data communication connection between the first and second computer networks required for the computer-implemented application, a configuration rule for the access protection system can be created that does not permit any further data traffic. In the shielded test system, therefore, in particular, only one trusted data communication connection from a first computer network to a second computer network can be detected, and configuration rules for access protection systems can be created accordingly.In other words, the test environment can preferably be implemented in a shielded manner, so that only the necessary data communication connection of a computer-implemented application is established. This is determined using a sensor, and a configuration rule is derived.

[0055] In step S5, the derived configuration rule is output. The configuration rule can be transferred from the test system to the production environment, where a corresponding access protection system can be configured according to the configuration rule.

[0056] Additionally, a configuration guide, such as a configuration script, can be created according to the configuration rule. This can be executed, for example, by a configuration module, so that the access protection system is configured according to the configuration rule.

[0057] The configuration rule and / or the configuration instructions can also be digitally signed, for example to prove their origin or integrity.

[0058] Figure 2shows a schematic illustration of an exemplary embodiment of a computer-implemented method according to the invention. A productive environment PE is shown. The productive environment PE can in particular be understood as a real network environment. The productive environment PE comprises a first computer network NW1 and a second computer network NW2, which are connected to one another via a communication connection for transmitting a data communication DC of a computer-implemented application APP. An access protection system FW, e.g. a firewall, can regulate and / or control the data communication DC. For this purpose, according to a method according to the invention, at least one configuration rule for an access protection system FW according to the invention is to be determined. The configuration rule is to be set up in such a way that in particular the data communication DC of the computer-implemented application APP is permitted.

[0059] For this purpose, the computer-implemented application APP is executed in the first computer network NW1, and the data communication DC of the computer-implemented application APP to the second computer network NW2 is recorded using a sensor 103. Based on the determined data communication connection DC, a rule can be derived and output as a configuration rule for the access protection system FW. For example, the configuration rule only includes access rights for this specific data communication connection DC, thus excluding all other possible data connections.

[0060] In particular, the determined configuration rule includes setting values ​​for the access protection system FW, with which the access protection system FW is configured in such a way that the data communication connection DC can be carried out via the access protection system, i.e. is not blocked or restricted.

[0061] Figure 3schematically shows a second embodiment of a method according to the invention. A test system TE, such as a sandbox, is shown. In order to determine a configuration rule for an access protection system that regulates a data communication connection between a first computer network and a second computer network, an image of each of the two computer networks NW1`, NW2` is provided in the test system TE. For example, the first computer network is a secure network and the second computer network is a public network, so that the communication of a computer-implemented application APP from the first computer network to the second computer network is to be regulated.

[0062] The computer-implemented application APP is executed in the test system TE. For example, the computer-implemented application APP exchanges data with various software SW1, SW2, and SW3 in the first computer network NW1' and with the computer network NW2'. Alternatively, at least part of this data communication connection DC can also be simulated using a computer-aided simulation, so that, for example, only simulated data is returned upon request.

[0063] By means of a sensor 103, which can be installed in the test system, for example, instead of an access protection system, the data communication connection DC of the computer-implemented application APP between the first computer network NW1' and the second computer network NW2' can be detected. Depending on the recorded data communication DC, a configuration rule for an access protection system in the production environment can be determined. Preferably, a configuration rule based on the least-privilege principle can be derived.

[0064] In Figure 4A further exemplary embodiment of a computer-implemented method according to the invention is shown in a schematic representation. It shows an image of a first computer network NW1` in a test environment TE. The test environment TE is connected to the production environment PE via a communication link, so that in particular data communication DC of the computer-implemented application APP between the image of the first computer network NW1` and the second computer network NW2 is enabled. In addition, data transmission DT of another computer-implemented application APP` from the second computer network NW2 into the test environment TE can be prevented or restricted. For example, the sending of data from the second network NW2 into the test environment TE can thus be prohibited. For example, only a connection to the Internet can be enabled for the test environment.

[0065] The production environment PE further comprises a firewall FW, which regulates, controls, and / or restricts the data flows between the first computer network NW1 and the second computer network NW2. To determine a configuration rule for the firewall FW, a computer-implemented application APP is executed in the image of the first computer network NW1 in the test environment TE, and the required data communication DC is recorded using sensor 103.

[0066] Based on the recorded data communication DC, at least one configuration rule is then derived. Additionally, a configuration script can be created that includes configuration instructions for the firewall FW according to the configuration rule.

[0067] In Figure 5a further embodiment of a method according to the invention is shown. A computer-implemented application APP is executed in the first computer network NW1 in order to record the data communication DC in the second computer network NW2 of the production environment PE. The data communication DC between the two computer networks NW1, NW2 in the production environment PE takes place via a plurality of network nodes, such as routers, for whose access protection systems FW1, FW2, FW3 a configuration rule is to be determined. For this purpose, the individual network nodes and the data communication running via them between the first computer network NW1 and the second computer network NW2 can first be determined using a sensor 103. A configuration rule is then derived for each access protection system FW1, FW2, FW3 and then implemented.

[0068] Figure 6shows an embodiment of a device 100 according to the invention for configuring an access protection system suitable for regulating data communication of a computer-implemented application between a first computer network and a second computer network. The device is preferably coupled to an access protection system according to the invention. The device 100 comprises a provision module 101, an application module 102, at least one sensor 103, a derivation module 104, an output module 105, and a configuration module 106. The device can further comprise at least one processor configured to execute at least one of the steps of a method according to the invention.

[0069] The provisioning module 101 is configured to provide a computer-implemented application to be executed in the first computer network. Furthermore, the provisioning module can provide an image of the first computer network and / or an image of the second computer network in a test system. The application module 102 is configured to execute the computer-implemented application in the production environment or in the test system, such that the data communication connection of the computer-implemented application APP between the first computer network and the second computer network can be recorded by means of the sensor 103. The derivation module 104 is configured to derive a configuration rule for an access protection system in the production environment based on the recorded data communication. The determined configuration rule is transmitted, for example, to the configuration module 106 by means of the output module 105.The configuration module 106 is configured to configure an access protection system according to the configuration rule and / or by means of configuration instructions. In particular, a configuration module can configure an access protection system according to the configuration rule in such a way that only trusted and / or necessary data traffic is permitted through it.

[0070] The device 100 can, in particular, comprise at least one processor to execute or implement the method according to the invention. In particular, the test system can be implemented in a cloud environment that is connected to the production environment via a communication link.

[0071] All described and / or illustrated features can be advantageously combined within the scope of the invention. The invention is not limited to the described embodiments.

Claims

1. Computer-implemented method for configuring an access protection system (FW) suitable for regulating a data communication connection of a computer-implemented application (APP) between a first computer network (NW1) and a second computer network (NW2), wherein - the computer-implemented application (APP) is provided (S1), - an image of the first computer network (NW1') is provided in a test system (TE) and the computer-implemented application (APP) is executed (S2b) therein, wherein the image is a reconstruction of the first computer network comprising all relevant network components and connections, and wherein the test system is shielded from other communication relationships, with the result that only those communications which are relevant to the computer-implemented application are carried out in the test system, - a data communication connection (DC) between the image of the first computer network (NW1') and the second computer network (NW2) that is required when executing the computer-implemented application is determined (S3) by a sensor (103), - on the basis of the data communication connection (DC) determined by the sensor, a configuration rule for the access protection system (FW) for allowing the data communication connection (DC) of the computer-implemented application (APP) between the first computer network (NW1) and the second computer network (NW2) is derived (S4), wherein the configuration rule is derived in such a way that only a trusted and / or permitted data communication connection (DC) of the computer-implemented application (APP) is allowed via the access protection system (FW) according to the configuration rule, and - the configuration rule for configuring the access protection system (FW) is output (S5).

2. Computer-implemented method according to Claim 1, wherein an image of the second computer network (NW2') is additionally provided in the test system (TE) and the data communication connection (DC) of the computer-implemented application (APP) only between the image of the first computer network (NW1') and the image of the second computer network (NW2') is determined by the sensor.

3. Computer-implemented method according to one of the preceding claims, wherein a data communication connection (DT) from the second computer network (NW2) or from the image of the second computer network (NW2') to the image of the first computer network (NW1') is prevented in the test system (TE).

4. Computer-implemented method according to one of the preceding claims, wherein the data communication connection (DC) of the computer-implemented application (APP) between the image of the first computer network (NW1') and the second computer network (NW2) or the image of the second computer network (NW2') is simulated in the test system (TE).

5. Computer-implemented method according to one of the preceding claims, wherein a data communication connection (DC) of the computer-implemented application (APP), which is effected between the first computer network (NW1) and the second computer network (NW2) via more than one access protection system (FW1, FW2, FW3, ...), is determined by more than one sensor and a configuration rule (R1, R2, R3, ...) for allowing the data communication connection (DC) of the computer-implemented application (APP) is respectively derived for each of these access protection systems (FW1, FW2, FW3, ...).

6. Computer-implemented method according to one of the preceding claims, wherein the type of data communication connection (DC) of the computer-implemented application is determined.

7. Computer-implemented method according to one of the preceding claims, wherein a communication characteristic is determined from the type of data communication connection (DC) of the computer-implemented application and a configuration rule for the access protection system (FW) is derived therefrom.

8. Computer-implemented method according to one of the preceding claims, wherein the configuration rule is provided by the test system (TE) to a productive environment (PE), which is similar to the test system (TE), for configuring the access protection system (FW).

9. Computer-implemented method according to one of the preceding claims, wherein the access protection system (FW) is configured according to the configuration rule.

10. Computer-implemented method according to one of Claims 7 to 9, wherein a configuration instruction for configuring the access protection system (FW) according to the configuration rule is determined and output for configuring the access protection system (FW).

11. Computer-implemented method according to one of Claims 7 to 10, wherein the configuration rule and / or the configuration instruction is / are digitally signed.

12. Apparatus (100) for configuring an access protection system (FW) suitable for regulating a data communication connection of a computer-implemented application between a first computer network (NW1) and a second computer network (NW2), comprising: - a first provision module (101) which is configured to provide the computer-implemented application (APP) and an image of the first computer network (NW1') in a test system (TE), wherein the image is a reconstruction of the first computer network comprising all relevant network components and connections, and wherein the test system is shielded from other communication relationships, with the result that only those communications which are relevant to the computer-implemented application are carried out in the test system, - an application module (102) which is configured to execute the computer-implemented application in the image of the first computer network (NW') in the test system (TE), - a sensor (103) which is configured to determine a data communication connection (DC) of the computer-implemented application (APP) between the image of the first computer network (NW1') and the second computer network (NW2) that is required when executing the computer-implemented application, - a derivation module (104) which is configured to derive, on the basis of the data communication connection (DC) determined by the sensor, a configuration rule for the access protection system (FW) for allowing the data communication connection (DC) of the computer-implemented application (APP) between the first computer network (NW1) and the second computer network (NW2), wherein the configuration rule is derived in such a way that only a trusted and / or permitted data communication connection (DC) of the computer-implemented application (APP) is allowed via the access protection system (FW) according to the configuration rule, and - an output module (105) which is configured to output the configuration rule for configuring the access protection system (FW) .

13. Apparatus according to Claim 12, comprising a configuration module (106) which is configured to configure the access protection system (FW) according to the configuration rule.

14. Test system (TE) which comprises an apparatus according to Claim 12.

15. Access protection system (FW) suitable for regulating a data communication connection of a computer-implemented application (APP) between a first computer network (NW1) and a second computer network (NW2) and configured according to the method according to one of Claims 1 to 11.

16. Computer program product that can be loaded directly into a programmable computer, comprising program code parts that, when the program code parts are executed by a computer, cause the latter to perform the steps of a method according to one of Claims 1 to 11.

17. Computer-readable data carrier, on which the computer program product according to Claim 16 is stored.