EP0910197A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Methods and apparatus for a computer network firewall with dynamic rule processing
Assignee: Nokia of America Corp
•
Filing: 1998-09-01
•
Granted: —
•
Expires: 2018-09-01
Abstract
Abstract The invention provides improved computer network firewalls which include one or more features for increased processing efficiency. A firewall in accordance with the invention can support multiple security policies, multiple users or both, by applying any one of several distinct sets of access rules. The firewall can also be configured to utilize "stateful" packet filtering which involves caching rule processing results for one or more packets, and then utilizing the cached results to bypass rule processing for subsequent similar packets. To facilitate passage to a user, by a firewall, of a separate later transmission which is properly in response to an original transmission, a dependency mask can be set based on session data items such as source host address, destination host address, and type of service. The mask can be used to query a cache of active sessions being processed by the firewall, such that a rule can be selected based on the number of sessions that satisfy the query. Dynamic rules may be used in addition to pre-loaded access rules in order to simplify rule processing. To unburden the firewall of application proxies, the firewall can be enabled to redirect a network session to a separate server for processing.
Inventors
- 👤 Michael John Coss
- 👤 Ronald L. Sharp
- 👤 David L. Majette
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-24 13:41
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; H04L9/00; H04L9/40
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
34 words
A method for providing a firewall service in a computer network,
comprising the steps of: loading an initial set of rules; and modifying the set of rules without expunging said initial set of rules.
Claim 2
Dependent Claim
35 words
The method of claim 1 wherein said firewall service is provided by a firewall
and wherein said modifying step is performed without losing any connections existing
through said firewall when said modifying step is executed.
Claim 3
Dependent Claim
37 words
The method of claim 1 wherein said firewall service is provided by a firewall
and wherein said modifying step is performed without losing a majority of connections
existing through said firewall when said modifying step is executed.
Claim 4
Dependent Claim
38 words
The method of claim 1 wherein said firewall service is provided by a firewall
and said firewall employs a cache to process packets through said firewall, and wherein
contents of said cache remain unchanged by said modifying step.
Claim 5
Dependent Claim
53 words
The method of claim 1 wherein said firewall service is provided by a firewall
servicing multiple domains, said modifying step modifies the set of rules associated
with one of the multiple domains, and the other domains continue to operate without
losing any connections existing through said firewall when said modifying step is
executed.
Claim 6
Dependent Claim
55 words
The method of claim 1 wherein said firewall service is provided by a firewall
servicing multiple domains, said modifying step modifies the set of rules associated
with one of the multiple domains, and the other domains continue to operate without
losing a majority of connections existing through said firewall when said modifying step
is executed.
Claim 7
Independent Claim
58 words
A method for providing a firewall service in a computer network,
comprising the steps of: forming an augmented set of rules by including, in a set of access rules,
at least one rule which acts to alter the operation of the set of rules under specified
conditions; and using the augmented set of rules in validating a packet.
Claim 8
Dependent Claim
15 words
The method of claim 7 wherein the at least one rule is a dynamic rule.
Claim 9
Dependent Claim
20 words
The method of claim 8 wherein the dynamic rule comprises a time condition
which the packet must satisfy for transmission.
Claim 10
Dependent Claim
23 words
The method of claim 8 wherein the dynamic rule is deleted at the end of its
lifetime if it has a specified lifetime.
Claim 11
Dependent Claim
16 words
The method of claim 8 wherein the dynamic rule is operative for a single
network session.
Claim 12
Dependent Claim
23 words
The method of claim 8 wherein the dynamic rule comprises information
which relates to a connection from a remote proxy to a destination.
Claim 13
Dependent Claim
37 words
The method of claim 8 wherein the dynamic rule is applied by a proxy in an
file transfer protocol (FTP) application to determine whether an FTP data channel
should be established in response to a data request.
Claim 14
Dependent Claim
27 words
The method of claim 8 wherein the dynamic rule specifies a threshold
condition such that the dynamic rule is used only when the threshold condition is
satisfied.
Claim 15
Dependent Claim
47 words
The method of claim 8 wherein the dynamic rule has associated
therewith at least one set of data which is pointed to by the dynamic rule, such that the
data within the set can be changed to alter operation of the rule without changing the
rule itself.
Claim 16
Independent Claim
76 words
A method for providing a firewall service in a computer network,
comprising the steps of: defining a set of access rules, wherein at least one of the rules has
associated therewith at least one set of data which is pointed to by the rule, such that the
data within the set can be changed to alter operation of the rule without changing the
rule itself; and using the set of access rules in validating a packet.
Claim 17
Dependent Claim
43 words
A method as claimed in claim 15 or claim 16 wherein the set of data
defines a host group, such that the host group can be modified to add or drop different
hosts without altering other aspects of the set of access rules.
Claim 18
Dependent Claim
45 words
A computer system for providing a firewall service in a computer
network, comprising: a memory for storing a set of access rules; and a processor coupled to the memory and operative to carry out a method
as claimed in any of claims 7 to 17.
Claim 19
Dependent Claim
31 words
A computer system for providing a firewall service in a computer
network, comprising means for carrying out each step of a method as claimed in any of
claims 7 to 17.
Claim 20
Dependent Claim
43 words
A dynamic rule for inclusion with access rules in a computer system
for packet validation in a computer network, the dynamic rule being formatted like the access rules, and the dynamic rule staying in force for a lesser duration than the access
rules.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.