US6772347B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method, apparatus and computer program product for a network firewall
Assignee: Juniper Networks Inc
•
Filing: 2000-03-15
•
Granted: 2004-08-03
•
Expires: 2020-03-15
Abstract
Abstract Systems and methods for network security including a firewall. One firewall includes a firewall engine. The firewall engine includes a first engine including a first set of rules for sorting incoming IP packets into initially allowed packets and initially denied packets. The firewall engine also includes a filter including a second set of rules for receiving and further sorting the initially denied packets into allowed packets and denied packets.
Inventors
- 👤 Ken Xie
- 👤 Yan Ke
- 👤 Yuming Mao
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 13:21
CPC Classifications
H; H04; H04L; H04L49/00; H04L49/90; H04L49/901; H04L49/9057; H04L63/00; H04L63/02; H04L69/00; H04L69/16; H04L69/22
Claims Analysis
Total Claims: 30
Claim 1
Independent Claim
53 words
An apparatus comprising: a firewall engine including: a first engine including a first set of rules for sorting incoming IP packets into initially allowed packets and initially denied packets; and a filter including a second set of rules for receiving and further sorting the initially denied packets into allowed packets and denied packets.
Claim 2
Independent Claim
53 words
An apparatus comprising: a firewall engine including: a first engine including a first set of rules for sorting incoming IP packets into initially allowed packets and initially denied packets; and a filter including a second set of rules for receiving and further sorting the initially denied packets into allowed packets and denied packets.
Claim 3
Dependent Claim
16 words
The apparatus of claim 1 , wherein the filter dynamically generates the second set of rules.
Claim 4
Dependent Claim
15 words
The apparatus of claim 2 , wherein the first set of rules comprises fixed rules.
Claim 5
Dependent Claim
20 words
The apparatus of claim 3 , further comprising: a second engine for receiving and further processing the initially allowed packets.
Claim 6
Dependent Claim
21 words
The apparatus of claim 4 , wherein the second engine is capable of modifying some subset of the initially allowed packets.
Claim 7
Dependent Claim
31 words
The apparatus of claim 5 , wherein the second engine comprises: a dynamic analyzer for identifying initially allowed packets requiring network address translation; and a handler for providing network address translation.
Claim 8
Dependent Claim
24 words
The apparatus of claim 5 , wherein the second engine comprises a dynamic analyzer for sending a “reset” packet to a source IP address.
Claim 9
Dependent Claim
62 words
A computer software product, tangibly stored on a computer-readable medium, for providing a network security, comprising instructions operable to cause a programmable processor to: process incoming IP packets into initially allowed packets and initially denied packets; extract matching criteria from incoming IP packets; dynamically generate rules using the extracted matching criteria; and further process the initially denied packets using the dynamically-generated rules.
Claim 10
Dependent Claim
62 words
A computer software product, tangibly stored on a computer-readable medium, for providing a network security, comprising instructions operable to cause a programmable processor to: process incoming IP packets into initially allowed packets and initially denied packets; extract matching criteria from incoming IP packets; dynamically generate rules using the extracted matching criteria; and further process the initially denied packets using the dynamically-generated rules.
Claim 11
Dependent Claim
19 words
The computer software product of claim 8 , wherein the instructions to process incoming IP packets use fixed rules.
Claim 12
Dependent Claim
25 words
The computer software product of claim 9 , further comprising instructions to: further process the initially allowed packets into allowed packets and packets requiring modification.
Claim 13
Dependent Claim
15 words
The computer software product of claim 10 , further comprising instructions to: modify control packets.
Claim 14
Dependent Claim
21 words
The computer software product of claim 11 , wherein the instructions to modify control packets include instructions for network address translation.
Claim 15
Dependent Claim
24 words
The computer software product of claim 10 , further comprising instructions to: generate and transmit a “reset” packet in response to a denied packet.
Claim 16
Independent Claim
40 words
A method for providing network computer security, comprising: receiving incoming packets at a firewall; sorting the incoming packets into initially allowed packets and initially denied packets; and further sorting the initially denied packets into allowed and denied packets using rules.
Claim 17
Independent Claim
40 words
A method for providing network computer security, comprising: receiving incoming packets at a firewall; sorting the incoming packets into initially allowed packets and initially denied packets; and further sorting the initially denied packets into allowed and denied packets using rules.
Claim 18
Dependent Claim
19 words
The method of claim 14 , wherein the step of sorting the incoming packets is performed using fixed rules.
Claim 19
Dependent Claim
24 words
The method of claim 15 , further comprising the step of further sorting the initially allowed packets into allowed packets and packets requiring modification.
Claim 20
Dependent Claim
19 words
The method of claim 16 , further comprising the step of providing network address translation for packets requiring modification.
Claim 21
Dependent Claim
12 words
The method of claim 14 , wherein the packets are IP packets.
Claim 22
Dependent Claim
12 words
The method of claim 14 , wherein the rules are dynamically generated.
Claim 23
Independent Claim
68 words
A method for providing network computer security, comprising: receiving incoming IP packets at a firewall; sorting the incoming IP packets into initially allowed packets and initially denied packets using a set of fixed rules; extracting parameters from the incoming IP packets; using the extracted parameters to generate a set of dynamically-generated rules; and further sorting the initially denied packets into allowed and denied packets using the dynamically-generated rules.
Claim 24
Independent Claim
68 words
A method for providing network computer security, comprising: receiving incoming IP packets at a firewall; sorting the incoming IP packets into initially allowed packets and initially denied packets using a set of fixed rules; extracting parameters from the incoming IP packets; using the extracted parameters to generate a set of dynamically-generated rules; and further sorting the initially denied packets into allowed and denied packets using the dynamically-generated rules.
Claim 25
Dependent Claim
24 words
The method of claim 20 , further comprising the step of further sorting the initially allowed packets into allowed packets and packets requiring modification.
Claim 26
Dependent Claim
19 words
The method of claim 21 , further comprising the step of providing network address translation for packets requiring modification.
Claim 27
Independent Claim
56 words
An apparatus comprising: an ASIC including a firewall engine including: a first engine including a first set of rules for processing incoming IP packets into initially allowed packets and initially denied packets; and a filter including a second set of rules for receiving and further processing the initially denied packets into allowed packets and denied packets.
Claim 28
Independent Claim
56 words
An apparatus comprising: an ASIC including a firewall engine including: a first engine including a first set of rules for processing incoming IP packets into initially allowed packets and initially denied packets; and a filter including a second set of rules for receiving and further processing the initially denied packets into allowed packets and denied packets.
Claim 29
Independent Claim
40 words
A method for providing network computer security, comprising: receiving incoming packets at a firewall; processing the incoming packets into initially allowed packets and initially denied packets; and further processing the initially denied packets into allowed and denied packets using rules.
Claim 30
Independent Claim
40 words
A method for providing network computer security, comprising: receiving incoming packets at a firewall; processing the incoming packets into initially allowed packets and initially denied packets; and further processing the initially denied packets into allowed and denied packets using rules.
References Cited (Backward Citations)
EP0658837A2
Cited
US5606668A
Cited
US5835726A
Cited
US6009475A
Cited
US6016310A
Cited
US5951651A
Cited
EP0893921A1
Cited
US6400707B1
Cited
US20020188720A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-08-03 | 2008-02-02 | 2008-08-03 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-08-03 | 2012-02-02 | 2012-08-03 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-08-03 | 2016-02-02 | 2016-08-03 | $7700.00 | Window Closed / Lapsed |