Active firewall system and methodology

Details Active firewall system and methodology Active firewall system and methodology

1999-06-08

2003-04-15

Peeso, Thomas R. (Department: 2132)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C713S152000, C713S168000, C713S170000

Reexamination Certificate

active

06550012

ABSTRACT:

COPYRIGHT NOTICE
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
BACKGROUND OF THE INVENTION
The present invention relates generally to computer networks and, more particularly, to system and methods for facilitating the detection of events occurring in a computer network system (e.g., detection of vulnerability) and secure communication of such events within the system, as well as automated responses to such events.
The first personal computers were largely stand-alone units with no direct connection to other computers or computer networks. Data exchanges between computers were mainly accomplished by exchanging magnetic or optical media such as floppy disks. Over time, more and more computers were connected to each other using Local Area Networks or “LANs.” In both cases, maintaining security and controlling what information a user of a personal computer can access was relatively simple because the overall computing environment was limited and clearly defined.
With the ever-increasing popularity of the Internet, particularly the World Wide Web (“Web”) portion of the Internet, however, more and more personal computers are connected to larger networks. Providing access to vast stores of information, the Internet is typically accessed by users through Web “browsers” (e.g., Microsoft Internet Explorer™ or Netscape Navigator™) or other “Internet applications.” Browsers and other Internet applications include the ability to access a URL (Universal Resource Locator) or “Web” site. The explosive growth of the Internet had a dramatic effect on the LANs of many businesses and other organizations. More and more employees need direct access through their corporate LAN to the Internet in order to facilitate research, competitive analysis, communication between branch offices, and send e-mail, to name just a few.
As a result, corporate IT (Information Technology) departments now face unprecedented challenges. Specifically, such departments, which have to date operated largely in a clearly defined and friendly environment, are now confronted with a far more complicated and hostile situation. As more and more computers are now connected to the Internet, either directly (e.g., over a dial-up connection with an Internet Service Provider or “ISP”) or through a gateway between a LAN and the Internet, a whole new set of challenges face LAN administrators and individual users alike: these previously-closed computing environments are now opened to a worldwide network of computer systems. In particular, systems today are vulnerable to attacks by practically any perpetrators (hackers) having access to the Internet.
The general problem facing network environments is that security coverage/protection is generally not available 24 hours a day, seven days a week, at least not without great cost. Nevertheless, corporate networks are typically kept running at all times for various reasons, such as for hosting Web sites, FTP (File Transfer Protocol) sites, and the like. Although it is generally impractical to keep an IT team around 24 hours a day, seven days a week, corporate networks remain under constant threat of “attack,” from both inside and outside sources.
There are several potential sources of attack. For example, an “inside” attack may occur as a result of the unauthorized act of an employee setting up a bogus FTP site, such as one containing confidential information that is not protected from access from outside the company. Another example of an inside attack is the unauthorized act of setting up a mail server (e.g., SMTP server) inside a corporate network, for sending unauthorized e-mail (e.g., completely bypassing company safeguards). “Outside” attacks typically occur as a result of unauthorized access to one's network by an outside perpetrator, that is, one existing outside the corporate “firewall.” A typical example of such an attack would include unauthorized access to a valid FTP site which has accidentally been configured to have “writeable” directories which are not known to exist.
Firewalls are applications that intercept the data traffic at the gateway to a wide area network (WAN) and try to check the data packets (i.e., Internet Protocol packets or “IP packets”) being exchanged for suspicious or unwanted activities. Initially firewalls have been used primarily to keep intruders from the LAN by filtering data packets. More recently, the concept has been expanded to include “proxy-based” firewall protection. A proxy-based firewall is one in which all relevant protocols are handled by an individual proxy, positioned (conceptually) between the incoming network card and the outgoing network card. In this manner, the proxy-based firewall can receive a connection from one side (e.g., incoming side) and apply relevant security checks before re-opening a corresponding connection on the other side (e.g., outgoing side).
Even with the availability of firewall technology, present-day techniques for detecting system compromise and vulnerabilities have occurred in a fairly non-automated fashion. Typically, an IT team routinely scans a company's network using scanning software, reviews a report of vulnerabilities, and then decides what firewall rules, if any, should be written. A particular problem with this approach is that existing firewalls have not, to date, served as an adequate substitute for IT personnel themselves. This stems from the fact that existing firewalls are simply static in nature and, thus, are unable to participate in a proactive, or even reactive, manner. When a breach in the network security or attack occurs, a firewall can only correctly handle the event if it has been programmed beforehand (e.g., by a system administrator) with a rule appropriate for the event. Since a firewall essentially serves as a repository of static rules, its functionality is limited by the ability of its system administrator to anticipate events and create rules for handling those events.
Often, however, an event will occur for which there is no rule. Since firewall rules themselves are not proactive, the firewall itself is unable to appropriately handle the event. Thus, events often require human intervention for appropriate handling. As these attacks can happen quite rapidly, such manual human intervention is itself often inadequate. Frequently, by the time IT personnel has detected an attack, it is too late: the damage (e.g., unauthorized access to confidential information) has already been done.
What is needed is a system with methodology that provides proactive protection for computer networks, thereby eliminating the need for continual, manual supervision and intervention for securing one's corporate network. Moreover, the underlying security and integrity of the proactive system itself should be assured, including communications within the system, so that the system itself does not introduce vulnerability to the network. In this manner, such a system may be employed to free IT personnel from the task of having to search for, and appropriately handle, system compromises in a non-automated manner. The present invention fulfills this and other needs.
SUMMARY OF THE INVENTION
System and methodology providing automated or “proactive” network security (“active” firewall) are described. In one embodiment, a system implementing an active firewall is provided which includes methodology for verifying or authenticating communications between network components (e.g., sensor(s), arbiter(s), and actor(s)), using cryptographic keys or digital certificates. Certificates may be used to digitally sign a message or file and, in a complementary manner, to verify a digital signature. These “digital signatures” allow authentication of messages, such that forgery of a signed message is not

Affiliated with

Also associated with

Rating

Active firewall system and methodology does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Active firewall system and methodology, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Active firewall system and methodology will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3059097