Arrangement in a data communication system

Details Arrangement in a data communication system Arrangement in a data communication system

1998-08-24

2003-06-10

Le, Dieu-Minh (Department: 2184)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

Reexamination Certificate

active

06578151

ABSTRACT:

FIELD OF INVENTION
The present invention relates to network security issues and a set of problems with management and control of firewalls, in particular pertaining to firewalling of applications utilizing dynamic port allocation.
More specifially, the present invention relates to an arrangement in a data communication system as stated in the preamble of the attached patent claim
1
.
PROBLEM AREAS
Problem 1
The most basic firewall functions are based on packet filter functions which perform screening on a (statically) configured set of allowed address pairs (incl. port numbers). These firewall functions are simple for reasons of cost, performance and management. The simplicity of these firewalls do however introduce a set of problems for applications that use dynamic allocation of ports (in particular UDP ports).
To solve these problems of dynamic port allocation, application proxy functions have been developed and placed on firewalls. These proxies interpret the application protocol and enforce control functions at the application layer as well as supporting the network and transport layer control functions (e.g. by reconfiguring the packet filter to allow traffic between a new set of address pairs).
The problem with this approach is that for every new application an application proxy has to be developed and placed on the firewalls. These proxies do also, in most configurations, introduce added delay and latency for the data transferred (not using cut-through). The proposed solution presents a generic solution to the described set of problems.
Problem 2
Current packet filter firewalls base their screening on address pairs and not on the end users working behind those addresses. This means that credentials are allocated to terminals and not to the end users. The proposed solution binds a user identity to an IP address and then performs screening based on the address pairs.
The described problem (and the solution) has even higher relevance in networks that employ dynamic address allocation schemes, such as the DHCP protocol.
PRIOR ART SOLUTIONS AND PROBLEMS WITH THESE
W3C: PICS, Platform for Internet Content Selection & DSig, Digitial Signature Initiative
W3C standardization address digitally signed information elements, but does not propose the mechanism used for this purpose. Rather, they suggests that the firewall can control the signatures before allowing the information to pass the firewall domain.
IETF RFC: 1928, 1929, 1961, SOCKS-v5
The following set of RFC defines a set of mechanims to employ for application proxying applications which use UDP ports (SOCKS-v4 handled TCP applications only).
IEFT draft: Firewall support for mobile IP
The draft propose a mechanism for allowing a mobile host to traverse a firewall based on using IPsec (SKIP). This means that the application protocol has to be encrypted and/or authenticated (which also implies added delay and latency for transferred data).
OBJECTS OF THE INVENTION
The main object of the present invention is to provide an arrangement in a data communication system wherein security issues can be substantially improved.
Another object of the present invention is to provide an arrangement allowing for generic mechanizms for firewalling applications.
Another object of the present invention is to provide an arrangement which favourably allows distributed control of firewall between configured and authorised actors, for thereby providing user mobility.
Another object of the present invention is to provide an arrangement allowing for integrity controlled and signed configuration and management as well signed log of operations.
Another object of the present invention is to provide an arrangement wherein firewall functions are related to identity of service user rather than user location, i.e. machine address.
Yet another object of the present invention is to provide an arrangmemt giving better support and control of mobile users and their access to firewalled domains.
An object of the present invention is also to provide an arrangement giving a simple non-repudiation service for service usage.
SUMMARY OF THE INVENTION
These objects are achieved in an arrangement of the type as stated in the preamble, which arrangement according to the present invention is characterized by the features as stated in the characterizing clause of enclosed patent claim
1
.
Further features and advantages of the present invention will appear from the following description taken in conjuction with the enclosed drawings, as well as from the further enclosed patent claims.


REFERENCES:
patent: 5550984 (1996-08-01), Gelb
patent: 5623601 (1997-04-01), Vu
patent: 5825880 (1998-10-01), Sudia et al.
patent: 5826014 (1998-10-01), Coley et al.
patent: 5892902 (1999-04-01), Clark
patent: 5896499 (1999-04-01), McKelvey
patent: 5999973 (1999-12-01), Glitho et al.
patent: 6061798 (2000-05-01), Coley et al.
patent: 6170058 (2001-01-01), Kausik
patent: WO 97/00471 (1997-01-01), None

Affiliated with

Also associated with

Rating

Arrangement in a data communication system does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Arrangement in a data communication system, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Arrangement in a data communication system will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3126395