High resolution access control

Details High resolution access control High resolution access control

1999-10-22

2004-11-30

Smithers, Matthew (Department: 2137)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C709S224000

Reexamination Certificate

active

06826694

ABSTRACT:

FIELD OF THE INVENTION
The field of the invention is information systems access control, and in particular high resolution filtering of packetized information.
BACKGROUND OF THE INVENTION
A firewall regulates the flow of packetized information. A packet includes a header and a payload. The header includes header parameters, including a source and destination address for the packet, as well as source and destination port numbers and a protocol number. Other examples of header parameters include various flags (e.g., security features implemented with respect to the packet (AUTHENTICATED, ENCRYPTED), quality of service requirements (e.g., HIGH, MEDIUM, LOW) for handling the packet, a priority parameter for handling the packet (e.g., ROUTINE, URGENT, FLASH), etc.) The payload includes the data meant to be conveyed by the packet from its source to its intended destination.
A known firewall is placed between the packet's source and intended destination, where it intercepts the packet. The known firewall filters a packet based upon the packet's header parameters and a rule loaded into the firewall. The rule correlates a pattern in the header of a packet with a prescribed action, either PASS or DROP. The filter identifies the rule that applies to the packet based upon the packet's header, and then implements the rule's prescribed action. When a DROP action is performed, the packet is blocked (deleted), and does not reach its intended destination. When a PASS action is performed, the packet is passed on toward its intended destination. The set of rules loaded into a firewall reflect a security policy, which prescribes what type of information is permissible to pass through the firewall, e.g., from which source, to which destination, for which applications, etc.
The set of rules loaded into a known firewall operate at a low level of resolution. As described above, a firewall rule prescribes a PASS or DROP action based only upon the header parameters of the packet. Packet header parameters alone do not reveal the ultimate target of, for example, a connection request from a sender to a destination host. For example, a HyperText Transfer Protocol (HTTP) connection request to send the file located at http://www.att.com/secret.html is not entirely disclosed in the header of the packet initiating the request. The header reveals the Internet Protocol (IP) address of the proxy corresponding to the domain name att.com. However, information regarding the particular file that is being requested, secret.html, is embedded in the payload of the packet. Since known firewalls only filter packets based upon their header parameters, known filters cannot PASS or DROP a packet on the basis of a particular file at a given destination. The same shortfall in known filters exists for filtering a packet destined for a particular newsgroup, chat session, e-mail address, etc.
SUMMARY OF THE INVENTION
The present invention provides high resolution access control for packetized information. In accordance with one embodiment of the present invention, a packet is received at a firewall and referred to an access control proxy. The access control proxy analyzes the contents of the packet, and identifies an access rule based upon the contents. The action prescribed by the access rule is performed with respect to the packet and any related packets. This advantageously provides for filtering a packet based not only upon its header information, as in known firewalls, but upon the information contained in the packet payload.


REFERENCES:
patent: 5473607 (1995-12-01), Hausman et al.
patent: 5983270 (1999-11-01), Abraham et al.
patent: 6219706 (2001-04-01), Fan et al.
patent: 6584508 (2003-06-01), Epstein et al.
patent: 0 762 707 (1997-08-01), None
patent: 96/05549 (1996-02-01), None
Bellovin, S..M., “Network Firewalls”, IEEE Communications Magazine, vol. 32, No. 9, Sep. 1, 1994, pp. 50-57, XP000476555; p. 52, col. 1, In. 60; p. 54, col. 2, In 30.

Affiliated with

Also associated with

Rating

High resolution access control does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with High resolution access control, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and High resolution access control will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3328389