Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1998-03-13
2001-11-20
Etienne, Ario (Department: 2155)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000, C713S153000, C709S229000, C709S220000
Reexamination Certificate
active
06321336
ABSTRACT:
TECHNICAL FIELD OF THE INVENTION
The present invention pertains generally to network communications, and in particular to a system and method for regulating the flow of inter-network connections through a firewall.
BACKGROUND OF THE INVENTION
Firewalls have become an increasingly important part of network design. Firewalls provide protection of valuable resources on a private network while allowing communication and access with systems located on an unprotected network such as the Internet. In addition, they operate to block attacks on a private network arriving from the unprotected network by providing a single connection with limited services. A well designed firewall limits the security problems of an Internet connection to a single firewall computer system. This allows an organization to focus their network security efforts on the definition of the security policy enforced by the firewall. An example of a firewall is given in “SYSTEM AND METHOD FOR PROVIDING SECURE INTERNETWORK SERVICES”, U.S. patent application Ser. No. 08/322,078, filed Oct. 12, 1994, by Boebert et al., the description of which is hereby incorporated by reference. A second example of such a system is described in “SYSTEM AND METHOD FOR ACHIEVING NETWORK SEPARATION”, U.S. application Ser. No. 08/599,232, filed Feb. 9, 1996, by Gooderum et al., the description of which is hereby incorporated by reference. Both are examples of application level gateways. Finally, “SECURITY POLICY MANAGEMENT SYSTEM AND METHOD”, U.S. application Ser. No. 08/715,668, filed Sep. 18, 1996, by Stockwell et al. describes a system and method for regulating the flow of internetwork connections through a firewall, the description of which is hereby incorporated by reference. Application level gateways use proxies operating at the application layer to process traffic through the firewall. As such, they can review not only the message traffic, but also message content. In addition, they provide authentication and identification services, access control and auditing.
Application level gateways operate best on hardened operating systems. For example, the Sidewinder® product, built by the assignee of the present invention, is an application level gateway which operates on a hardened version of BSD Unix.
The advantage of having an application level gateway operate on top of a hardened operating system is that the routing of traffic through the gateway can be restricted to require that all traffic through the gateway pass through the application level proxy first.
To date, in order to harden the operating system, the programmer has required access to the operating system source code. In many instances, however, operating system manufactures are hesitant to give outside parties access to their source code. What is needed is a way of modifying an existing operating system so that it can be used as a firewall implementing an application level gateway without access to operating system source code.
For the reasons stated above, and for other reasons stated below which will become apparent to those skilled in the art upon reading and understanding the present specification, there is a need in the art for a system which provides a firewall that can be used with an indigenous stack without modification.
SUMMARY OF THE INVENTION
The above-mentioned problems with providing a secure network without access to operating system source code and other problems are addressed by the present invention and which will be understood by reading and studying the following specification. A system is described which reroutes data packets without requiring modification of the source code of a commercial operating system.
In particular, the present invention describes a method of securing communication between an external network and a processor operating on an internal network. The method comprising the steps of receiving a communication from an internal network host. The communication including a first destination address. The method includes creating a session control block and storing therein the first destination address, replacing the first destination address with a second destination address identifying a location of a communication security firewall, and routing the communication to the security firewall through a stack after the first destination address is replaced with the second destination address. A security check is performed to determine if the communication is authorized. The session control block is accessed to retrieve the first destination address, and the second destination address is replaced with the first destination address if the communication is authorized. If authorized, the communication is routed to the processor operating on the external network. Finally, communication from an external host directed at the security firewall is associated to the internal network host.
In another embodiment, a method is described for securing communication between an external network and a processor operating on an internal network. The method comprising the steps of receiving a communication from the external network, including a first destination address, and a first header check sum. The method further includes using a shim located between a stack and a network interface adapter to identify an appropriate session control block, identifying an IP address of an internal host using the identified session control block, routing the communication to the security firewall through a TCP/IP stack, and performing a security check of the communication to determine if the communication is authorized. Finally, if the communication is authorized, the communication is routed to the processor operating on the internal network.
In yet another embodiment of the invention, a firewall for securing traffic between an internal and an external network comprises a network interface, a network driver connected to the network interface, and an application level proxy. A protocol stack is connected to the application level proxy. A shim is connected between the protocol stack and the network interface adapter. The shim includes means for modifying an address of network traffic to redirect the traffic up the protocol stack to the application level proxy.
REFERENCES:
patent: 3956615 (1976-05-01), Anderson et al.
patent: 4104721 (1978-08-01), Markstein et al.
patent: 4177510 (1979-12-01), Appell et al.
patent: 4442484 (1984-04-01), Childs, Jr. et al.
patent: 4584639 (1986-04-01), Hardy
patent: 4621321 (1986-11-01), Boebert et al.
patent: 4648031 (1987-03-01), Jenner
patent: 4701840 (1987-10-01), Boebert et al.
patent: 4713753 (1987-12-01), Boebert et al.
patent: 4870571 (1989-09-01), Frink
patent: 4885789 (1989-12-01), Burger et al.
patent: 4914568 (1990-04-01), Kodosky et al.
patent: 5077658 (1991-12-01), Bendert et al.
patent: 5093914 (1992-03-01), Coplien et al.
patent: 5124984 (1992-06-01), Engel
patent: 5153918 (1992-10-01), Tuai
patent: 5204961 (1993-04-01), Barlow
patent: 5228083 (1993-07-01), Lozowick et al.
patent: 5263147 (1993-11-01), Francisco et al.
patent: 5272754 (1993-12-01), Boebert
patent: 5276735 (1994-01-01), Boebert et al.
patent: 5303303 (1994-04-01), White
patent: 5305385 (1994-04-01), Schanning et al.
patent: 5311593 (1994-05-01), Carmi
patent: 5329623 (1994-07-01), Smith et al.
patent: 5333266 (1994-07-01), Boaz et al.
patent: 5355474 (1994-10-01), Thuraisngham et al.
patent: 5414833 (1995-05-01), Hershey et al.
patent: 5416842 (1995-05-01), Aziz
patent: 5455828 (1995-10-01), Zisapel
patent: 5485460 (1996-01-01), Schrier et al.
patent: 5511122 (1996-04-01), Atkinson
patent: 5548646 (1996-08-01), Aziz et al.
patent: 5550984 (1996-08-01), Gelb
patent: 5566170 (1996-10-01), Bakke et al.
patent: 5583940 (1996-12-01), Vidrascu et al.
patent: 5586260 (1996-12-01), Hu
patent: 5604490 (1997-02-01), Blakley, III et al.
patent: 5606668 (1997-02-01), Shwed
patent: 5615340 (1997-03-01), Dai et al.
patent: 5619648 (1997-04-01), Canale et al.
patent: 5623601 (1997-04-01), Vu
patent: 5636371 (1997-06-01), Yu
patent: 5644571 (1997-07-01), Seaman
patent: 5671279 (1997-
Applegate John
Romatoski Jeff
Backer Firmin
Etienne Ario
Schwegman Lundberg Woessner & Kluth P.A.
Secure Computing Corporation
LandOfFree
System and method for redirecting network traffic to provide... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method for redirecting network traffic to provide..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method for redirecting network traffic to provide... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2595762