Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
2000-03-02
2002-12-17
Wright, Norman M. (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000, C709S241000, C370S902000
Reexamination Certificate
active
06496935
ABSTRACT:
FIELD AND BACKGROUND OF THE INVENTION
The present invention is of a system, a device and method for rapid packet filtering on a packet-switched network, and in particular, to such a system, a device and method in which the efficiency of packet filtration is increased by session-based filtering.
Connectivity and security are two conflicting objectives in the computing environment of most organizations. The typical modern computing system is built around network communications, supplying transparent access to a multitude of services. The global availability of these services is perhaps the single most important feature of modern computing solutions. Demand for connectivity comes both from within organizations and from outside them.
Protecting network services from unauthorized usage is of paramount importance to any organization. As the need for increased security grows, the means of controlling access to network resources has become an administrative priority. In order to save cost and maintain productivity, access control must be simple to configure and transparent to users and applications. The minimization of setup costs and down time are also important factors.
Packet filtering is a method which allows connectivity yet provides security by controlling the traffic being passed, thus preventing illegal communication attempts, both within single networks and between connected networks.
U.S. Pat. Nos. 5,835,726 (filed on Jun. 17, 1996) and U.S. Pat. No. 5,606,668 (filed on Dec. 15, 1993), both of which are hereby incorporated by reference as if fully disclosed herein, describe methods for providing network security by controlling the inbound and outbound data packet flow in a computer network. The flow of packets is controlled through packet filtering, performed according to a user-generated rule base which is then converted into a set of filter language instructions. Each rule in the rule base includes a source, destination, service, whether to accept or reject the packet and whether to log, encrypt and/or authenticate the event. The set of filter language instructions are installed and execute on inspection engines which are placed on computers acting as firewalls. The inspection engines perform stateful inspection in order to determine whether a packet should be permitted to enter through the firewall. The firewalls are positioned in the computer network such that all traffic to and from the network to be protected is forced to pass through the firewall. Thus, packets are filtered as they flow into and out of the network in accordance with the rules comprising the rule base.
According to these references, the inspection engine acts as a virtual packet filtering machine which determines on a packet by packet basis whether to reject or accept a packet. If a packet is rejected, it is dropped. If it is accepted, the packet may then be modified. Modification may include encryption, decryption, signature generation, signature verification or address translation. All modifications are performed in accordance with the contents of the rule base.
Unfortunately, one drawback of the disclosed method is that a large computational burden is placed upon the computer which operates the firewall. The previously disclosed processes of packet filtration require each packet to be separately analyzed, with many different comparisons to the set of rules according to which packet entry through the firewall is determined. However, once a session, or connection between two nodes which is established through the firewall, has been validated as permitted, then in most cases, further intensive analysis may not be necessary. Thus, reducing or even eliminating the requirement for continued analysis of packets from a permitted connection would significantly reduce the computational burden imposed by a firewall and accelerate the process of packet filtering, while still maintaining the security of the protected system.
There is thus a need for, and it would be useful to have, a system, a device and a method for rapid packet filtration according to the connection from which a packet is received, such that if a packet is received from a permitted connection, the requirement for complete packet analysis is reduced or even eliminated, while the ability to rapidly and efficiently modify packets is still maintained, optionally through hardware acceleration of the modification process.
SUMMARY OF THE INVENTION
The present invention is of a system, a device, and a method for accelerating packet filtration on a packet-switched network, preferably an IP network, by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a limited set of actions with regard to the packets, according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or “off-loaded” the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with a particular session-control field value which indicates that the session is finished, such that the connection is closed.
For example, for the preferred implementation of the present invention with IP networks, such a session-control field value is a FIN/RST flag which is set for the packet.
One advantage of reducing or even eliminating the amount of analysis which is required for packets from a permitted connection is that the firewall can optionally be supplemented by hardware acceleration. Such hardware acceleration has the advantage of being much more rapid than software-based packet processing, and can therefore significantly increase the efficiency of the firewall system. In addition, hardware acceleration of the modification process can maintain the ability to rapidly and efficiently modify packets, since the modification process requires less “intelligence” for modifying the packets but faster processing, while the opposite characteristics are true for the process of packet analysis. Thus, optionally and preferably, the pre-filtering module is implemented as hardware.
According to the present invention, there is provided a system for accelerated packet filtering, the system comprising: (a) a source node for transmitting a packet; (b) a destination node for receiving the packet; (c) a firewall interposed between the source node and the destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module being in communication with the firewall, for receiving at least one instruction from the firewall and for receiving the packet before the firewall, such that if the packet is permitted according to the at least one instruction, the pre-filtering module handles the packet, and alternatively the pre-filtering module forwards the packet to the firewall for handling.
According to another embodiment of the present invention, there is provided a system for accelerated filtering of a packet on a network, the system comprising: (a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module located on the network and in communication with the firewall, for receiving at least one instruction from the firewall, the at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before the firewall, such that if the packet is permitted according to the simple comparison, the pre-filtering module at least transmits the packet on the network.
According to yet another embodiment of the present invention, there is provided, for use in a system for accelerated packet filtration, the system featuring a network
Fink Gonen
Harush Amir
Check Point Software Technologies LTD
Friedman Mark M.
Wright Norman M.
LandOfFree
System, device and method for rapid packet filtering and... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System, device and method for rapid packet filtering and..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System, device and method for rapid packet filtering and... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2978201