Patent ID: 8127347
Filing Date: 2012-02-28
Classification: H04L

Abstract:
1. A method comprising: dividing a firewall into a plurality of virtual firewalls based on a plurality of network address ranges; dividing a plurality of users into a plurality of user groups in a first network based on a plurality of security policies; assigning each of said network address ranges to one of said user groups such that each of said virtual firewalls manages a respective user group and equips a security policy corresponding to said respective user group; accessing a first packet from a user group in said first network; checking a first network address associated with said first packet; identifying a corresponding virtual firewall associated with said user group according to said first network address; delivering said first packet to said corresponding virtual firewall; checking said first packet based on said security policy of said corresponding virtual firewall; sending said first packet to a second network if said first packet complies with said security policy; discarding said first packet if said first packet violates said security policy; accessing a second packet from said second network; delivering said second packet to one of said virtual firewalls according to a second network address associated with said second packet; sending said second packet to said first network if said second packet complies with said security policy of said one of said virtual firewalls; discarding said second packet if said second packet violates said security policy; and filtering said second packet if said second network address is outside the group consisting of a web server and a mail server.