Abstract:
Data transfer is controlled between a first network and a second network of computers by a firewall-proxy combination. Active interpretation of protocol commands exchanged between the first network and the second network is performed to determine specific actions concerning completion of the protocol request. This active firewall-proxy combination may exist on either the first or second network of computers. This method of control provides centralized control and administration for all potentially reachable resources within a network.

Description:
FIELD OF THE INVENTION 
     The present invention relates to the field of providing information over a network. More particularly, this invention relates to selectively controlling data transferred between two networks based upon protocol commands. 
     BACKGROUND OF THE INVENTION 
     The Internet is comprised of many computers communicating in a standardized manner. These communications are standardized to allow applications to interoperate on behalf of the users. Client applications may communicate with other client applications or communicate with servers to get access to resources on the network. These resources may include anything from actual file data, to computational resources, to communications channels. The internet applications use these standardized protocols or methods of communications so that independently developed and deployed computers programs may work together across a campus or continent. 
     The Internet has many standardized protocols for accomplishing various computerized tasks. File Transfer Protocol (FTP) is utilized to move files and manipulate file systems from locations remote to the data. These files may consist of any type of data that the native file system can store. The Remote Terminal Protocol (Telnet) is used to access another computer from a remote location, but to provide the same functionality that a user would have if they were locally connected. Simple Mail Transfer Protocol (SMTP) is used to exchange email between computers. As a final example, Hypertext Transfer Protocol (HTTP) is the protocol that is used on the World Wide Web to exchange text and richer multimedia enhanced information. 
     A firewall is used to separate one network of computers from another. For example, a corporation that connects its internal Intranet, to the Internet may install a firewall to prevent users outside the corporation from arbitrarily accessing data stored on the computer network within the corporation. Additionally, the firewall can prevent users within the corporation from providing inappropriate data out to the Internet. 
     A Firewall is a specially configured computer that can interrupt the flow of communications between two or more computers. A Firewall can interpret the lower level addressing information on the communications and decide whether or not to let to the transaction complete. This addressing information may control which physical machines may be interconnected. For finer grained control, the ability to address specific applications running on a computer may also be arbitrated. This provides a secure, but relatively coarse level of access control for corporate Intranets. 
     A Proxy sits on top of a firewall; Proxies look at a higher level of the communications than the Firewall normally does. It is typically a process that responds and acts on behalf of, client requests. Proxies understand and have the ability to interpret the protocol that is exchanged between the opposing sides of the application. A Proxy may be used to improve performance by caching data from previous retrievals. A Proxy may look at the initial protocol requests from the communicating applications to verify their authenticity and then signal the Firewall to allow communications to proceed. In this manner, once a ‘session’ is created, no further interpretation is needed. 
     SUMMARY OF THE INVENTION 
     A method of controlling data transfer between a first network and a second network of computers is described. Active interpretation of protocol commands exchanged between the first network and the second network is done, to determine specific actions concerning completion of the protocol request. This active firewall-proxy combination may exist on either the first or second network of computers. This method of control provides centralized control and administration for all potentially reachable resources within a network. 
     These and other advantages of the present invention are fully described in the following detailed description. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a block diagram of a firewall/proxy separating a first network from a second network of computers. 
     FIG. 2 includes various protocol commands that might be interpreted by a proxy. 
     FIG. 3 shows a flowchart of the steps taken using the present invention. 
    
    
     DETAILED DESCRIPTION 
     A method of controlling application communications and data transfer between a first network and a second network of computers is described. Protocol exchanges, such as File Transfer Protocol (FTP) or Hypertext Transfer Protocol (HTTP), received from the first network by the second network is parsed and interpreted to determine requests within the application protocol. The second network of computers makes a completion decision as to whether to allow the command(s) based on the protocol information. The second network of computers may allow complete exchange or partial exchange between the application(s). The second network of computers may deny the exchange until a later time, or it may cache the exchange to allow its clients to access the data from this transfer without the need to retrieve the data a second time from the first network. Various other completion decisions based upon resource constraints, specific rights of the user are also possible. 
     FIG. 1 is a block diagram of a firewall/proxy separating a first network from a second network of computers. The first network, network A, is the Internet  10  which includes the many host computers and its many HTTP, SMTP, FTP and Telnet sites, such as WEB site  12  and FTP site  13 . 
     Network A is coupled to Network B, which may be a corporate network of computers, for example. In one embodiment, Network B comprises a first filtering router  20 , a proxy  22 , and a second filtering router  24 . Additionally, Network B may host a number of services such as FTP and WEB that are accessible to Network A. Network B may also host many other client computers  30  connected to its network. 
     The filtering router  20  is connected to the Internet  10 . The filtering router  20  accepts only requests with source addresses from the proxy  22  for destinations of the Internet  10 . The filtering router  20  also only allows protocol messages received from the Internet  10  that are addressed for proxy  22 . 
     Similarly, the filtering router  24  is connected to the client computers  30 . The filtering router  24  accepts requests from the client computers  30  only directed to the proxy  22 . The filtering router  24  also only allows data from the proxy  22  to be provided to the client computers  30 . 
     The Proxy  22  sits between the filtering routers  20  and  24 . Thus, the proxy controls the client computers  30  from accessing the Internet  10  directly. The proxy is able to monitor all protocol exchanges between Network B and Network A. 
     In the prior art, the proxy  22  receives a connection request via filtering router  24  from one of its clients to initiate a protocol exchange from the Internet. The proxy requests the data from the Internet which is allowed to pass through the filtering router  20 . When the request response is returned from the Internet, the filtering router  20  allows the message to be provided to the proxy  22 . The proxy then provides the message to the client  30  that originated the request. Thus, the completion of any exchange is managed in a centralized, but universal manner, by the proxy  22 . 
     In the present invention, the proxy  22  actively monitors and interprets the protocol exchanges that occur between the Internet. The proxy looks at session information and specific commands that may be used during the protocol exchange about the content of the data, as will be described further with reference to FIG.  2 . The proxy then determines completion decisions as to whether to allow the command to complete based upon the information within the protocol. The decision can be completely dynamic, based upon the current parties and environment active at that point in time. For example, the proxy may allow complete transfer or partial transfer of the data within FTP, depending on the text mode that has been set by the client. It may defer the transfer until a later time, or it may cache the file to allow its clients to access the file from this transfer without the need to retrieve the file a second time from the Internet. Various other completion decisions based upon resource constraints, specific rights of the user, and exact protocol commands are possible, as will be described. 
     In contrast, in the prior art, a proxy typically allowed or disallowed an entire session. Thus, either access was completely allowed between a client computer on the first computer network and another computer on the second computer network, or the access was completely disallowed. Decision making was not performed dynamically during ongoing protocol exchanges. 
     The proxy  22  may be comprised of one or more computers. Additionally, proxy  22  may comprise other proxies which communicate with the Internet, such as the previously listed SMTP, HTTP, and Telnet proxies. Proxy  22  processes the requests from the client computers  30  and the responses received from the Internet  10 . 
     FIG. 2 includes various protocol commands that might be interpreted by a proxy. This is not meant to be an exhaustive list, and may be extended to include future protocol commands. During certain times of the day the Network B may disallow transfer of files over a specified size, or may prevent the transfer of binary or picture files to a particular system. At other times of the day, these transfers will be allowed. These restrictions may be based upon resource constraints of the network during peak hours during which normal business over the Network B would become too slow without the restrictions. 
     Certain users, however, may be allowed access to files of any size or type at any time of the day. The Proxy uses access rights associated with a user, to appropriately determine completion actions whether to allow the transfer. In this manner, communications and information exchanges can be controlled in a centralized fashion. 
     Miscellaneous Protocol Controls 
     Other protocol information that can be used by the proxy to make completion decisions include specific recipients of data, auxiliary connections that might be needed or extended searching mechanisms. The proxy can access information about the users on its client systems which allows the proxy to determine whether certain users should be allowed to complete protocol transactions in particular situations. The proxy may also store information about certain destination sites and disallow certain types of accesses based upon the destination site. 
     FIG. 3 shows a flowchart of the steps taken using the present invention. The flowchart starts at block  60  from which it continues at block  62 . At block  62 , a session between the first and second computer networks is established. The session may be initiated by a client computer in net  30 . For example, the client computer may request access to an internet site via the proxy  22 . The proxy  22 , in response, establishes the session with the internet site. A session may also be established from an internet site requesting from the proxy access to a client server in net  30 . 
     The flowchart continues at block  64 , at which the protocol commands exchanged within the session established between the first and second computer networks are parsed, or interpreted. 
     The flowchart continues at block  66 , at which completion actions are determined based upon the protocol commands for restricting access to certain resources within the first and second computer networks. 
     The flowchart continues at block  68 . If it is the end of the session, then operation continues at block  70 , at which the session terminates, otherwise, operation returns to block  64  at which protocol commands are continued to be parsed. From block  70 , the flowchart terminates at block  72 . 
     Specific Examples 
     Some examples may help clarify possible uses of the invention. In a first example, a session is established originating from a client computer on net  30  via the proxy to a FTP site on the internet. FTP allows transfer in a text mode and in a binary mode. In one case, the proxy parses the command protocol stream to prevent a switch from one mode to the other initiated by the client computer. In another case, the proxy disallows the data being retrieved in one of the FTP modes. These restrictions may be based upon attributes of the client computer, the user of the client computer, or the FTP site. It may also be based upon the time of day or other resource constraints. 
     In a second example, a session is established via a SMTP protocol. Within the SMTP protocol, an EXPN command allows access to mailing list information. The proxy may restrict the EXPN command from being transferred between the two networks based upon predetermined rules which are stored within the proxy. Alternatively, the proxy may interpret the SMTP stream of commands to disallow email from a particular sender to be accepted for a particular recipient. 
     In a third example, a session is established between a client computer in net  30  and an internet web site via the HTTP protocol. The proxy may allow commands from the client computer to read from the web site; however, the proxy may disallow posts (or writes) to the web site. 
     In the foregoing specification, the invention has been described with reference to specific exemplary embodiments thereof. It will, however be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.