Organizing computer network identifications and concurrent application of policy selectors

Methods, apparati, and computer-readable media for associating computer network identifications with network policies. A plurality of network detectors (3) are coupled to a client computer (1). A network probe (4), coupled to the network detectors (3), associates each network identification revealed by a network detector (3) with a netspec. A netspec database (6), coupled to the network probe (4), associates netspecs with locations. A policy guide (8), coupled to the network probe (4), associates network identifications with locations. A network interface module (9), coupled to the policy guide (8), implements network policies based upon locations.

TECHNICAL FIELD

This invention pertains to the field of acquiring and managing classifications of computer networks and applying network identifications to the selection of polices in a firewall or other network interface component.

BACKGROUND ART

With the high proliferation of notebook and other portable computers, it is becoming common for a computer to be connected to the Internet and other networks from different access points at different times. In addition, single computers can be equipped with multiple network devices operating on different media, each with an independent path to the Internet. For example, a single computer may be equipped with a LAN device, a wireless device, a telephone modem interface, and other network devices, some or all of which can be operated simultaneously.

The level of security required to safely conduct network communications may vary, depending upon the method of access being used. It would be beneficial for the end user to restrict access to interfaces to just those specific applications and services that require those interfaces, thus preventing misuse of those interfaces. For example, a user may wish to share data freely on private Web pages in his or her office environment LAN, but not want this access granted to connections from wireless or telephony sources.

Many vendors have implemented so-called location awareness features that address this need to some extent. Typically, the system is assigned a global state that represents the system's “location”, and this state is used to select policy settings. This approach does not allow for the possibility that multiple connections can be active at the same time, nor for the application of separate policies for simultaneous connections on different interfaces.

Location awareness features often allow user selection of the specific metric used to identify location (such as gateway, domain, DHCP server, etc.). However, these features do not integrate multiple methods for concurrent use.

What is needed is a means for allowing a user to integrate and manage multiple methods for establishing policy selectors, and to simultaneously assign a different selector to each interface on the system. The present invention accomplishes this, by allowing distinct policies to be applied separately to each data packet entering or leaving the user's computer, depending upon the interface used.

DISCLOSURE OF INVENTION

Methods, apparati, and computer-readable media for associating computer network identifications with network policies. A plurality of network detectors (3) are coupled to a client computer (1). A network probe (4), coupled to the network detectors (3), associates each network identification revealed by a network detector (3) with a netspec. A netspec database (6), coupled to the network probe (4), associates netspecs with locations. A policy guide (8), coupled to the network probe (4), associates network identifications with locations. A network interface module (9), coupled to the policy guide (8), implements network policies based upon locations.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1illustrates apparatus suitable for carrying out the present invention. A client computer1, which includes a processor and which may be a desktop computer or a portable computer such as a notebook computer or a hand-held PDA (Personal Digital Assistant), contains several network connections, i.e., means for connecting to one or more outside networks11, such as the Internet, an enterprise LAN (Local Area Network) or WAN (Wide Area Network), etc. These connections to outside networks11are typically made through a network interface module9, which can be a firewall, a router, a sniffer, an intrusion detection module, a behavior blocking module, and/or any other type of network communications module.

Associated with client computer1is a local network stack2, software that manages all of the network connections of client computer1. Stack2typically comprises a plurality of system API's (Application Program Interfaces). Coupled to local network stack2are a plurality of network detectors3. As used throughout this specification including claims, “coupled” refers any direct or indirect communicative coupling.FIG. 1illustrates three network detectors3, but there can be any finite number of them. Each network detector3is a module that can identify a particular network interface of computer1using a particular technology or system API.

Each input to a network detector3is a network interface (connection) specified by Internet Protocol (IP) address. The output of each detector3is a pair of tokens, which together are called the netspec (network specification) of that network interface. The first token is a detector token having a static value that identifies the specific detector3that created the netspec. Examples of suitable detectors3are Local IP, Gateway IP, Gateway MAC, DNS IP, Wireless SSID, and Dialup. The second token is a value that the particular detector3uses to uniquely identify the network interface. The first token specifies the domain of the second token.

Table 1 below illustrates various netspecs that can be produced by various detectors3.

Network probe4is a module that gathers identification information for each network connection in every way possible, and sorts this identification information into priority order. In one embodiment, network probe4periodically polls each detector3for a netspec that applies to each network interface that can be detected by that detector3. In an alternative embodiment, network probe4responds to signals emanating from the detectors3. The signals correspond to information about network connections that detectors3have gathered. Network probe4assembles a data structure (network interface list), illustrated in the left three columns of the below Table 2, consisting of all the netspecs that apply to each active network interface. Not all detectors3are able to supply a netspec for a particular network interface. For example, a dialup detector that identifies connections with phone numbers is not able to identify a LAN interface.

In Table 2, it can be seen that each detected network interface is assigned an arbitrary consecutive number (1to6in the illustrated example). Each network interface is uniquely identified by its local IP address in the second column of Table 2. The third column of Table 2 gives the netspec that a detector3has observed for that network interface. Table 2 illustrates six network interface entries, but only three unique network interfaces. Entries3through6represent the results of four different detectors3having detected the same network interface, one having a local IP address of 10.11.12.14.

In one embodiment, network probe4sorts the observed netspecs in a priority order on the basis of the detectors3that performed the observations. The prioritization can be based upon the fact that some detectors3are more reliable in observing certain network connections, and therefore it is deemed that these detectors3should be awarded priority. The priority order by which detectors3are associated with network connections can be fed to network probe4by a prioritization module5associated with network probe4. Prioritization module5can contain a user interface so that a human user of client computer1can easily set or change the priorities.

Netspec database6is a table showing the correspondence between netspecs and location identifiers. Thus, for each network interface entry, netspec database6contains two columns, illustrated as columns4and5in Table 2. Entries in the 4thcolumn are identical to those observed netspecs captured by network probe4(as entered in column3of Table 2). The fifth column of Table 2 gives location identifiers associated with each of the netspecs. Location identifiers are user assigned selectors that correspond to a particular desired policy set. Network interface module9uses these location identifiers to select specific rules (policies) that the user wishes to apply to particular network connections. Table 2 illustrates two different location identifiers,1and2. Location1may correspond to “home”, i.e., the computer1is being used at the user's home, while location identifier2may correspond to “work”, i.e., the computer1is being used at the user's work. Other examples of location can be “school”, “travel”, “guest”, etc.

Location identifiers can be assigned to specific netspecs via location setting module7coupled to netspec database6. Location setting module7may contain a user interface by which the user assigns a location to each netspec or changes an existing location. If no location has been assigned to a certain netspec, a unique location identifier, such as a −1 (minus 1) can be used to indicate the fact that the location is unassigned. In this embodiment, location setting module7can be configured to ask the user, e.g., via a pop-up window appearing on a display associated with computer1, for a location identifier to assign to that particular netspec. The user then tells location setting module7which location the user wishes to assign to that netspec. Similarly, the user can change the location associated with a given netspec at any time, by informing location setting module7of the new location that the user wishes to assign.

Network probe4provides (downloads) the correlation between the network connection (as identified by local IP address) and location (as given by the numerical location identifier) to policy guide8, a module which in turn feeds this information to network interface module9in real time. In one embodiment, network probe4simply selects the highest priority netspec for the particular network interface and looks up the corresponding location identifier in netspec database6. In an alternative embodiment, network probe4considers more than one netspec (for those network interfaces that have more than one netspec) before deciding which location identifier to provide to policy guide8, according to a pre-established algorithm.

For each network connection, network interface module9requests policy guide8to provide network interface module9with the associated location identifier. In the case where network interface module9is a firewall, this information can be provided from policy guide8to firewall9for each packet of data that enters or leaves computer1via firewall9. The locations are correlated with firewall settings on a distributed basis within firewall9. This is illustrated inFIG. 3, which shows three locations, identified as location1, location2, and location3; and three types of firewall settings: trusted computers, trusted networks, and trusted programs. In the example illustrated inFIG. 3, firewall9has been configured to implement three sets of network policies corresponding to the three locations. For location1, firewall9will allow communications between computer1and only computers A, B, and C; will allow these communications regardless of what network computers A, B, and C are part off and will allow these communications regardless of which program is being used. For location2, firewall9will allow communications between computer1and only computers D, E, and F; only when one of these computers D, E, F is part of the Internet; and only when the program Internet Explorer is being used. For location3, firewall9will allow computer1to communicate only with computer A; only over the enterprise LAN; and only using the e-mail program known as Outlook.

A user interface module10coupled to network interface module9allows a user of computer1to change the correlations between location identifiers and network interface module9settings, thereby changing the corresponding network policies.

Modules3through10can be implemented in software, hardware, firmware, or any combination thereof. When implemented in software, modules3through10can reside on a computer storage readable medium or on a plurality of computer readable storage media, such as one or more floppy disks, hard disks, CDs, DVDs, etc.

Let us now illustrate the above principles of the present invention by providing an example. In this example, computer1has two network interfaces: a wireless interface and a LAN interface. Network probe4enumerates the IP addresses of these two interfaces by polling the available detectors3. Let us assume that there are two detectors3: a first detector3(1) that detects the gateway MAC address and a second detector3(2) that detects wireless SSIDs. For the wireless network interface, both detectors3(1),3(2) acquire information pertaining to the interface, and deliver this information to network probe4. The gateway MAC detector3(1) delivers a netspec consisting of a gateway MAC token and the numeric value of the gateway MAC address. The wireless SSID detector3(2) delivers a netspec consisting of an SSID token and the string representation of the currently active SSID.

For the LAN network interface, the gateway MAC detector3(1) succeeds and returns a netspec. However, the wireless SSID detector3(2) fails to acquire an SSID, since this metric does not apply to LAN interfaces.

Network probe4thus produces a network interface list where each interface is stored with its own collection of netspecs. This is shown in the below table:

The netspecs are sorted according to a user specified identification priority. Once the above table is assembled, netspec database6is consulted by network probe4to find a corresponding location identifier for each network interface. In this example, netspec database6may consist of the following:

The above items are matched by network probe4with the preferred netspecs from the above netspec database6, resulting in a location table that network probe4downloads to policy guide8as follows:

Let us assume that, in this example, network interface module9is a firewall. The firewall9policies are selected according to the location identifiers provided to firewall9by policy guide8. For instance, let us assume that the user of computer1wants to restrict a local Web server1to honor requests that emanate only from the user's office LAN but not from wireless sources. An incoming request packet arrives at firewall9from a wireless source and has a destination address of 10.20.30.40. By consulting policy guide8, firewall9determines that the request is associated with location identifier1, which represents the wireless interface. This identifier is then used to select a firewall9policy that blocks the request.

An exemplary method embodiment of the present invention is now described in conjunction withFIG. 2. Let us assume that client computer1is a laptop, and network interface module9is a firewall. User Joe turns on his laptop1, installs firewall9, and configures the firewall9settings. A pop-up window appears on the display of laptop1asking Joe whether he wishes to activate the present invention by means of activating the network detectors3associated with laptop1. In an optional step, Joe is asked whether he wishes to prioritize detectors3, so that, for subsequent steps there will be just one detector3associated with one network connection. At this time, Joe can also select which detectors3are allowed to be considered for which network connectors. Joe may not wish for all of the detectors3to be used for all possible network connectors, because he may consider some detectors3to be less reliable than others.

If Joe decides to activate the network detectors3, modules3,4perform step21, during which the network connections of laptop1are determined. Network detectors3look for network connections, and network probe4periodically polls the detectors3to see whether a physical network connection has changed, a VPN (Virtual Private Network) has changed, etc. The polling may be performed every n seconds, where n is preselected by Joe. n can be modified, e.g., by Joe changing this parameter via prioritization module5.

As a result of step21, network probe4produces a table of observed netspecs. For each new netspec (i.e., a netspec that doesn't have an associated location), Joe is asked to identify the netspec with a location. He does this via location setting module7. Netspec database6can contain predefined default locations (such as “home, “office”, “away”) for some or all netspecs. The predefined locations have policies associated with them, embodied in firewall9. For each non-predefined location, Joe is asked to define the set of policies that he wishes to associate with the location identifier. Joe provides this information to firewall9via user interface module10. This process can be facilitated using a wizard software module associated with user interface module10. The wizard walks Joe through the policy, setting by setting. The correlation between locations and policies is distributed throughout firewall9.

Joe is allowed to reassign a location to a netspec at any time via location setting module7. Joe is also allowed to reassign a policy to a location at any time via user interface module10.

At step22, network probe4associates network identifications with locations, and presents this information to policy guide8.

At step23, policy guide8feeds network identification/location pair information to firewall9on a real-time packet-by-packet basis. In turn, firewall9uses this information to determine which packets are allowed to and from laptop1, thereby implementing the network policies desired by Joe.