Patent Publication Number: US-2003233582-A1

Title: Methods and apparatus for a computer network firewall which can be configured dynamically via an authentication mechanism

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
     [0001] Provisional patent application No. 60/367,223 Filing date Apr. 9, 2002 
    
    
     
       BACKGROUND OF THE INVENTION  
       [0002] 1. Field of the Invention  
       [0003] This invention relates to the prevention of unauthorized access in computer networks and, more particularly, to firewall protection within computer networks.  
       [0004] 2. Background of the Invention  
       [0005] In computer networks, information is conventionally transmitted in the form of packets. Information present at one site may be accessed by or transmitted to another site at the command of the former or the latter. Thus if information is proprietary, there is a need for safeguards against unauthorized access. To this end, techniques known as packet filtering effected at a network processor component known as a firewall, have been developed and commercialized. At the firewall, packets are inspected and filtered, i.e., passed on or dropped depending on whether they conform to a set of predefined access rules. Typically, a firewall administrator allows broad access that is consented to from one side of the firewall to the other, but blocks transmissions in the opposite direction that are not part of an active network session. For example, “inside” company employees may have unrestricted access through the firewall to an “outside” network such as the Internet, but access from the Internet is blocked unless it has been specifically authorized. There are two types of firewalls—Perimeter firewalls and Host-resident firewalls.  
       [0006] Perimeter firewalls sit between the “unfriendly” network, i.e., the Internet, and the “friendly” enterprise network. These provide a security gateway between the two environments, inspecting and filtering all incoming and outgoing data traffic at a single checkpoint.  
       [0007] Host-resident firewalls are host-resident security software applications that protect the enterprise network&#39;s critical endpoints against unwanted intrusion. Usually deployed behind the perimeter firewall, they provide a second layer of defense. They work by enabling only essential traffic into the machine they protect, prohibiting other types of traffic to prevent unwanted intrusions. Whereas the perimeter firewall must take a generalist, common denominator approach to protecting servers on the network, Host-resident firewalls act as specialists. They offer the advantage of filtering traffic from both the Internet and the internal network. This enables them to prevent hacking attacks that originate from both the Internet and the internal network. This is important because the most costly and destructive attacks still originate from with the organization.  
       [0008] 3. Problems with Current Firewalls  
       [0009] The problem with both the above firewalls is that they can filter only statically assigned IP addresses. A Perimeter Firewall can filter traffic between the external network and the internal network. If the firewall is breached, the computers on the internal network are unprotected. Host-resident firewalls solve this problem by placing a firewall on the computer itself. However, the firewall can only be configured to filter out traffic from the outside network. It suffers from the same security problems as a Perimeter Firewall and can also be breached.  
       [0010] The solution is to allow access only from selected computers within the internal network. The problem with this is that the computers in the internal network have their IP addresses assigned dynamically, i.e. it changes every time the computer is booted up.  
       [0011] In preparing for this application, a review of various patent resources was conducted. The review resulted in the inventor gaining familiarity with the following patents:  
                                                           PAT. NO.   INVENTOR   ORIG. CLASS   ISSUE DATE                          6,442,588   Clark et al.   709/203   Aug. 27, 2002           6,353,856   Kanemaki et al.   709/229   Mar. 5, 2002           5,950,195   Stockwell et al.   704/229   Sep. 7, 1999           6,519,703   Joyce et al.   713/201   Feb. 11, 2003           6,052,788   Wesinger et al.   713/201   Apr. 18, 2000                      
 
       SUMMARY OF THE INVENTION  
       [0012] The present invention, hereinafter referred to as NetFirewall, provides techniques for implementing computer network firewalls so as to improve security by allowing access only from selected computers within the internal network.  
       [0013] In accordance with a first aspect of the invention, NetFirewall is able to support a firewall with a client-server architecture.  
       [0014] In accordance with a second aspect of the invention, NetFirewall can be configured to handle dynamic IP addresses as well as static IP addresses.  
       [0015] In accordance with a third aspect of the invention, NetFirewall can be configured to provide authenticated access to a firewall.  
       [0016] In accordance with a fourth aspect of the invention, NetFirewall can be configured to provide “Single Sign-On” access to multiple firewalls.  
       [0017] In accordance with a fifth aspect of the invention, NetFirewall can be configured to encrypt packets between two firewalls.  
     
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
     [0018]FIG. 1 is a schematic of a perimeter firewall providing security to the corporate network from the Internet.  
     [0019]FIG. 2 is a schematic of the NetFirewall system within a corporate network.  
     [0020]FIG. 3 is a flowchart of the NetFirewall logon process.  
     [0021]FIG. 4 is a flowchart of the NetFirewall logoff process. 
    
    
     DESCRIPTION OF THE INVENTION INCLUDING PREFERRED EMBODIMENTS  
     [0022] The preferred techniques can be implemented at a firewall for controlling the flow of data between, for example, separate local area networks (LANs) or subnets of a LAN. Exemplary embodiments of the invention are described herein in terms of processes. Efficient prototypes of such processes have been implemented as computer system software, for implementation on general-purpose PC hardware. Efficiency can be enhanced further, as is known, by special-purpose firmware or hardware computer system implementations.  
     [0023] 1. Firewall with a Client-server Architecture  
     [0024] Existing firewalls are implemented in a server-only architecture. This is illustrated in FIG. 1 which shows a perimeter firewall  103  protecting a corporate network  102  and a computer on it  101 . The perimeter firewall  103  is connected to the Internet  105  via a router  104 .  
     [0025]FIG. 2 depicts the NetFirewall architecture. The client-side component “NetFirewall Client” is resident in a user computer B  201 . The server-side component “NetFirewall Server” is resident on a server computer C  202 . The “NetFirewall Controller” D  203  controls access between B  201  and C  202 .  
     [0026] 2. Handling Dynamic as Well as Static IP Addresses  
     [0027] Existing firewalls have rules that control access between networks (in the case of a perimeter firewall) or between a network and a computer (in the case of a host-resident firewall). In either case, the rules are based on statically assigned IP addresses. These rules are programmed by a firewall administrator. Like existing firewalls, NetFirewall can have the rules based on statically defined IP addresses that are programmed by a firewall administrator.  
     [0028] Unlike existing firewalls, NetFirewall can also have the rules based on dynamically assigned IP addresses that are programmed by the client-side component of NetFirewall via the NetFirewall Controller using an authentication mechanism.  
     [0029] 3.Authenticated Access to a Firewall  
     [0030] Existing firewalls do not have authenticated access. The access is controlled by a set of static rules defined by the firewall administrator. Once the rules are defined, any computer within the authorized network has access via the firewall at any time.  
     [0031] Unlike existing firewalls, NetFirewall can have dynamic rules which are programmed by the NetFirewall Client via the NetFirewall Controller using an authentication mechanism. A user can “logon” to the firewall and “logoff” from the firewall.  
     [0032]FIG. 3 is a flowchart of the NetFirewall logon process. The following steps are included:  
     [0033] 301: A user invokes the NetFirewall Client software on their computer. A box is displayed prompting the user to enter a username and a password. After the information is entered, the user clicks a button labeled “Logon”. The information is sent to the NetFirewall Controller in encrypted form.  
     [0034] 302: The NetFirewall Controller validates the username and password against data stored in its internal database. If the validation is successful, further processing occurs.  
     [0035] 303: The NetFirewall Controller extracts the dynamically assigned IP address of the user&#39;s computer from the logon message and checks whether it originates from a computer within the authorized network. If the validation is successful, further processing occurs.  
     [0036] 304: The NetFirewall Controller sends the IP address of the user&#39;s computer to the NetFirewall Server. The information exchange between the NetFirewall Controller and NetFirewall Server is sent in encrypted form after mutual authentication. The NetFirewall Server adds the IP address of the user&#39;s computer to its rule table.  
     [0037]FIG. 4 is a flowchart of the NetFirewall logoff process. The following steps are included:  
     [0038] 401: A user invokes the NetFirewall Client software on their computer. A box is displayed prompting the user to enter a username and a password. After the information is entered, the user clicks a button labeled “Logoff”. The information is sent to the NetFirewall Controller in encrypted form.  
     [0039] 402: The NetFirewall Controller validates the username and password against data stored in its internal database. If the validation is successful, further processing occurs.  
     [0040] 403: The NetFirewall Controller sends the IP address of the user&#39;s computer to the NetFirewall Server. The information exchange between the NetFirewall Controller and NetFirewall Server is sent in encrypted form after mutual authentication. The NetFirewall Server deletes the IP address of the user&#39;s computer from its rule table.  
     [0041] The logoff process can happen without the intervention of the NetFirewall Client based upon adminstrator criteria, such as time-of-day. For example, the administrator can program the NetFirewall Controller to logoff all users from 6.00 pm till 8.00 am.  
     [0042] 4. Single Sign-On Access to Multiple Firewalls  
     [0043] The NetFirewall Controller can have a list of server computers (which have the NetFirewall Server) a given user can access. This list can be customizable per user. After the user login process, the NetFirewall Server programming step (see 304 above) can be done for all the server computers on the user list.  
     [0044] 5.Packet Encryption Between Two Firewalls  
     [0045] The NetFirewall Controller can act as a key distribution center and distribute session encryption keys between the NetFirewall Client and the NetFirewall Server. These keys can be used to encrypt data between the NetFirewall Client and the NetFirewall Server.