Patent ID: 7296291

Claim:
A method of controlling information flow through a firewall, said method comprising: determining a first incoming packet community set (PCS) of a first data packet received on an interface of said firewall; discarding said first data packet in response to detecting said first incoming PCS is not a subset of an interface community set (IFCS) of said interface; and processing said first data packet in response to detecting said first incoming PCS is a subset of said IFCS, wherein said processing comprises: matching said first data packet to a first rule of a plurality of rules of said firewall; comparing said first incoming PCS to a second incoming PCS specified by the first rule; changing the first incoming PCS in the first data packet to an outgoing PCS specified by the first rule, in response to determining the first incoming PCS matches the second incoming PCS; comparing said outgoing PCS with a destination community set of said first data packet, prior to transmitting the first data packet to said destination community; discarding said first data packet in response to detecting said outgoing PCS is not a subset of said destination community set; and further processing said first data packet in response to detecting said outgoing PCS is a subset of said destination community set; wherein the determining, discarding, and processing are performed within a single node of a network.