Patent ID: 7610621

Claim:
A method for controlling data flow through a firewall comprising: establishing a firewall model for the firewall, wherein the firewall model defines nodes, connections between the nodes, and a set of firewall rules applicable to the nodes, the connections between the nodes, or a combination thereof, wherein each of the nodes represents simultaneously a source and a destination for data packets, and wherein the set of firewall rules comprise a tree graph with an arriving sub-tree having one or more rule chains for conditioning the data packets without accepting or dropping the data packets, a matrix sub-tree having one or more rule chains for accepting or dropping in the data packets without changing the data packets, and an extensible sub-tree having one or more rule chains for providing dynamic extensibility to the firewall rules; implementing the firewall within one or more machines connected to network segments where the nodes reside; receiving a packet at an arriving node, wherein the arriving node is one of the nodes defined by the firewall model; conditioning the packet based on rules in the one or more rule chains in the arriving sub-tree that are associated with the arriving node; and accepting or dropping the packet based on rules in the one or more rule chains in the matrix sub-tree that are associated with the arriving node, an inter-node connection, or a combination thereof, wherein the inter-node connection is one of the connections defined by the firewall model.