Firewall providing enhanced network security and user transparency

• US 20030196122A1
• Filed: 05/08/2003
• Published: 10/16/2003
• Est. Priority Date: 10/17/1996
• Status: Abandoned Application

• Current Assignee: Christopher D. Coley, Ralph E. Wesinger Jr
• Original Assignee: Christopher D. Coley, Ralph E. Wesinger Jr
• Inventors: Coley, Christopher D., Wesinger, Ralph E. Jr.
• Application Number:
  US10/434,330
• Publication Number:
  US 20030196122A1
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: B65B 11/004 in blanks, e.g. sheets precut and creased for folding
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 2101/677 Multiple interfaces, e.g. multihomed nodes
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2521 Translation architectures other than single NAT servers
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

The present invention, generally speaking, provides a firewall that achieves maximum network security and maximum user convenience. The firewall employs “envoys” that exhibit the security robustness of prior-art proxies and the transparency and ease-of-use of prior-art packet filters, combining the best of both worlds. No traffic can pass through the firewall unless the firewall has established an envoy for that traffic. Both connection-oriented (e.g., TCP) and connectionless (e.g., UDP-based) services may be handled using envoys. Establishment of an envoy may be subjected to a myriad of tests to “qualify” the user, the requested communication, or both. Therefore, a high level of security may be achieved. The usual added burden of prior-art proxy systems is avoided in such a way as to achieve fall transparency-the user can use standard applications and need not even know of the existence of the firewall. To achieve full transparency, the firewall is configured as two or more sets of virtual hosts. The firewall is, therefore, “multi-homed,” each home being independently configurable. One set of hosts responds to addresses on a first network interface of the firewall. Another set of hosts responds to addresses on a second network interface of the firewall. In one aspect, programmable transparency is achieved by establishing DNS mappings between remote hosts to be accessed through one of the network interfaces and respective virtual hosts on that interface. In another aspect, automatic transparency may be achieved using code for dynamically mapping remote hosts to virtual hosts in accordance with a technique referred to herein as dynamic DNS, or DDNS.

Claims

1. A method of operating a system for selectively facilitating a connection between a first computer and a second computer, the method comprising:

receiving a request from the first computer for the connection, the request including a name of the second computer; and

initiating one or more verification checks in response to the request including the name, the one or more verification checks for selectively facilitating the connection of the first computer to the second computer.

2. The method of claim 1, further comprising:

identifying a network address of the second computer based upon the name of the second computer.

3. The method of claim 1, further comprising:

mapping the name of the second computer to one or more network addresses associated with the system.

4. The method of claim 1, further comprising:

mapping the name of the second computer to one or more private IP addresses associated with the system.

5. The method of claim 1, further comprising:

channel processing any information passed between the first computer and the

second computer, wherein the channel processing includes one or more acts of encrypting, decrypting, encoding, decoding, compression, decompression, content filtering, image enhancement, sound enhancement, data enhancement, or virus detection.

6. A method of operating a third computer network in processing a request from a first computer network for connection to a second computer network, said method comprising:

receiving a request from the first computer network for the connection to the second computer network, the request including a domain name associated with the second computer network; and

initiating one or more verification checks in response to the reception of the request including the domain name, the one or more verification checks for selectively facilitating the connection of the first computer network to the second computer network.

7. The method of claim 6, further comprising:

identifying one or more network addresses associated with second computer network based upon the domain name associated with the second computer network.

8. The method of claim 6, further comprising:

mapping the domain name associated with the second computer network to one or more network addresses associated with the second computer network.

9. The method of claim 6, further comprising:

mapping the domain name associated with the second computer network to one or more private IP addresses associated with the second computer network.

10. The method of claim 6, further comprising:

channel processing any information passed between the first computer network and the

second computer network, wherein the channel processing includes one or more acts of encrypting, decrypting, encoding, decoding, compression, decompression, content filtering, image enhancement, sound enhancement, data enhancement, or virus detection.

11. A method of communicating data, comprising:

receiving a data unit, said data unit includes a destination address and a first set of information representing a first domain name, said destination address corresponds to each entity in a set of two or more entities, said domain name corresponds to a first entity in the set of two or more entities;

translating said first domain name to a first address, said first address corresponds to said first entity and does not correspond to any other entity in said set of two or more entities; and

sending said data unit to said first entity using said first address.

12. A method according to claim 11, wherein:

said first set of information includes said first domain name.

13. A method according to claim 11, wherein:

said first set of information includes said first domain name and a second domain name, said second domain name associated with a source of said data unit.

14. A method according to claim 11, wherein:

said first set of information includes a compressed form of said first domain name.

15. A method according to claim 11, wherein:

said first set of information includes a encoded form of said first domain name.

16. A method according to claim 11, wherein:

said first set of information includes an encrypted form of said first domain name.

17. A method according to claim 11, wherein:

said step of translating includes finding a record in a table associated with said first domain name, said record in said table includes first address; and

said steps of receiving, translating and sending are performed by a firewall.

18. A method according to claim 11, wherein:

said step of sending includes sending said data unit to a firewall.

19. A method according to claim 11, wherein:

said destination address is a global address; and

said first address is a local address.

20. A method according to claim 19, further comprising the step of:

replacing said global address in said data unit with said local address, said step of replacing being performed after said step of translating.

21. A method according to claim 11, wherein:

said step of receiving is performed by a second entity, said second entity corresponds to said destination address.