Device for checking firewall policy

• US 20050125697A1
• Filed: 01/07/2005
• Published: 06/09/2005
• Est. Priority Date: 12/27/2002
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Tahara, Satoshi
• Application Number:
  US11/030,400
• Publication Number:
  US 20050125697A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

An emulation unit establishes a virtual network equivalent to a network to be managed by a firewall device based on network configuration information. A check performing unit gives an instruction to verify the policies set in the firewall device to the emulation unit. The emulation unit transmits a packet to the firewall device based on the given instruction through a connection unit. The check performing unit verifies the policies set in the firewall device based on the response from the firewall device.

Claims

1. A policy checking device to check whether or not a policy is properly set in a firewall device, said policy checking device comprising:

a configuration information storage unit for storing network configuration information describing a network to be managed by said firewall device;

a policy information storage unit for storing policy information describing a policy to be enforced by said firewall device;

an emulation unit for establishing a virtual network based on the network configuration information and transmitting a packet using the virtual network;

a connection unit for connecting the virtual network and said firewall device; and

a check performing unit for checking whether or not the action of said firewall device is in accordance with the policy information by monitoring the packet transmitted by said emulation unit.

2. The policy checking device according to claim 1, wherein:

said emulation unit transmits to said firewall device a packet to be allowed by said firewall device; and

said check performing unit determines that a policy is not properly set in said firewall device if the packet is not received from said firewall device.

3. The policy checking device according to claim 1, wherein:

said emulation unit transmits to said firewall device a packet to be denied by said firewall device; and

said check performing unit determines that a policy is not properly set in said firewall device if said packet is received from said firewall device.

4. The policy checking device according to claim 1, wherein:

said emulation unit transmits to said firewall device a packet to be denied by said firewall device;

said check performing unit determines that a policy is properly set in said firewall device if a packet containing a predetermined message is received from said firewall device.

5. A policy checking device to check whether or not a policy including a condition and a result is properly set in a firewall device, said policy checking device comprising:

a detection unit for detecting a singular point condition from a policy to be enforced by said firewall device;

a selection unit for selecting predetermined number of ordinary area conditions other than the singular point condition from the policy to be enforced by said firewall device; and

a verification unit for verifying whether or not results corresponding to the singular point condition and the ordinary area conditions can be obtained by said firewall device.

6. The policy checking device according to claim 5, wherein:

said detection unit detects as the singular point condition the threshold address between an address to be allowed and an address to be denied.

7. The policy checking device according to claim 5, wherein:

said detection unit detects as the singular point condition the threshold port number between a port number to be allowed and a port number to be denied.

8. The policy checking device according to claim 5, wherein:

said verification unit transmits to said firewall device packets corresponding to the singular point condition and the predetermine number of ordinary area conditions respectively, and verifies whether or not a policy is properly set in said firewall device based on the action of said firewall device that receives the packets.

9. A policy checking method for checking whether or not a policy is properly set in a firewall device, said method comprising:

obtaining network configuration information describing a network to be managed by said firewall device;

obtaining policy information describing a policy to be enforced by said firewall device;

establishing a virtual network based on the network configuration information;

transmitting a packet to said firewall device using the virtual network; and

verifying whether or not the action of said firewall device is in accordance with the policy information by monitoring the packet transmitted to said firewall device.

10. A policy checking method for checking whether or not a policy including a condition and a result is properly set in a firewall device, said policy checking method comprising:

detecting a singular point condition from a policy to be enforced by said firewall device;

selecting predetermined number of ordinary area conditions other than the singular point conditions from the policy to be enforced by said firewall device; and

verifying whether or not results corresponding to the singular point condition and the ordinary area conditions can be obtained by said firewall.

11. A computer readable medium storing a policy checking program for checking whether or not a policy is properly set in a firewall device, said program enabling a computer to perform a method:

obtaining network configuration information describing a network to be managed by said firewall device;

obtaining policy information describing a policy to be enforced by said firewall device;

establishing a virtual network based on the network configuration information;

transmitting a packet to said firewall device using the virtual network; and

verifying whether or not the action of said firewall device is in accordance with the policy information by monitoring the packet transmitted to said firewall device.

12. A computer readable medium storing a policy checking program for checking whether or not a policy including a condition and a result is properly set in a firewall device, said program enabling a computer to perform a method:

detecting a singular point condition from a policy to be enforced by said firewall device;

selecting predetermined number of ordinary area conditions other than the singular point conditions from the policy to be enforced by said firewall device; and

verifying whether or not results corresponding to the singular point condition and the ordinary area conditions can be obtained by said firewall.