System and method for behavior-based firewall modeling

• US 20050204402A1
• Filed: 03/10/2005
• Published: 09/15/2005
• Est. Priority Date: 03/10/2004
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Eric White
• Inventors: White, Eric, Turley, Patrick
• Granted Patent: US 7,610,621 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

One embodiment of the present invention creates a model of the traffic through a network firewall and uses that model to dynamically manipulate the network firewall based on human intervention or based on the automatic invocations of processes and protocols that implement firewall policy. Another embodiment of the invention creates a model of the physical and virtual network interfaces that a firewall system controls and presents abstracted entities representing both the interface abstractions and the processing nodes (network segments or network client devices) to and through which network traffic flows.

Claims

1. A method for controlling data flow through a firewall comprising:

establishing a firewall model for the firewall, wherein the firewall model defines nodes representing sources and destinations for data packets and connections between the nodes;

associating node-specific rules with each node that govern whether a packet sent to that node and from that node is blocked; and

blocking packets to and from a particular node based on the node-specific rules associated with that node.

2. The method of claim 1, further comprising associating one or more devices with each node.

3. The method of claim 1, further comprising associating one or more services with each node.

4. The method of claim 1, further comprising associating connection-specific rules with the connections and processing packets using a particular connection based on the connection-specific rules associated with that connection.

5. The method of claim 4, wherein the node-specific rules and connection specific rules comprise predicate/antecedent rules.