Method for transparently managing outbound traffic from an internal user of a private network destined for a public network

• US 20050229248A1
• Filed: 03/03/2005
• Published: 10/13/2005
• Est. Priority Date: 02/06/1996
• Status: Active Grant

• Current Assignee: Christopher D. Coley, Ralph E. Wesinger Jr
• Original Assignee: Christopher D. Coley, Ralph E. Wesinger Jr
• Inventors: Coley, Christopher D., Wesinger, Ralph E. Jr.
• Granted Patent: US 7,383,573 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods and apparatus for transparently managing outbound traffic from an internal user of a private network destined for a public network are disclosed. Embodiments include a firewall device operable between an internal user of a private network and an IP-compliant network. The firewall device being configured to assign a proxy agent to process a request by the internal user to form a connection with a public network element through the IP-compliant network. Disclosed embodiments include the proxy agent forming a connection only if the internal user is authorized to access the public requested network element.

Claims

1. A method for transparently managing outbound traffic from an internal user of a private network destined for a public network comprising:

receiving a request from an internal user of a private network to access a public network element over an IP-compliant network;

assigning a proxy agent operable within said firewall to process said request;

determining, by said proxy agent, whether said internal user is authorized to access said public network element; and

if said user is authorized to access said public network element, then forming, by said proxy agent, a connection to said IP-compliant network element on behalf of said internal user.

2. The method of claim 1, wherein said act of determining whether said user is authorized to access said public network element occurs according to a set of predetermined rules.

3. The method of claim 2, wherein said set of predetermined rules includes comparing the source address of said access request against a list of addresses.

4. The method of claim 3, further comprising the act of performing additional verification based on the request'"'"'s port designation.

5. The method of claim 2, wherein said proxy agent is operable within a firewall, and said firewall appears as the source of the connection to said internal user.

6. A firewall device for transparently managing outbound traffic from an internal user of a private network destined for a public network comprising:

a firewall device operable between an internal user of a private network and an IP-compliant network;

the firewall device being configured to;

assign a proxy agent to process a request by said internal user to form a connection with a public network element through said IP-compliant network; and

wherein the proxy agent forms a connection to said public network element if said internal user is authorized to access said public network element.

7. The method of claim 6, wherein said user is determined to be authorized to access said public network element occurs according to a set of predetermined rules.

8. The method of claim 7, wherein said set of predetermined rules includes comparing the source address of said access request against a list of addresses.

9. The method of claim 8, wherein said proxy agent is further configured to perform additional verification based on the request'"'"'s port designation.

10. The method of claim 7, wherein said proxy agent is operable within said firewall device, and said firewall appears as the source of the connection to said internal user.

11. An apparatus for transparently managing outbound traffic from an internal user of a private network destined for a public network comprising:

means for receiving a request from an internal user of a private network to access a public network element over an IP-compliant network;

means for assigning a proxy agent operable within said firewall to process said request;

means for determining whether said internal user is authorized to access said public network element; and

means for forming a connection to said IP-compliant network element on behalf of said internal user if said user is authorized to access said public network element.

12. The apparatus of claim 11, further comprising means for determining whether said user is authorized to access said public network element occurs according to a set of predetermined rules.

13. The apparatus of claim 12, wherein said set of predetermined rules includes comparing the source address of said access request against a list of addresses.

14. The apparatus of claim 13, further comprising means for performing additional verification based on the request'"'"'s port designation.

15. The apparatus of claim 12, wherein said proxy agent is operable within a firewall, and said firewall appears as the source of the connection to said internal user.

16. A computer-readable device containing a set of instructions for causing a computer to perform a method for transparently managing outbound traffic from an internal user of a private network destined for a public network, the method comprising:

receiving a request from an internal user of a private network to access a public network element over an IP-compliant network;

assigning a proxy agent operable within said firewall to process said request;

determining, by said proxy agent, whether said internal user is authorized to access said public network element; and

if said user is authorized to access said public network element, then forming, by said proxy agent, a connection to said IP-compliant network element on behalf of said internal user.

17. The device of claim 16, wherein said act of determining whether said user is authorized to access said public network element occurs according to a set of predetermined rules.

18. The device of claim 17, wherein said set of predetermined rules includes comparing the source address of said access request against a list of addresses.

19. The device of claim 18, said method further comprising the act of performing additional verification based on the request'"'"'s port designation.

20. The device of claim 17, wherein said proxy agent is operable within a firewall, and said firewall appears as the source of the connection to said internal user.