Dynamic firewall capabilities for wireless access gateways

• US 20060059551A1
• Filed: 09/13/2004
• Published: 03/16/2006
• Est. Priority Date: 09/13/2004
• Status: Abandoned Application

• Current Assignee: UTStarcom Incorporated (UTStarcom Holdings Corp.)
• Original Assignee: UTStarcom Incorporated (UTStarcom Holdings Corp.)
• Inventors: Borella, Michael
• Application Number:
  US10/939,675
• Publication Number:
  US 20060059551A1
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

The present invention provides a method and system for dynamic filtering of data packets at an access gateway in a communication network. According to the method, a policy server receives a request for registration with the network from a network node. The server verifies the network node identity and selects the corresponding security policy for the network node. The selected security policy is indicated by the server to a network access gateway. The network access gateway selects the indicted security policy. The selected security policy is applied for the communication between the network node and the network.

Claims

1. A method for dynamic filtering of data packets at an access gateway in a network, the method comprising the steps of:

a. receiving a registration request on behalf of a network node for access to a network;

b. answering the registration request; and

c. filtering data packets associated with the network node.

2. The method according to claim 1 wherein the network is a home network.

3. The method according to claim 1 wherein the network is a foreign network.

4. The method according to claim 1 wherein the step of answering the registration request comprises granting access to the network.

5. The method according to claim 1 wherein the step of filtering data packets at the access gateway comprises performing the filtering at a packet data serving node of the foreign network.

6. The method according to claim 1 wherein the step of filtering data packets at the access gateway comprises performing the filtering at a home agent of the home network.

7. The method according to claim 1 wherein the step of filtering data packets comprises applying an appropriate security policy, the appropriate security policy being indicated by information inherent to the access gateway.

8. The method according to claim 7 wherein the step of applying appropriate security policy comprises:

a. selecting the appropriate policy, corresponding to the network node, from the set of policies maintained at the access gateway; and

b. applying the appropriate policy, the appropriate policy being maintained at the access gateway, to the communication of the network node.

9. The method according to claim 7 wherein the step of choosing the appropriate policy comprises choosing on the basis of domain name of the network node.

10. The method according to claim 7 wherein the step of selecting the appropriate policy from the set of policies maintained at the access gateway comprises a general security policy being configured, the general security policy being configured for all network nodes in the network.

11. The method according to claim 1 wherein the step of filtering data packets comprises applying an appropriate security policy, the appropriate security policy being indicated in a message received from an authentication, authorization and accounting server.

12. The method according to claim 11 wherein the step of filtering data packets comprises applying an appropriate security policy to the communication of the network node, the appropriate security policy being maintained at the access gateway.

13. A method for dynamic filtering of data packets at an access gateway in a foreign network, the method comprising the steps of:

a. receiving a registration request on behalf of a network node for access to a network, the registration request comprising an identifier wherein the identifier identifies the network node;

b. answering the registration request; and

c. filtering data packets associated with the network node at the access gateway.

14. The method according to claim 13 wherein the step of receiving a registration request comprises receiving a registration request for access to the network through mobile Internet Protocol.

15. The method according to claim 13 wherein the step of answering the registration request comprises granting access to the network.

16. The method according to claim 13 wherein the step of filtering data packets at the access gateway comprises performing the filtering at a packet data serving node of the foreign network.

17. The method according to claim 13 wherein the step of filtering data packets comprises applying an appropriate security policy, the appropriate security policy being indicated by information inherent to the access gateway.

18. The method according to claim 17 wherein the step of applying appropriate security policy comprises the steps of:

a. selecting the appropriate policy, corresponding to the network node, from the set of policies maintained at the access gateway; and

b. applying the appropriate policy, the appropriate policy being maintained at the access gateway, to the communication of the network node.

19. The method according to claim 17 wherein the step of choosing the appropriate policy comprises choosing on the basis of domain name of the network node.

20. The method according to claim 17 wherein the step of selecting the appropriate policy from the set of policies maintained at the access gateway comprises a general security policy being configured, the general security policy being configured for all network nodes in the network.

21. The method according to claim 13 wherein the step of filtering data packets comprises applying an appropriate security policy, the appropriate security policy being indicated in a message received from an authentication, authorization and accounting server.

22. The method according to claim 21 wherein the step of filtering data packets comprises applying an appropriate security policy to the communication of the network node the appropriate security policy being maintained at the access gateway,

23. A method for dynamic filtering of data packets at an access gateway in a home network, the method comprising the steps of:

a. receiving a registration request on behalf of a network node for access to a network, the registration request comprising an identifier wherein the identifier identifies the network node;

b. answering the registration request; and

c. filtering data packets associated with the network node at the access gateway.

24. The method according to claim 23 wherein the step of receiving a registration request on behalf of a network node comprises receiving the registration request from a mobile device.

25. The method according to claim 23 wherein the step of receiving a registration request comprises receiving a registration request for access to the network through mobile Internet Protocol.

26. The method according to claim 23 wherein the step of answering the registration request comprises granting access to the network.

27. The method according to claim 23 wherein the step of filtering data packets at the access gateway comprises performing the filtering at a home agent of the home network.

28. The method according to claim 23 wherein the step of filtering data packets comprises applying an appropriate security policy, the appropriate security policy being indicated by information inherent to the access gateway.

29. The method according to claim 28 wherein the step of applying appropriate security policy comprises the steps of:

a. selecting the appropriate policy, corresponding to the mobile device, from the set of policies maintained at the access gateway; and

b. applying the appropriate policy, the appropriate policy being maintained at the access gateway, to the communication of the mobile device.

30. The method according to claim 28 wherein the step of choosing the appropriate policy comprises choosing on the basis of domain name of the mobile device.

31. The method according to claim 28 wherein the step of selecting the appropriate policy from the set of policies maintained at the access gateway comprises a general security policy being configured, the general security policy being configured for all mobile devices in the network.

32. The method according to claim 23 wherein the step of filtering data packets comprises applying an appropriate security policy, the appropriate security policy being indicated in a message received from an authentication, authorization and accounting server.

33. The method according to claim 32 wherein the step of filtering data packets comprises applying an appropriate security policy to the communication of the network node, the appropriate security policy being maintained at the access gateway.

34. A system for dynamic filtering of data packets in a network, the system comprising:

a. at least one server for receiving a registration request made by a network node for access to the network resources, the server sending a reply to the network node in response to the registration request; and

b. an access gateway, embedded on the server, for performing filtering of data packets associated with the network node.

35. The system according to claim 34 wherein the server is a local policy server, the local policy server providing appropriate security policy for the network node to communicate with network resources.

36. The system according to claim 34 wherein the server in the network is a server providing authentication, authorization, and accounting services, the server indicating the appropriate security policy for the network node to communicate with network resources.

37. The system according to claim 34 wherein the access gateway is a packet data-serving node in a foreign network.

38. The system according to claim 34 wherein the access gateway is a home agent in a home network.

39. A system for dynamic filtering of data packets in a network, the system comprising:

a. at least one server for receiving registration request made by a network node for access to the network, the server sending a reply to the network node in response to the registration request; and

b. a packet data serving node in a foreign network, for performing filtering of data packets associated with the network node.

40. The system according to claim 39 wherein the server is a local policy server, the local policy server providing appropriate security policy for the network node to communicate with network resources.

41. The system according to claim 39 wherein the server in the network is a server providing authentication, authorization, and accounting services, the server indicating the appropriate security policy for the network node to communicate with network resources.

42. A system for dynamic filtering of data packets in a network, the system comprising:

a. at least one server for receiving registration request made by a network node for access to the network, the server sending a reply to the network node in response to the registration request; and

b. a home agent in a home network, for performing filtering of data packets associated with the network node.

43. The system according to claim 42 wherein the server is a local policy server, the local policy server providing appropriate security policy for the network node to communicate with network resources.

44. The system according to claim 42 wherein the server in the network is a server providing authentication, authorization, and accounting services, the server indicating the appropriate security policy for the network node to communicate with network resources.

45. A computer program product for use with a computer, for dynamic filtering of data packets at an access gateway in a communication network, the computer program product performing the steps of:

a. receiving a registration request on behalf of a network node for access to the network, the registration request comprising an identifier wherein the identifier identifies the location of the network node;

b. answering the registration request; and

c. filtering data packets associated with the network node, wherein the location of filtering being decided on the basis of the identifier.