Method, apparatus and computer program product enabling negotiation of firewall features by endpoints

• US 20060185008A1
• Filed: 05/12/2005
• Published: 08/17/2006
• Est. Priority Date: 02/11/2005
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Le, Franck, Bajko, Gabor, Swami, Yogesh Prem
• Application Number:
  US11/129,273
• Publication Number:
  US 20060185008A1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Disclosed are examples of a method, system, devices and nodes to conduct communications between a device coupled to a communication network and a network security enforcement node, such as a firewall. An illustrative method includes, with a device coupled to a network security enforcement node through a communication network, requesting from the network security enforcement node information comprised of at least one of supported and enabled features and, in response to receiving the request, sending information descriptive of at least one of network security enforcement node supported and enabled features. The method may further include requesting by the device that at least one network security enforcement node feature be one of enabled or disabled.

Claims

1. A method comprising

with a device capable of being coupled to a network security enforcement node through a communication network, requesting from the network security enforcement node information comprised of at least one of supported and enabled features;

and

in response to receiving the request, sending information descriptive of at least one of network security enforcement node supported and enabled features.

2. A method as in claim 1, where sending comprises associating a flag with a feature to inform the device whether the device is allowed to enable/disable the feature.

3. A method as in claim 1, where sending comprises associating a flag with a feature to inform the device of a default state of the feature.

4. A method as in claim 1, further comprising requesting by the device that at least one network security enforcement node feature be one of enabled or disabled.

5. A method as in claim 4, further comprising informing the device if the request to enable or disable at least one firewall feature has been successful or has failed.

6. A method as in claim 1, where sending is performed by the network security enforcement node.

7. A method as in claim 1, where sending is performed by a manager of the network security enforcement node.

8. A method as in claim 1, further comprising an initial operation of initiating a network security enforcement node discovery procedure by the node, where requesting the information makes the request to a discovered network security enforcement node.

9. A method as in claim 1, further comprising selecting at least a communication protocol to be used by the device in response to receiving the information.

10. A method as in claim 1, further comprising:

requesting by the device that at least one network security enforcement node feature be disabled;

conducting a communication through the network security enforcement node; and

at the conclusion of the communication, requesting that the at least one network security enforcement node feature be re-enabled.

11. Apparatus comprising a wireless network interface and a data processor operable for communication with a network security enforcement node, said communication comprising sending a request to the network security enforcement node to determine at least one of supported and enabled features.

12. Apparatus as in claim 11, said communication further comprising sending a request to one of enable or disable at least one network security enforcement node feature.

13. Apparatus as in claim 11, said communication further comprising performing a network security enforcement node discovery procedure, said data processor initiating the communication with a discovered network security enforcement node.

14. Apparatus as in claim 11, said data processor operable to select at least one communication protocol in accordance with information received in response to the request.

15. Apparatus as in claim 11, said communication further comprising a request that at least one network security enforcement means feature be disabled, said data processor operable to thereafter conduct a communication through said network security enforcement node.

16. Apparatus as in claim 11, where at a conclusion of the communication, said communication further comprising a request that the at least one network security enforcement node feature be re-enabled.

17. A computer program embodied on a computer-readable medium, execution of said computer program directing a data processor of a wireless device for communication with a network security enforcement node, comprising an operation of sending a request to the network security enforcement node to determine at least one of supported and enabled features.

18. A computer program as in claim 17, execution of said computer program further comprising an operation of sending a request to one of enable or disable at least one network security enforcement node feature.

19. A computer program as in claim 17, execution of said computer program further comprising an operation of performing a network security enforcement node discovery procedure, and an operation of initiating the communication with a discovered network security enforcement node.

20. A computer program as in claim 17, execution of said computer program further comprising an operation of selecting a communication protocol in accordance with information received in response to the request.

21. A computer program as in claim 17, execution of said computer program further comprising an operation of requesting that at least one network security enforcement node feature be disabled, said data processor operable to thereafter conduct a communication through said network security enforcement node.

22. A computer program as in claim 21, execution of said computer program further comprising an operation of, at a conclusion of the communication, requesting that the at least one network security enforcement node feature be re-enabled.

23. Apparatus comprising a network interface and a data processor operable for communication with a device through the network interface, said data processor being responsive to a first request from the device for information regarding network security enforcement capabilities of said apparatus to send the device information descriptive of at least one of network security enforcement supported and enabled features.

24. Apparatus as in claim 23, said data processor being further responsive to a second request from the device to selectively enable or disable at least one network security enforcement feature.

25. A computer program embodied on a computer-readable medium, execution of said computer program directing a data processor of a network security enforcement node to communicate with a device coupled to the network security enforcement node through a network interface, comprising operations of:

receiving a first request from the device for information regarding capabilities of said network security enforcement node; and

sending the device information descriptive of at least one of network security enforcement node supported and enabled features.

26. A computer program as in claim 25, further comprising an operation, performed in response to receiving a second request from the device, to selectively enable or disable at least one network security enforcement node feature for device communications handled by said network security enforcement node.

27. Apparatus comprising means for interfacing to a wireless network and means for communication with a network security enforcement node, said communication means operable for sending a request to the network security enforcement node to determine at least one of supported and enabled features.

28. Apparatus as in claim 27, said communication means further operable for sending a request to one of enable or disable at least one network security enforcement node feature.

29. Apparatus as in claim 27, said communication means further operable for performing a network security enforcement node discovery procedure, and for initiating a communication with a discovered network security enforcement node.

30. Apparatus as in claim 27, further comprising means for selecting at least one communication protocol in accordance with information received in response to the request.

31. Apparatus comprising means for interfacing to a network and means for communication with a device via said network interface means and being responsive to a first request from the device for information regarding network security enforcement capabilities of said apparatus to send the device information descriptive of at least one of network security enforcement supported and enabled features.

32. Apparatus as in claim 31, said communication means further responsive to a second request from the device to selectively enable or disable at least one network security enforcement feature.

33. Apparatus comprising a wireless network interface and a data processor operable to send, via said wireless network interface, a network security enforcement node a request for information descriptive of at least one of supported and enabled features, said data processor being further operable in response to receiving the information from the network security enforcement node to select a communication protocol.

34. Apparatus as in claim 33, said data processor further operable to send the network security enforcement node a request to one of enable or disable at least one network security enforcement node feature.

35. Apparatus as in claim 33, said data processor further operable to initiate a network security enforcement node discovery procedure, and to send the request for information descriptive of at least one of supported and enabled features to a discovered network security enforcement node.