Firewall protection for wireless users

• US 20060272013A1
• Filed: 08/03/2006
• Published: 11/30/2006
• Est. Priority Date: 05/02/2001
• Status: Active Grant

• Current Assignee: Brian Kilgore
• Original Assignee: Brian Kilgore
• Inventors: Kilgore, Brian
• Granted Patent: US 7,676,837 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

In a computer telecommunications network, firewalls protect a machine or network from undesired message transmissions. In the case of a firewall employed on a user side of the wireless link, a message rejected by the firewall has already consumed the wireless resources required to transmit. A system for protecting a mobile wireless user via a firewall employed at the wired line, or ISP side, of the wireless link in a wireless network allows a specific user profile to be provided for each user that is indicative of a desired firewall configuration corresponding to the mobile user. A firewall configuration is established at a firewall application in a wireless transceiver corresponding to the current location of the mobile user, and the same firewall configuration is established, via a wireless handoff, at a second wireless transceiver when the user is located in the area corresponding to the second wireless transceiver, thereby protecting a plurality of wireless users prior to wasteful wireless transmission of undesired messages.

Claims

1. A method of providing protection for wireless access units in a wireless communications network via a firewall application, the method comprising:

obtaining profile information associated with a first wireless access unit;

establishing a first firewall configuration for the first wireless access unit at the firewall application from the obtained profile information associated with the first wireless access unit;

obtaining profile information associated with a second wireless access unit; and

establishing a second firewall configuration for the second wireless access unit at the firewall application from the obtained profile information associated with the second wireless access unit.

2. A method as defined in claim 1 wherein the profile information associated with the first and second wireless access units is obtained from a central repository.

3. A method as defined in claim 2 wherein the central repository is a wireless Internet facility.

4. A method as defined in claim 1 wherein each wireless access unit is associated with a unique identifier.

5. A method as defined in claim 4 wherein the unique identifier is an electronic serial number (ESN) associated with the wireless access unit.

6. A method as defined in claim 4 wherein the unique identifier is a subscriber identifier (ID) associated with wireless access unit.

7. A method as defined in claim 4 further comprising:

using a unique identifier associated with the first wireless access unit to obtain the profile information associated with the first wireless access unit.

8. A method as defined in claim 1 further comprising:

receiving a message destined for the first wireless access unit;

determining if the message is undesired based on the obtained profile information associated with the first wireless unit; and

if the message is undesired, discarding the message.

9. A method as defined in claim 8 wherein the step of determining if the message is undesired further comprises:

examining stateless firewall parameters contained in the obtained profile information associated with the first wireless unit to determine if the message is undesired.

10. A method as defined in claim 8 wherein the step of determining if the message is undesired further comprises:

determining if a stateful check is indicated in the profile information obtained for the first wireless unit;

if a stateful check is indicated, updating intrusion detection state associated with the first wireless unit; and

examining the updated intrusion detection state to determine if the message is undesired.

11. A base station for providing protection for wireless subscriber access units in a wireless communications network via a firewall application, the base station comprising:

a firewall application configured to;

(a) provide protection for wireless access units in the wireless communications network; and

processing circuitry configured to;

(a) obtain profile information associated with a first wireless access unit,

(b) establish a first firewall configuration for the first wireless access unit at the firewall application from the obtained profile information associated with the first wireless access unit,

(c) obtain profile information associated with a second wireless access unit, and

(d) establish a second firewall configuration for the second wireless access unit at the firewall application from the obtained profile information associated with the second wireless access unit.

12. A base station as defined in claim 11 wherein the profile information associated with the first and second wireless access units is obtained from a central repository.

13. A base station as defined in claim 12 wherein the central repository is a wireless Internet facility.

14. A base station as defined in claim 11 wherein the each wireless access unit is associated with a unique identifier.

15. A base station as defined in claim 14 wherein the processing circuitry is further configured to:

(a) use a unique identifier associated with the first wireless access unit to obtain the profile information associated with the first wireless access unit.

16. A base station as defined in claim 11 wherein the processing circuitry is further configured to:

(a) receive a message destined for the first wireless access unit,

(b) determining if the message is undesired based on the obtained profile information associated with the first wireless unit, and

(c) discard the message if the message is undesired.

17. An apparatus for providing protection for wireless subscriber access units in a wireless communications network via a firewall application, the apparatus comprising:

means for obtaining profile information associated with a first wireless access unit;

means for establishing a first firewall configuration for the first wireless access unit at the firewall application from the obtained profile information associated with the first wireless access unit;

means for obtaining profile information associated with a second wireless access unit; and

means for establishing a second firewall configuration for the second wireless access unit at the firewall application from the obtained profile information associated with the second wireless access unit.

18. An apparatus as defined in claim 17 further comprising:

means for using a unique identifier associated with the first wireless access unit to obtain the profile information associated with the first wireless access unit.

19. An apparatus as defined in claim 17 further comprising:

means for receiving a message destined for the first wireless access unit;

means for determining if the message is undesired based on the obtained profile information associated with the first wireless unit; and

means for discarding the message if the message is undesired.

20. An apparatus as defined in claim 19 further comprising:

means for examining stateless firewall parameters contained in the obtained profile information associated with the first wireless unit to determine if the message is undesired.

21. An apparatus as defined in claim 19 further comprising:

means for determining if a stateful check is indicated in the profile information obtained for the first wireless unit;

means for updating intrusion detection state associated with the first wireless unit if a stateful check is indicated; and

means for examining the updated intrusion detection state to determine if the message is undesired.