State-full perimeter security for data networks

• US 20070157301A1
• Filed: 12/30/2005
• Published: 07/05/2007
• Est. Priority Date: 12/30/2005
• Status: Active Grant

• Current Assignee: United States Cellular Corporation (Telephone & Data Systems, Inc.)
• Original Assignee: United States Cellular Corporation (Telephone & Data Systems, Inc.)
• Inventors: Saxena, Narothum, Irizarry, Michael, Taglienti, Claudio
• Granted Patent: US 7,886,349 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0254 Stateful filtering

Abstract

The described embodiments include a system for controlling communications between a first network and a second network including a plurality of in-line security devices, the in-line security devices being configured to manage communication between the first network and the second network, and including a state server connected to the plurality of in-line security devices, the state server being configured to receive state information about the state of the connections established by a first one of the in-line security devices and to communicate the state information to at least a second one of said in-line security devices. In one embodiment, the in-line security devices are firewalls. In another embodiment, state server communicates the state information received from the first one of the firewall devices and communicates the state information to every other one of the plurality of firewall devices. The described embodiments also include a method for controlling communications between a first network and a second network including providing a plurality of in-line security devices, establishing communication between the first network and the second network via the in-line security devices, providing a state server connected to the plurality of in-line security devices, transmitting state information from a first one of the the in-line security devices about the state of the connections established by the a first one of the in-line security devices, and communicating the state information from the state server to at least a second one of said in-line security devices.

Claims

1. A system for controlling communications between a first network and a second network comprising:

a plurality of in-line security devices, the in-line security devices being configured to manage communication between the first network and the second network; and

a state server connected to the plurality of in-line security devices, the state server being configured to receive state information about the state of the connections established by a first one of the in-line security devices and to communicate the state information to at least a second one of said in-line security devices.

2. A system as in claim 1 wherein the in-line security devices are firewalls.

3. A system as in claim 1 wherein the state server communicates the state information received from the first one of the firewall devices and communicates the state information to every other one of the plurality of firewall devices.

4. A system as in claim 1 further including a secondary state server, said secondary state server configured to receive the state information from the state server and provide the state information to the plurality of in-line security devices.

5. A system as in claim 1 wherein the state server is an SIP security server.

6. A method for controlling communications between a first network and a second network comprising:

providing a plurality of in-line security devices;

establishing communication between the first network and the second network via the in-line security devices;

providing a state server connected to the plurality of in-line security devices;

transmitting state information from a first one of the in-line security devices about the state of the connections established by the a first one of the in-line security devices; and

communicating the state information from the state server to at least a second one of said in-line security devices.

7. A method as in claim 6 wherein the in-line security devices are firewalls.

8. A method as in claim 6 wherein the state server communicates the state information received from the first one of the firewall devices and communicates the state information to every other one of the plurality of firewall devices.

9. A method as in claim 6 further including communicating said state information from the state server to a secondary state server, said secondary state server configured to receive the state information from and providing the state information to the plurality of in-line security devices from the secondary state server.

10. A method as in claim 6 wherein the state server is an SIP security server.

11. A method as in claim 6 wherein the communication of the state information from the state server to at least a second one of said in-line security devices occurs in response to a communication link being diverted from the first one of the in-line security devices to the at least second one of the in-line security devices.

12. A method as in claim 6 further comprising, when a communication link established by first in-line security device is closed, notifying the state server and deleting the information on the state of the communication link from the state server.