Reverse Firewall with Self-Provisioning

• US 20070204338A1
• Filed: 12/27/2006
• Published: 08/30/2007
• Est. Priority Date: 02/17/2005
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property II LP (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Spatscheck, Oliver, Van der Merwe, Jacobus, Sen, Subhabrata, McDaniel, Patrick, Kalmanek, Charles, Aiello, William, Leighton, William
• Granted Patent: US 8,453,227 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04W 28/00 Network traffic management; Network resource management

Abstract

An application provisioning device may be used to manage a profile of a host and provide data corresponding to a selected application for installation at a host. A reverse firewall may use the profile of the host to determine whether to allow or block particular network communication from an application running on the host. An indication of a selected application may be received at the application provisioning device. Configuration information may also be received at the application provisioning device. The application provisioning server may request an update to the profile of a host and transmit such a request. The profile may be updated to reflect the configuration information and/or information of the selected application. Data corresponding to the selected application may be updated and transmitted to a host computer, where it may be installed. Therefore, the installed application running on the host may operate without being prematurely blocked by the reverse firewall.

Claims

1. An apparatus comprising a computer having an application program configured to receive an indication of a selected application of a computing device, transmit a request to update a profile of a host to reflect configuration information related to the selected application, modify the profile for use with a reverse firewall device, and use the reverse firewall device to determine whether to allow or block a particular communication from the host.

2. A method, comprising:

receiving an indication of a selected application of a computing device;

transmitting a request to update a profile of a host to reflect configuration information related to the selected application;

configuring the profile for use with a reverse firewall device; and

using the reverse firewall device to determine whether to allow or block a particular communication from the host.

3. The method of claim 2 including configuring the reverse firewall device to use a throttling discipline and out-of-profile counter to determine whether to allow or block the particular communication from the host.

4. The method of claim 2, further comprising presenting at least one selected application.

5. The method of claim 2 including transmitting a request to update the profile while the profile is empty of configuration information before transmitting a request to update the profile of the host.

6. The method of claim 2 including, the configuration information comprising information indicating an internal host that the selected application is configured to access.

7. The method of claim 2, further comprising:

updating data that corresponds to the selected application to reflect the configuration information, wherein the configuration information is predetermined configuration information; and

transmitting data that corresponds to the selected application.

8. The method of claim 2, further comprising:

receiving the configuration information;

updating data that corresponds to the selected application to reflect the configuration information; and

transmitting the data that corresponds to the selected application.

9. An apparatus, comprising:

a processor that executes instructions;

a memory configured to store data corresponding to a selected application including the instructions, the instructions being configured to, when executed, present at least one application choice for download to a host, receive an indication of a selected application for download to the host, the selected application being the selected application, transmit data that corresponds to the selected application, and transmit a request to update a profile of the host to reflect configuration information of the selected application, the updated profile indicating whether to allow or block a particular communication from the host;

an output device for presenting the at least one selected application and for transmitting data and a request to update; and

an input device for receiving an indication of the selected application.

10. The apparatus of claim 9, the profile being configured for use with a reverse firewall device for applying a throttling discipline and comprising an out-of-profile counter for determining whether to allow or block the particular communication from the host.

11. The apparatus of claim 9, the configuration information being predetermined configuration information.

12. The apparatus of claim 9, the instructions being configured to, when executed, receive the configuration information, and update the data that corresponds to the selected application to reflect the received configuration information.

13. A method, comprising:

generating a profile of a host;

saving the profile in a memory in communication with a processor that is located in a policy manager; and

communicating via the policy manager the profile to a reverse firewall configured to use the profile of the host to determine whether to allow or block the particular communication from the host.

14. The method of claim 13, including generating the profile of the host based at least on a software application installed on the host.

15. The method of claim 13, comprising updating the profile in response to receiving a request to update the profile to reflect configuration information of a selected application.

16. The method of claim 13, comprising updating the profile of the host based on an analysis of network communication between a plurality of hosts in the network during a period of time.

17. The method of claim 13, including:

accessing the profile of the host if parameters of a network communication from the host are in the profile of the host;

allowing the network communication to pass through a reverse firewall device if parameters of a network communication from the host are not in the profile of the host; and

enforcing a throttling discipline on the network communication to determine whether to allow or to block the network communication from the host.

18. The method of claim 13, wherein generating the profile includes at least one of:

generating a 3-tuple rule defined by protocol, client, server port, and server profile,

generating a 3-tuple rule defined by protocol, client, and server profile,

generating a 2-tuple rule defined by protocol and server profile, and

generating a 3-tuple rule defined by protocol, server port, and server profile.

19. A computer-readable medium containing instructions which, when executed, cause a computing device to receive an indication of a selected application for downloading to a host, transmit data that corresponds to the selected application to the host;

and transmit a request to update a profile of a host to reflect configuration information of the selected application, the profile indicating if a particular communication from the host is to be blocked.

20. The computer-readable medium of claim 19, wherein the configuration information is predetermined configuration information.

21. The computer-readable medium of claim 19, wherein the instructions cause the computing device to receive the configuration information and update data that corresponds to the selected application to reflect the received configuration information.

22. The computer-readable medium of claim 19, wherein the profile comprises a 3-tuple rule defined by protocol, client, server port, and server profile.

23. The computer-readable medium of claim 19, wherein the profile comprises a 3-tuple rule defined by protocol, client, and server profile.

24. The computer-readable medium of claim 19, wherein the profile comprises a 2-tuple rule defined by protocol and server profile.

25. The computer-readable medium of claim 19, wherein the profile comprises a 3-tuple rule defined by protocol, server port, and server profile.