Firewall propagation

• US 20080235755A1
• Filed: 03/22/2007
• Published: 09/25/2008
• Est. Priority Date: 03/22/2007
• Status: Active Grant

• Current Assignee: DigiCert Incorporated
• Original Assignee: Mocana Corporation (DigiCert Incorporated)
• Inventors: Vuong, Thien, Blaisdell, James
• Granted Patent: US 7,853,998 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Methods and systems for propagating data security policies and rules up a chain of network components, for example, from an end-user device having a firewall, to a network component at the “edge” of the network, such as a so-called “edge” firewall server, from where a policy statement can be transmitted to a service provider, such as an ISP, are described. A device, such as a computer or mobile phone, has, as part of its firewall software, a policy propagation file, that communicates with pre-existing firewall software. The firewall software creates a policy statement upon detecting a triggering event, which is transmitted from the device to the next data security component up the chain, “upstream,” in the network. In some cases this device may be a firewall server or a firewall policy server. The firewall server may combine policy statements from numerous end-user type devices and transmit the policy statement to an external network component, such as an ISP firewall server or similar device. The ISP or other service provider may then use the policy statement to implement date security rules for the devices in the network. In this manner, the firewall operated by the ISP implements rules and policies of a network owner or the owner of a stand-alone device, thereby preventing unwanted traffic from entering the network.

Claims

1. A data communication network comprising:

a plurality of network devices;

a data filtering server having a trigger module containing one or more trigger names, one or more trigger definitions, one or more propagation policies, and a trigger definition translation module, and a trigger directory;

a first data filtering module having a first policy propagation file;

a second data filtering module having a second policy propagation file; and

a data filtering policy server for combining policy statements.

2. A network as recited in claim 1 wherein a propagation policy is an action to be taken.

3. A network as recited in claim 1 further comprising an ISP server.

4. A network as recited in claim 1 wherein the trigger definition translation module further comprises conditional language and an end-user template.

5. A network as recited in claim 1 further comprising a policy statement containing one or more trigger names and one or more propagation policies.

6. A network as recited in claim 1 wherein the second propagation file contains instructions and modification rules.

7. A method of filtering data entering a network, the method comprising:

creating a first policy statement containing one or more trigger names, one or more propagation policies, and one or more trigger short definitions;

within the network, propagating the first policy statement to a network data security server;

determining if there is a match in a first trigger name contained in the first policy statement with a second trigger name contained in a second policy statement;

if there is a match, creating a combined policy statement, wherein the second policy statement contains data that overrides data in the first policy statement; and

determining which recipients should receive the combined policy statement.

8. A method as recited in claim 7 further comprising:

detecting an event; and

determining whether the event is a trigger.

9. A method as recited in claim 8 wherein determining whether the event is a trigger further includes checking to see if the event is listed in a policy propagation file.

10. A method as recited in claim 8 wherein determining whether the event is a trigger further comprises determining whether the event is a network-based trigger or an external trigger.

11. A method as recited in claim 7 wherein the network data security server is a firewall server.

12. A method as recited in claim 7 wherein creating a first policy statement includes storing trigger data in a policy statement when a trigger is activated.

13. A method as recited in claim 7 further comprising trigger long definitions and trigger long names.

14. A method as recited in claim 7 wherein the step of creating a first policy statement is performed by pre-existing firewall software.

15. A method as recited in claim 7 further comprising sending an API to the pre-existing firewall software if there is a trigger.

16. A method as recited in claim 7 wherein creating the first policy statement further comprises storing trigger data in the first policy statement when a trigger is activated.

17. A method as recited in claim 7 further comprising translating the trigger definitions.