Firewall with policy hints

• US 20080282314A1
• Filed: 05/09/2007
• Published: 11/13/2008
• Est. Priority Date: 05/09/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Diaz Cuellar, Gerardo, Abzarian, David, Dabbiru, Satheesh S.
• Granted Patent: US 8,584,227 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A firewall helps a user make a decision regarding network access for an application executing on a computing device by providing “hints” to the user about an appropriate network access policy. If at least one previously set firewall policy for the application exists in a context different from a current context, the user may be presented with information based on a previously set firewall policy. The information may be prioritized based on a source of the previously set firewall policy and other factors, to provide the user with a hint that facilitates making the decision appropriate in the current context. A programming interface to the firewall allows third party applications to specify a format in which hints are provided to the user.

Claims

1. A method of operating a computing device executing an application, the method comprising:

determining whether at least one previously set firewall policy for the application exists in a context different from a current context; and

presenting to a user information based on the determination.

2. The method of claim 1, wherein the method is initiated upon access to a network.

3. The method of claim 1, wherein the at least one previously set firewall policy comprises at least one enabled policy and/or at least one disabled policy.

4. The method of claim 1, further comprising requesting a decision from the user in conjunction with presenting to the user the information based on the determination, the decision relating to a firewall policy for the application in the current context.

5. The method of claim 4, wherein the least one previously set firewall policy comprises a firewall policy previously set by a domain administrator and a firewall policy previously set by the user, and wherein presenting the information based on the determination comprises displaying an indication of the firewall policy previously set by the domain administrator.

6. The method of claim 1, wherein the context comprises a network characteristic.

7. The method of claim 4, wherein:

if the at least one previously set firewall policy is a group policy, presenting to the user the information based on the determination comprises providing information to the user reflecting a prior decision made by a domain administrator; and

if the at least one previously set firewall policy is not a group policy;

if at least one restriction exists that was specified in a context different from the current context, presenting to the user the information based on the determination comprises providing information to the user including the at least one restriction; and

if the at least one restriction does not exist, presenting to the user the information based on the determination comprises providing information to the user based on a prior decision made by the user.

8. The method of claim 1, wherein the at least one previously set firewall policy is a group policy and/or a local policy.

9. The method of claim 8, wherein the at least one previously set firewall policy comprises a policy for a public network profile.

10. The method of claim 8, wherein the at least one previously set firewall policy comprises a policy for a private network profile.

11. The method of claim 1 further comprising receiving through a command line a command specifying a type of a dialog and at least one argument, wherein presenting comprises displaying the dialog based on the command and the least one argument.

12. A computer system having a graphical user interface for requesting a decision from a user regarding an application in conjunction with providing information to the user based on at least one previously set firewall policy for the application in a context different from a current context.

13. The computer system of claim 12, wherein the information is provided to the user in a video and/or audio format.

14. The computer system of claim 12, wherein the context comprises a network characteristic.

15. The computer system of claim 12, wherein the graphical user interface comprises a dialog box provided upon access to a network.

16. A computer-readable medium having computer-executable components comprising:

a plurality of policy stores;

a firewall component; and

a component for identifying information that is provided to a user based on determining whether at least one previously set firewall policy for the application exists in a context different from a current context.

17. The computer-readable medium of claim 16, wherein the plurality of policy stores comprises at least one of a local policy store, a dynamic policy store, and/or a group policy store.

18. The computer-readable medium of claim 17, further comprising a network location awareness component, wherein the current context is derived from information provided by the network location awareness component.

19. The computer-readable medium of claim 16, wherein the at least one previously set firewall policy comprises a firewall policy previously set by a domain administrator and a firewall policy previously set by the user, and wherein the firewall policy previously set by the domain administrator takes priority over the firewall policy previously set by the user.

20. The computer-readable medium of claim 16, further comprising an application programming interface providing communication between the computer-executable components and a third party application whereby the information is provided to the user in conjunction with requesting a decision from the user via an interface specified in the third party application.