Firewall installer

• US 20080289026A1
• Filed: 05/18/2007
• Published: 11/20/2008
• Est. Priority Date: 05/18/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yariv, Eran, Diaz Cuellar, Gerardo, Abzarian, David, Paleologu, Emanuel, Carbaugh, Ian
• Granted Patent: US 8,266,685 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

Embodiments of the invention are directed to a firewall installer that receives a set of configuration instructions for configuring a firewall in a declarative format that describes one or more rules to be implemented by the firewall, and that automatically configures the firewall. Providing a firewall installer that is capable of configuring a firewall based upon declarative input rather than procedural process-oriented input facilitates administration of a firewall by allowing an administrator to specify desired firewall configuration at a higher, declarative level and frees the administrator from the need to specify procedures for implementing configuration changes in the firewall. In one embodiment of the invention, the firewall installer can receive and store input for configuring a firewall even when the firewall is not running, such that the firewall executes on those configuration changes when it next comes online.

Claims

1. A system comprising:

a firewall installer to configure a firewall, the firewall installer comprising at least one processor programmed to;

(A) receive, at the firewall installer, a set of configuration instructions comprising at least one configuration instruction, the set of configuration instructions being in a declarative form that specifies at least one firewall rule to be enforced by the firewall; and

(B) configure the firewall, via the firewall installer, to implement the at least one firewall rule.

2. The system of claim 1, wherein (B) comprises a plurality of procedural steps that are not directly specified via the set of configuration instructions.

3. The system of claim 1, wherein (B) comprises executing a plurality of procedural steps in an order that is not specified via the set of configuration instructions.

4. The system of claim 1, wherein the firewall installer is located remotely from a computing device hosting the firewall.

5. The system of claim 1, wherein the set of configuration instructions comprises an indicator of at least one parameter of the firewall rule.

6. The system of claim 1, wherein the set of configuration instructions is an XML schema having a firewallRule node.

7. The system of claim 1, wherein (B) comprises configuring the firewall, via the firewall installer, when the firewall is not in operation.

8. The system of claim 7, wherein configuring the firewall comprises directly editing a policy store of the firewall when the firewall is not in operation.

14. The method of claim 8, wherein the act (A) comprises providing the set of configuration instructions as part of an install process.

15. The method of claim 8, wherein the act (A) comprises providing the set of configuration instructions as part of an uninstall process.

9. A method of configuring a firewall, the method comprising an act of:

(A) providing to a firewall installer a set of configuration instructions comprising at least one configuration instruction, the set of configuration instructions being in a declarative form that specifies at least one firewall rule to be enforced by the firewall.

10. The method of claim 9, wherein the firewall installer executes a plurality of procedural steps to configure the at least one firewall rule based on the set of configuration instructions, and wherein the act (A) comprises providing a set of configuration instructions that does not directly specify the plurality of procedural steps.

11. The method of claim 9, wherein the firewall installer executes a plurality of procedural steps in an order to configure the at least one firewall rule based on the set of configuration instructions, and wherein the act (A) comprises providing a set of configuration instructions that does not directly specify the order in the set of configuration instructions.

12. The method of claim 9, wherein the set of configuration instructions comprises an indicator of at least one parameter of the firewall rule.

13. The method of claim 9, wherein the set of configuration instructions is an XML schema having a firewallRule node.

16. At least one computer-readable medium encoded with instructions which, when executed, perform a method, the method comprising acts of:

(A) receiving, at a firewall installer, a set of configuration instructions comprising at least one configuration instruction, the set of configuration instructions being in a declarative form that specifies at least one a firewall rule to be enforced by a firewall; and

(B) configuring the firewall, via the firewall installer, to implement the at least one firewall rule.

17. The at least one computer-readable medium of claim 16, wherein (B) comprises executing a plurality of procedural steps that are not directly specified via the configuration instructions.

18. The at least one computer-readable medium of claim 16, wherein (B) comprises executing a plurality of procedural steps in an order that is not specified via the configuration instructions.

19. The at least one computer-readable medium of claim 16, wherein the set of configuration instructions comprises an indicator of at least one parameter of the firewall rule.

20. The at least one computer-readable medium of claim 16, wherein (B) comprises configuring the firewall, via the firewall installer, when the firewall is not in operation.