INTELLIGENT FIREWALL

• US 20090288158A1
• Filed: 07/23/2009
• Published: 11/19/2009
• Est. Priority Date: 01/24/2002
• Status: Active Grant

• Current Assignee: Arxceo Corp. (Japan Communications Inc.)
• Original Assignee: Arxceo Corp. (Japan Communications Inc.)
• Inventors: Izatt, David, Davidson, Donald J., Smith Cashion, Jackie, Langston, Russ, Wilson, Billy Ray, Hall, J. Chandler
• Granted Patent: US 8,082,578 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

An intelligent firewall that prevents unauthorized access to a system has been developed. The fire wall does not use a communication address. It receives a data packet and analyzes it to determine its final disposition. Finally, the firewall handles the data packet according to its final disposition.

Claims

1. A method of preventing unauthorized access to a system, comprising:

receiving a data packet at a firewall, the data packet comprising an ethernet frame field and a source address, wherein the firewall does not use a communication address;

analyzing the data packet with the firewall to determine the final disposition of the data packet; and

handling the data packet according to its final disposition, wherein handling the data packet comprises determining whether to drop the data packet or send the data packet to a final destination, and handling the data packet further comprises dropping the data packet or sending the data packet to the final destination using the ethernet frame field, the data packet sent without changing the ethernet frame field or the source address.

2. The method of claim 1, wherein the communication address is a TCP/IP address.

3. The method of claim 1, wherein the communication address is a MAC address.

4. The method of claim 1, wherein the communication address is a ethernet address.

5. The method of claim 1, wherein handling the data packet comprises sending the data packet to a final destination within the system.

6. The method of claim 1, wherein handling the data packet comprises sending the data packet to a final destination outside the system.

7. The method of claim 1, wherein handling the data packet comprises dropping the data packet.

8. The method of claim 1, wherein handling the data packet comprises denying access to the system.

9. The method of claim 8, wherein the denying access of a data packet comprises responding to the originator of the data packet with a denial message.

10. The method of claim 8, further comprising:

dropping the data packet.

11. The method of claim 8, further comprising:

logging the attempted access to the system of the data packet.

12. The method of claim 11, wherein the logging is stored on a computer in the system.

13. The method of claim 8, further comprising:

initiating countermeasures against the originator of the data packet.

14. The method of claim 13, wherein the countermeasures comprise disguising the operating system used by the system.

15. The method of claim 13, wherein the countermeasures comprise adjusting window sizes of the system.

16. The method of claim 1, wherein the firewall does not access a network protocol stack.

17. The method of claim 1, wherein the firewall accesses a network protocol stack.

18-47. -47. (canceled)