SECURE FIREWALL CONFIGURATIONS

• US 20190081983A1
• Filed: 10/27/2017
• Published: 03/14/2019
• Est. Priority Date: 09/12/2017
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Teal, Richard S.
• Granted Patent: US 10,885,213 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 12/0813 with a network or matrix configuration
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/60 Details of cache memory
• CPC Class Codes: G06F 2212/62 Details of cache specific to multiprocessor cache arrangements
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 : Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 : Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 : Rule management
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 : Vulnerability analysis
• CPC Class Codes: H04L 63/1441 : Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 : the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 9/0891 : Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

The configuration of a firewall on an endpoint is secured to prevent changes by unauthorized processes, while permitting changes that are requested by authorized processes. Authorized processes can be stored in a tamper protection cache within a kernel of the operating system of the endpoint and secured with reference to a trust authority external to the operating system. When a process on the endpoint requests a change to the firewall configuration, the requesting process can be checked against the processes listed in the tamper protection cache, and any suitable rules can be applied to limit or prevent changes to firewall configuration.

Claims

1. A computer program product for managing a firewall on an endpoint, the computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:

storing a process cache in a kernel space of an operating system on the endpoint, the endpoint having a memory that includes the kernel space and a user space and the process cache storing at least one property for a configuration of a firewall provided by a software firewall process executing in the user space on the endpoint;

storing a tamper protection cache in the kernel space, the tamper protection cache identifying one or more protected computing objects on the endpoint, wherein the tamper protection cache secures the one or more computing objects with reference to a trust authority external to the operating system, and wherein the one or more protected computing objects includes the software firewall process;

receiving a request for a change to the configuration of the firewall from a second process with a kernel driver; and

conditionally authorizing the change from the kernel driver only when the one or more protected computing objects also includes the second process that requests the change to the configuration of the firewall.

2. A method for managing a firewall on an endpoint, the method comprising:

storing a process cache in a kernel space of an operating system on the endpoint, the endpoint having a memory that includes the kernel space and a user space and the process cache storing at least one property for a software firewall process executing in the user space on the endpoint;

storing a tamper protection cache in the kernel space, the tamper protection cache identifying one or more protected computing objects on the endpoint, wherein the tamper protection cache secures the one or more computing objects with reference to a trust authority external to the operating system, and wherein the one or more protected computing objects includes the software firewall process;

receiving a request for a change to a configuration of the software firewall process from a second process with a kernel driver; and

conditionally authorizing the change from the kernel driver only when the one or more protected computing objects also includes the second process.

3. The method of claim 2 wherein the request for the change to the configuration of the software firewall process originates from a source external to the endpoint.

4. The method of claim 2 wherein the configuration of the software firewall process is stored in one or more registry keys for the endpoint.

5. The method of claim 4 wherein the one or more registry keys are contained in the one or more protected computing objects stored in the tamper protection cache.

6. The method of claim 2 wherein the trust authority is external to the endpoint.

7. The method of claim 2 wherein the trust authority includes a remote trust authority maintained by a threat management facility for an enterprise network that includes the endpoint.

8. The method of claim 2 wherein the trust authority includes a remote third-party trust authority.

9. The method of claim 2 wherein the configuration specifies one or more firewall rules.

10. The method of claim 2 wherein the configuration identifies permitted or prohibited network addresses.

11. The method of claim 2 wherein the configuration identifies permitted or prohibited applications executing on the endpoint.

12. The method of claim 2 wherein the second process is a remote process executing on a threat management facility for an enterprise network that includes the endpoint.

13. The method of claim 2 wherein the change to the configuration includes a request to allow traffic from an application executing on the endpoint.

14. The method of claim 2 wherein the second process evaluates an application requesting network access through the software firewall process and responsively requests the change to permit the application to communicate through the firewall.

15. The method of claim 2 wherein the second process implements a policy change for an enterprise network to permit network use by an application by configuring the software firewall process and a remote firewall on a gateway for the enterprise network to allow traffic by the application.

16. A system comprising:

an endpoint having a memory and an operating system that organizes the memory into a user space for executing processes and a kernel space for the operating system;

a software firewall process executing in the user space;

a process cache stored in the kernel space, the process cache storing at least one property for the software firewall process executing in the user space;

a tamper protection cache stored in the kernel space, the tamper protection cache secured with reference to a trust authority external to the operating system and identifying one or more protected computing objects on the endpoint, wherein the one or more protected computing objects includes the software firewall process; and

a kernel driver executing in the kernel space and configured to detect a request for a change to the at least one property of the software firewall process from a second process and to conditionally authorize the change only when the one or more protected computing objects also includes the second process.

17. The system of claim 16 wherein the at least one property of the software firewall process is stored in one or more registry keys for the endpoint.

18. The system of claim 17 wherein the one or more registry keys are contained in the one or more protected computing objects stored in the tamper protection cache.

19. The system of claim 16 wherein the trust authority includes a remote trust authority maintained by a threat management facility for an enterprise network that includes the endpoint.

20. The system of claim 16 wherein the trust authority includes a remote third-party trust authority.