Firewall security apparatus for high-speed circuit switched networks

• US 6,141,755 A
• Filed: 04/13/1998
• Issued: 10/31/2000
• Est. Priority Date: 04/13/1998
• Status: Expired due to Term

• Current Assignee: The United States of America As Represented By The Director National Security Agency
• Original Assignee: The United States of America As Represented By The Director National Security Agency
• Inventors: Mchenry, John Thomas, Dowd, Patrick William
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Iqbal, Nadeem
• Application Number:
  US09/059,041
• Time in Patent Office: 932 Days
• Field of Search: 713/200, 713/201, 713/202, 707/7, 707/9, 707/10, 380/4, 380/25, 380/23, 364/286.4, 364/286.5, 364/286.6, 340/825.34, 340/825.31, 395/200.31, 395/200.55, 395/200.68
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A network firewall security apparatus that enables a very high degree of traffic selectability yet avoids the usual performance penalty associated with firewalls. This approach is specific to high-speed circuit switched networks, Asynchronous Transfer Mode (ATM) networks in particular. Security management is achieved through active connection management with authentication, better suited to the cell-based environment of high-speed circuit switched networks and to the mix of circuit switched traffic, where Internet Protocol (IP) datagrams comprise a fraction of the total traffic. The information in the signaling cells is used to determine which flows, rather than which individual cells, are allowed to pass through the firewall. A hierarchical method has been devised, in which the physical location of the interrelated components may be decoupled. Active connection management is applied in determining the approval of a connection based on signaling information and network state information. Once a flow has been validated, the cells associated with that flow are allowed to proceed through the firewall at line-speed with limited intervention and no performance degradation.

Claims

1. A firewall security apparatus for high-speed circuit switched networks deployed between an external circuit switched network and an internal circuit switched network for preventing unauthorized communications between the external and internal circuit switched networks, while permitting authorized communications, comprising:

an external network transceiver having means for receiving incoming protocol data units (PDUs) from the external circuit switched network and transforming the physical line characteristics of the PDUs on the external circuit switched network media to a digital bit stream protocol data units and having means for receiving digital bit stream PDUs, transforming the received digital bit stream PDUs to the physical line characteristics of the external circuit switched network media, and transmitting the PDUs on the external circuit switched network;

an internal network transceiver having means for receiving incoming PDUs from the internal circuit switched network and transforming the physical line characteristics of the PDUs on the internal circuit switched network media to a digital bit stream PDUs and having means for receiving digital bit stream PDUs, transforming the received digital bit stream PDUs to the physical line characteristics of the internal circuit switched network media, and transmitting the PDUs on the internal circuit switched network;

a flow switch for switching the communications between the external and internal circuit switched networks on command, connected in series between said external network transceiver and said internal network transceiver, and having means for receiving commands, having means for receiving digital bit stream PDUs from said external network transceiver, causing the digital bit stream PDUs received from said external network transceiver to be transmitted to said internal network transceiver, and causing said internal network transceiver to transform the digital bit stream PDUs received from said external network transceiver to the physical line characteristics of the internal circuit switched network media and to transmit them on the internal circuit switch network on command and having means for receiving digital bit stream PDUs from said internal network transceiver, causing the digital bit stream PDUs received from said internal network transceiver to be transmitted to said external network transceiver, and causing said external network transceiver to transform the digital bit stream PDUs received from said internal network transceiver to the physical line characteristics of the external circuit switched network media and to transmit them on the external circuit switch network on command;

a firewall database for storing a list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints and a list of link level identifiers identified as containing signalling messages and control information; and

a firewall controller for controlling communications between the external and internal circuit switched networks,

having a set of active connection management rules for determining under what circumstances communications between the external and internal circuit switched networks are authorized;

having means for receiving the digital bit stream PDUs from said external network transceiver and said internal network transceiver;

having means for determining if the digital bit stream PDU received is control information, commanding said flow switch to transmit the digital bit stream PDU to the external circuit switched network for digital bit stream PDUs received from the internal circuit switched network and to the internal circuit switched network for digital bit stream PDUs received from the external circuit switched network, processing the control information to obtain routing and configuration information, and writing the routing and the configuration information to said firewall database, when the digital bit stream PDU is control information;

having means for determining if the digital bit stream PDU received is part of a signaling message, reassembling the signaling message, determining if the signaling message is a connection request signaling message, determining if the signaling message is a connection deletion signaling message, commanding said flow switch to transmit the digital bit stream PDU to the external circuit switched network for digital bit stream PDUs received from the internal circuit switched network and to the internal circuit switched network for digital bit stream PDUs received from the external circuit switched network when the digital bit stream PDU is a signaling message, removing the entry from the list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints in said firewall database associated with the connection deletion signaling messages when the digital bit stream is a connection deletion signaling message, and adding a link level identifier entry to the list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints in said firewall database associated with the connection request signaling messages when the link level identifier is authorized under said set of active connection management rules, when the digital bit stream PDU is a connection request signaling message; and

having means for determining if the digital bit stream PDU received is data, determining if the digital bit stream PDU is listed as approved in said firewall database, and commanding said flow switch to transmit the digital bit stream PDU to the external circuit switched network for digital bit stream PDUs received from the internal circuit switched network and to the internal circuit switched network for digital bit stream PDUs received from the external circuit switched network when the digital bit stream PDU is listed as approved in said firewall database.

2. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said set of active connection management rules further comprise a participant verification means whereby the determination as to whether a communication between the external and internal circuit switched networks is authorized is accomplished by examination of the endpoint identifiers within the connection request signaling message.

3. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said set of active connection management rules further comprise a route validation means whereby the determination as to whether a communication between the external and internal circuit switched networks is authorized is accomplished by examination of the path used to set up the connection, and the consistency of the path with respect to the endpoints identifiers within the connection request signaling message.

4. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said set of active connection management rules further comprise an endpoint authentication means whereby the determination as to whether a communication between the external and internal circuit switched networks is authorized is accomplished by verification of the authenticity of the participants identified for the connection.

5. A firewall security apparatus for high-speed circuit switched networks according to claim 4, wherein said set of active connection management rules further comprise an endpoint authentication means between the external endpoint and said firewall security apparatus for high-speed circuit switched networks whereby the determination as to whether a communication between the external endpoint and said firewall security apparatus for high-speed circuit switched networks is authorized is accomplished by verification of the authenticity of the participant identified for the external connection.

6. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said set of active connection management rules further comprise a resource allocation request authentication means whereby the determination as to whether a communication between the external and internal circuit switched networks is authorized is accomplished by detecting abnormalities in internal circuit switch network resource requests, multiple connection requests from the same endpoint, and excessive quality of service requests that would lead to monopolization of internal circuit switched network resources.

7. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said set of active connection management rules further comprise a plurality of separate authentication processes for classes of users and individual user participants on the external and internal circuit switched networks whereby the determination as to whether a communication between the external and internal circuit switched networks is authorized is accomplished.

8. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said means for determining if the digital bit stream PDU received is control information further comprises a means for causing said firewall database to log the control information digital bit stream PDUs received.

9. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein:

said set of active connection management rules further comprise a means for determining if the digital bit stream PDU is listed as conditionally approved in said firewall database,

said firewall database further comprises a list of all conditionally approved link level identifiers and endpoints, and

said means for determining if the digital bit stream PDU received is part of a signaling message further comprises means for removing the entry from the list of all conditionally approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints in said firewall database associated with the connection deletion signaling messages when the digital bit stream is a connection deletion signaling message, and adding an link level identifier entry to the list of all conditionally approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints in said firewall database associated with the connection request signaling messages when the link level identifier is authorized under said set of active connection management rules, when the digital bit stream PDU is a connection request signaling message.

10. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said firewall controller for controlling communications between external and internal circuit switched networks further comprises a means for examining control information for hidden functionality when the digital bit stream PDU received is control information.

11. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said means for determining if the digital bit stream PDU received is data message further comprises a means for sending a signaling message to the digital bit stream PDU source and destination endpoints instructing the source and destination endpoints to release the connection when the digital bit stream PDU is not listed as approved in said firewall database.

12. A firewall security apparatus for high-speed circuit switched networks according to claim 1, wherein said list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints is mapped to a smaller memory space through a hash function.

13. A firewall security apparatus for high-speed circuit switched networks according to claim 12, further comprised of means for resolving hash collisions in said list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints.

14. A firewall security apparatus for high-speed circuit switched networks according to claim 1, further comprising:

a separate firewall control processor for supporting the non-line-speed functions of the firewall security apparatus for high-speed circuit switched networks, comprising;

said set of active connection management rules,

said means for processing the control information to obtain routing and configuration information,

said means for writing the routing and the configuration information to said firewall database, and said means for reassembling the signaling message,

said means for determining if the signaling message is a connection request signaling message,

said means for determining if the signaling message is a connection deletion signaling message, and

said means for removing and adding a link level identifier entry to the list of all approved external circuit switched network and internal circuit switched network approved link level identifiers and endpoints;

and further comprising;

a full network database, for supporting the non-line-speed functions of the firewall security apparatus for high-speed circuit switched networks,

a firewall control processor controller, for controlling non-line-speed functions of said firewall security apparatus for high-speed circuit switched networks, and

a means for communicating between said full network database and said firewall control processor controller; and

a separate firewall inline processor comprising all the remaining components of said firewall security apparatus for high-speed circuit switched networks for accomplishing those functions of said firewall security apparatus for high-speed circuit switched networks that need to operate at line-speed, and further comprising a means for communicating with said firewall control processor.

15. A firewall security apparatus for high-speed circuit switched networks according to claim 14, wherein said firewall control processor is located on the internal circuit switched network and said means for communicating with said firewall control processor further comprise tunneling via said internal network transceiver.

16. A firewall security apparatus for high-speed circuit switched networks according to claim 14, wherein said firewall control processor is located on the external circuit switched network and said means for communicating with said firewall control processor further comprise tunneling via said external network transceiver.