Methods and apparatus for a computer network firewall with cache query processing
First Claim
1. A method for packet validation in a computer network firewall, comprising the steps of:
- obtaining a session key for a packet of a given network session;
processing a query portion of a rule, when a match with said session key is not found in a cache containing information about packets associated with one or more other network sessions which were previously processed by said firewall thereby indicating that the packet from which the session key is obtained is not from the one or more other network sessions, the query portion specifying a query to said cache to determine whether at least a portion of information associated with the packet of the given network session substantially matches at least a portion of information associated with at least one packet associated with the one or more other network sessions contained in said cache; and
processing an action portion of said rule as a function of a result of said query to said cache.
5 Assignments
0 Petitions
Accused Products
Abstract
The invention provides improved computer network firewalls which include one or more features for increased processing efficiency. A firewall in accordance with the invention can support multiple security policies, multiple users or both, by applying any one of several distinct sets of access rules. The firewall can also be configured to utilize “stateful” packet filtering which involves caching rule processing results for one or more packets, and then utilizing the cached results to bypass rule processing for subsequent similar packets. To facilitate passage to a user, by a firewall, of a separate later transmission which is properly in response to an original transmission, a dependency mask can be set based on session data items such as source host address, destination host address, and type of service. The mask can be used to query a cache of active sessions being processed by the firewall, such that a rule can be selected based on the number of sessions that satisfy the query. Dynamic rules may be used in addition to pre-loaded access rules in order to simplify rule processing. To unburden the firewall of application proxies, the firewall can be enabled to redirect a network session to a separate server for processing.
218 Citations
13 Claims
-
1. A method for packet validation in a computer network firewall, comprising the steps of:
-
obtaining a session key for a packet of a given network session;
processing a query portion of a rule, when a match with said session key is not found in a cache containing information about packets associated with one or more other network sessions which were previously processed by said firewall thereby indicating that the packet from which the session key is obtained is not from the one or more other network sessions, the query portion specifying a query to said cache to determine whether at least a portion of information associated with the packet of the given network session substantially matches at least a portion of information associated with at least one packet associated with the one or more other network sessions contained in said cache; and
processing an action portion of said rule as a function of a result of said query to said cache. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. An apparatus for use in validating a packet in a firewall of a computer network, comprising:
-
a processor operative (i) to obtain a session key for a packet of a given network session, (ii) to process a query portion of a rule, when a match with said session key is not found in a cache containing information about packets associated with one or more other network sessions which were previously processed by said firewall thereby indicating that the packet for which the session key is obtained is not from the one or more other network sessions, the query portion specifying a query to said cache to determine whether at least a portion of information associated with the packet of given network session substantially matches at least a portion of information associated with at least one packet associated with the one or more other network sessions contained in said cache, and (iii) to process an action portion of said rule as a function of a result of said query to said cache; and
a memory, coupled to the processor, for storing said cache. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A method for packet validation in a computer network firewall, comprising the steps of:
-
obtaining a session key for a packet of a network session;
processing a dependency mask associated with a rule, when a match with said session key is not found in a cache containing information about packets associated with one or more other network sessions which were previously processed by said firewall thereby indicating that the packet from which the session key is obtained is not from the one or more other network sessions, the dependency mask defining a query to said cache to determine whether at least a portion of information associated with the packet of the given network session substantially matches at least a portion of information associated with at least one packet associated with the one or more other network sessions contained in said cache; and
processing an action portion of the rule as a function of a result of said query to the cache.
-
Specification