Method, apparatus and computer program product for a network firewall

• US 6,772,347 B1
• Filed: 03/15/2000
• Issued: 08/03/2004
• Est. Priority Date: 04/01/1999
• Status: Expired due to Term

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Mao, Yuming, Ke, Yan, Xie, Ken
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/525,369
• Time in Patent Office: 1,602 Days
• Field of Search: 713/200, 713/201, 713/154, 713/155, 713/160, 709/243, 709/242, 709/238
• US Class Current: 726/11
• CPC Class Codes: H04L 49/90 Buffering arrangements
• CPC Class Codes: H04L 49/901 using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9057 Arrangements for supporting packet reassembly or resequencing
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Systems and methods for network security including a firewall. One firewall includes a firewall engine. The firewall engine includes a first engine including a first set of rules for sorting incoming IP packets into initially allowed packets and initially denied packets. The firewall engine also includes a filter including a second set of rules for receiving and further sorting the initially denied packets into allowed packets and denied packets.

Claims

1. An apparatus comprising:

a firewall engine including;

a first engine including a first set of rules for sorting incoming IP packets into initially allowed packets and initially denied packets; and

a filter including a second set of rules for receiving and further sorting the initially denied packets into allowed packets and denied packets.

2. The apparatus of claim 1, wherein the filter dynamically generates the second set of rules.

3. The apparatus of claim 2, wherein the first set of rules comprises fixed rules.

4. The apparatus of claim 3, further comprising:

a second engine for receiving and further processing the initially allowed packets.

5. The apparatus of claim 4, wherein the second engine is capable of modifying some subset of the initially allowed packets.

6. The apparatus of claim 5, wherein the second engine comprises:

a dynamic analyzer for identifying initially allowed packets requiring network address translation; and

a handler for providing network address translation.

7. The apparatus of claim 5, wherein the second engine comprises a dynamic analyzer for sending a “

reset”

packet to a source IP address.

8. A computer software product, tangibly stored on a computer-readable medium, for providing a network security, comprising instructions operable to cause a programmable processor to:

process incoming IP packets into initially allowed packets and initially denied packets;

extract matching criteria from incoming IP packets;

dynamically generate rules using the extracted matching criteria; and

further process the initially denied packets using the dynamically-generated rules.

9. The computer software product of claim 8, wherein the instructions to process incoming IP packets use fixed rules.

10. The computer software product of claim 9, further comprising instructions to:

further process the initially allowed packets into allowed packets and packets requiring modification.

11. The computer software product of claim 10, further comprising instructions to:

modify control packets.

12. The computer software product of claim 11, wherein the instructions to modify control packets include instructions for network address translation.

13. The computer software product of claim 10, further comprising instructions to:

generate and transmit a “

reset”

packet in response to a denied packet.

14. A method for providing network computer security, comprising:

receiving incoming packets at a firewall;

sorting the incoming packets into initially allowed packets and initially denied packets; and

further sorting the initially denied packets into allowed and denied packets using rules.

15. The method of claim 14, wherein the step of sorting the incoming packets is performed using fixed rules.

16. The method of claim 15, further comprising the step of further sorting the initially allowed packets into allowed packets and packets requiring modification.

17. The method of claim 16, further comprising the step of providing network address translation for packets requiring modification.

18. The method of claim 14, wherein the packets are IP packets.

19. The method of claim 14, wherein the rules are dynamically generated.

20. A method for providing network computer security, comprising:

receiving incoming IP packets at a firewall;

sorting the incoming IP packets into initially allowed packets and initially denied packets using a set of fixed rules;

extracting parameters from the incoming IP packets;

using the extracted parameters to generate a set of dynamically-generated rules; and

further sorting the initially denied packets into allowed and denied packets using the dynamically-generated rules.

21. The method of claim 20, further comprising the step of further sorting the initially allowed packets into allowed packets and packets requiring modification.

22. The method of claim 21, further comprising the step of providing network address translation for packets requiring modification.

23. An apparatus comprising:

an ASIC including a firewall engine including;

a first engine including a first set of rules for processing incoming IP packets into initially allowed packets and initially denied packets; and

a filter including a second set of rules for receiving and further processing the initially denied packets into allowed packets and denied packets.

24. A method for providing network computer security, comprising:

receiving incoming packets at a firewall;

processing the incoming packets into initially allowed packets and initially denied packets; and

further processing the initially denied packets into allowed and denied packets using rules.