Firewall providing enhanced network security and user transparency

• US 6,804,783 B1
• Filed: 04/18/2000
• Issued: 10/12/2004
• Est. Priority Date: 10/17/1996
• Status: Expired due to Fees

• Current Assignee: Network Engineering Software, Inc. (Hopto Inc.)
• Original Assignee: Network Engineering Software, Inc. (Hopto Inc.)
• Inventors: Wesinger, Jr., Ralph E., Coley, Christopher D.
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/552,476
• Time in Patent Office: 1,638 Days
• Field of Search: 713/200, 713/201
• US Class Current: 726/11
• CPC Class Codes: B65B 11/004 in blanks, e.g. sheets precut and creased for folding
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 2101/677 Multiple interfaces, e.g. multihomed nodes
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2521 Translation architectures other than single NAT servers
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

The present invention, generally speaking, provides a firewall that achieves maximum network security and maximum user convenience. The firewall employs “envoys” that exhibit the security robustness of prior-art proxies and the transparency and ease-of-use of prior-art packet filters, combining the best of both worlds. No traffic can pass through the firewall unless the firewall has established an envoy for that traffic. Both connection-oriented (e.g., TCP) and connectionless (e.g., UDP-based) services may be handled using envoys. Establishment of an envoy may be subjected to a myriad of tests to “qualify” the user, the requested communication, or both. Therefore, a high level of security may be achieved. The usual added burden of prior-art proxy systems is avoided in such a way as to achieve full transparency—the user can use standard applications and need not even know of the existence of the firewall. To achieve full transparency, the firewall is configured as two or more sets of virtual hosts. The firewall is, therefore, “multi-homed,” each home being independently configurable. One set of hosts responds to addresses on a first network interface of the firewall. Another set of hosts responds to addresses on a second network interface of the firewall. In one aspect, programmable transparency is achieved by establishing DNS mappings between remote hosts to be accessed through one of the network interfaces and respective virtual hosts on that interface. In another aspect, automatic transparency may be achieved using code for dynamically mapping remote hosts to virtual hosts in accordance with a technique referred to herein as dynamic DNS, or DDNS.

Claims

1. A method of authenticating the identity of a user as one authorized to communicate from a first computer, across a computer network, and through a firewall to a second computer, the method comprising the steps of:

receiving at the firewall a request to establish a connection between the first computer and the second computer;

communicating to the user through a separate communications mechanism a key; and

requiring the user to send to the firewall information dependent upon said key in order to said connection to be established.

2. The method of claim 1, wherein said key is valid only for the current attempted connection.

3. The method of claim 1, wherein communicating comprises paging a pager of said user, said key being included in a paging message.

4. The method of claim 1, wherein communicating comprises sending a fax including said key to a fax number of said user.

5. The method of claim 1, wherein communicating comprises the user calling a predetermined telephone number, entering identifying information, and receiving a voice message including said key.

6. A firewall, comprising:

means for communicating a key to a user through a separate communications mechanism in response to a request to establish a connection between a first computer and a second computer; and

means for establishing the connection between the first computer and the second computer in response to a reception of information dependent upon said key.

7. A firewall, comprising:

a physical computer;

a first interface connecting said physical computer to a first computer; and

a second interface connecting said physical computer to a second computer,

wherein said physical computer is operable to communicate a key to a user through a separate communications mechanism in response to a request to establish a connection between the first computer and the second computer, and

wherein said physical computer is further operable to establish the connection between the first computer and the second computer in response to a reception of information dependent upon said key.

8. The firewall of claim 7, wherein the key is only valid for the current attempted connection.

9. The firewall of claim 7, wherein said physical computer communicates the key to the user by paging a pager of the user with the key included in a paging message.

10. The firewall of claim 7, wherein said physical computer communicates the key to the user by sending a fax including the key to a fax number of the user.

11. The firewall of claim 7, wherein said physical computer communicates the key to the user by providing a voice message including the key to the user in response to the user calling a predetermined telephone number and entering identifying information.

12. A computer readable medium containing computer instructions executable by a computer, the computer instruction comprising:

computer instructions for receiving at a firewall a request from a user to establish a connection between a first computer and a second computer;

computer instructions for communicating a key to the user through a separate communications mechanism; and

computer instructions for requiring the user to send to the firewall information dependent upon the key in order to the connection to be established.

13. The computer readable medium of claim 12, wherein the key is only valid for the current attempted connection.

14. The computer readable medium of claim 12, wherein the key is communicated to the user by a paging of a pager of the user with the key included in a paging message.

15. The computer readable medium of claim 12, wherein the key is communicated to the user by a sending a fax including the key to a fax number of the user.

16. The computer readable medium of claim 12, wherein the key is communicated to the user by a providing of a voice message including the key to the user in response to the user calling a predetermined telephone number and entering identifying information.