Firewall protection for wireless users

• US 7,089,586 B2
• Filed: 05/02/2001
• Issued: 08/08/2006
• Est. Priority Date: 05/02/2001
• Status: Active Grant

• Current Assignee: IPR Licensing Incorporated (InterDigital, Inc.)
• Original Assignee: IPR Licensing Incorporated (InterDigital, Inc.)
• Inventors: Kilgore, Brian
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US09/847,865
• Publication Number:
  US 20020166068A1
• Time in Patent Office: 1,924 Days
• Field of Search: 713/201, 713153-154, 713/100, 370/229, 380/270, 726/13, 726/11
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

In a computer telecommunications network, firewalls protect a machine or network from undesired message transmissions. In the case of a firewall employed on a user side of the wireless link, a message rejected by the firewall has already consumed the wireless resources required to transmit. A system for protecting a mobile wireless user via a firewall employed at the wired line, or ISP side, of the wireless link in a wireless network allows a specific user profile to be provided for each user that is indicative of a desired firewall configuration corresponding to the mobile user. A firewall configuration is established at a firewall application in a wireless transceiver corresponding to the current location of the mobile user, and the same firewall configuration is established, via a wireless handoff, at a second wireless transceiver when the user is located in the area corresponding to the second wireless transceiver, thereby protecting a plurality of wireless users prior to wasteful wireless transmission of undesired messages.

Claims

1. A method of protecting a mobile wireless user via a firewall comprising:

defining a mobile user profile indicative of a firewall configuration corresponding to the mobile user;

establishing the firewall configuration at a firewall application in a wireless transceiver corresponding to the current location of the mobile user, the wireless transceiver operable for wireless communication with the mobile user via a wireless access unit; and

establishing the same firewall configuration at a firewall application in a second wireless transceiver when the user is located in the area corresponding to the second wireless transceiver.

2. The method of claim 1 wherein the firewall configuration is indicative of a set of firewall characteristics corresponding to a particular mobile user.

3. The method of claim 1 wherein the firewall is operable to selectively provide authorized access via the wireless transceiver.

4. The method of claim 1 wherein the wireless transceiver is a Base Station Processor (BSP).

5. The method of claim 1 wherein the wireless transceiver is an internetworking gateway in communication with a Base Station Processor (BSP).

6. The method of claim 2 wherein the firewall configuration corresponding to each of a plurality of mobile users is stored in a central repository.

7. The method of claim 6 wherein the central repository is a Wireless Internet Facility (WIF).

8. The method of claim 2 wherein establishing further comprises an indexed lookup according to a unique identifier indicative of the particular mobile user.

9. The method of claim 8 wherein the unique identifier is an index selected from the group consisting of a subscriber If) and an electronic serial number (ESN).

10. The method of claim 1 wherein the firewall is located on a wired network side of wireless link.

11. The method of claim 10 wherein the wired side corresponds to an ISP side of the wireless link, the ISP side connected to a public access network.

12. The method of claim 3 further comprising selectively allowing message packet transmissions by determining if a message packet corresponds to the firewall characteristics of a particular mobile user profile.

13. The method of claim 12 wherein the firewall characteristics are selected from the group consisting of port numbers, application IDs, source, destination, content filters, IP address, machine names, virus detection, password cracking, denial of service detection, and TCP/IP flags.

14. A system for protecting a mobile wireless user via a firewall comprising:

a subscriber access unit in communication with the mobile wireless user, the access unit operable to transmit and receive wireless transmissions;

a wireless transceiver in wireless communication with the access unit, the wireless transceiver operable for communication via a public access network;

a firewall application in the wireless transceiver, the firewall application operable to establish a firewall configuration to selectively forward wireless transmissions according to a mobile user profile corresponding to the mobile wireless user; and

a handoff manager operable to establish communications with a second wireless transceiver when the mobile wireless user is in an area corresponding to the second wireless transceiver, wherein the communications with the second wireless transceiver corresponds to the mobile user profile.

15. The system of claim 14 wherein the firewall is operable to selectively provide authorized access via the wireless transceiver.

16. The system of claim 14 wherein the wireless transceiver is a Base Station Processor (BSP).

17. The system of claim 14 wherein the wireless transceiver is an internetworking gateway in communication with a Base Station Processor (BSP).

18. The system of claim 14 further comprising a unique identifier indicative of the particular mobile user, the unique identifier adapted for an indexed lookup of the mobile user profile.

19. The system of claim 18 wherein the unique identifier is an index selected from the group consisting of a subscriber ID and an electronic serial number (ESN).

20. The system of claim 14 wherein the firewall configuration is indicative of a set of firewall characteristics corresponding to a particular mobile user.

21. The system of claim 14 further comprising a central repository, wherein the firewall configuration corresponding to each of a plurality of mobile users is stored in the central repository.

22. The system of claim 21 wherein the central repository is a Wireless Internet Facility (WIF).

23. The system of claim 14 wherein the firewall is located on wired network side of wireless link.

24. The system of claim 14 wherein the wired side corresponds to an ISP side of the wireless link.

25. The system of claim 14 wherein the firewall is operative to selectively allow message packet transmissions by determining if a message packet corresponds to the firewall characteristics of a particular mobile user profile.

26. The system of claim 25 wherein the firewall characteristics are selected from the group consisting of port numbers, application IDs, source, destination, content filters, IP address, machine names, virus detection, password cracking, denial of service detection, and TCP/IP flags.

27. A method of protecting mobile wireless users via a firewall comprising:

defining a first mobile user profile indicative of a first firewall configuration corresponding to the first mobile user;

establishing the firewall configuration at a firewall application in a base station;

defining a second mobile user profile indicative of a second firewall configuration corresponding to a second mobile user;

establishing the second firewall configuration at the firewall application in the base station;

receiving message packets at the base station;

when the message packets are directed to the first mobile user, determining, according to the first mobile user profile, whether to forward the message packets to the first mobile user; and

when the message packets are directed to the second mobile user, determining, according to the second mobile user profile, whether to forward message packets directed to the second mobile user.

28. The method of claim 27 wherein the first mobile user profile and the second mobile user profile are different.

29. A computer program product having computer program code for protecting a mobile wireless user via a firewall comprising:

computer program code for defining a mobile user profile indicative of a firewall configuration corresponding to the mobile user;

computer program code for establishing the firewall configuration at a firewall application in a wireless transceiver corresponding to the current location of the mobile user, the wireless transceiver operable for wireless communication with the mobile user via a wireless access unit; and

computer program code for establishing the same firewall configuration at a firewall application in a second wireless transceiver when the user is located in the area corresponding to the second wireless transceiver.

30. A computer data signal for protecting a mobile wireless user via a firewall comprising:

program code for defining a mobile user profile indicative of a firewall configuration corresponding to the mobile user;

program code for establishing the firewall configuration at a firewall application in a wireless transceiver corresponding to the current location of the mobile user, the wireless transceiver operable for wireless communication with the mobile user via a wireless access unit; and

program code for establishing the same firewall configuration at a firewall in a second wireless transceiver when the user is located in the area corresponding to the second wireless transceiver.

31. A system for protecting a mobile wireless user via a firewall comprising:

means for defining a mobile user profile indicative of a firewall configuration corresponding to the mobile user;

means for establishing the firewall configuration at a firewall application in the wireless transceiver corresponding to the current location of the mobile user, the wireless transceiver operable for wireless communication with the mobile user via a wireless access unit; and

means for establishing the same firewall configuration at a firewall in a second wireless transceiver when the user is located in the area corresponding to the second wireless transceiver.