Firewall protocol providing additional information

• US 7,146,638 B2
• Filed: 06/27/2002
• Issued: 12/05/2006
• Est. Priority Date: 06/27/2002
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Malcolm, Jerry Walter
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US10/185,704
• Publication Number:
  US 20040003290A1
• Time in Patent Office: 1,622 Days
• Field of Search: None
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A method and computer program product that allow a firewall program to control whether an application program is granted access to a wide area network (WAN), such as the Internet. The method allows the firewall to receive an access request definition from the application program through a well-known port. A preferred request definition comprises the application unique identifier, a destination address, the port, and a corresponding justification statement. The firewall intercepts access requests sent by the application program and identifies a matching access request definition. The firewall then prompts a user to approve or deny the request, wherein the prompt is accompanied by the justification statement from the identified access request definition. Accordingly, the user is better able to make an informed decision whether or not to grant the access request.

Claims

1. A method for a firewall program to control communication between an application program and a wide area network, comprising:

receiving at least one access request definition from the application program, wherein each access request definition comprises a unique identifier of the application program, a destination address on a wide area network, a port, and a corresponding justification statement;

intercepting an access request directed from the application program to a destination address on the wide area network;

identifying one of the at least one access request definitions that matches the intercepted access request; and

prompting a user to approve or deny the intercepted access request accompanied by the justification statement from the identified access request definition.

2. The method of claim 1, wherein the wide area network is the Internet.

3. The method of claim 1, wherein the at least one access request definition is received on a well-known port.

4. The method of claim 1, wherein the at least one access request definition is received from the application program during startup of the application program.

5. The method of claim 1, wherein the at least one access request definition is received by the firewall preceding the intercepted access request.

6. The method of claim 1, wherein the justification statement comprises parameters selected from the unique identifier of the application program, the version of the application program, the destination address on the wide area network address, an entity responsible for a server at the destination address, a text string detailing a purpose for the access request, information to be delivered to the server at the destination address, information to be received from the server at the destination address, and combinations thereof.

7. The method of claim 1, wherein the intercepted access request comprises the unique identifier of the application program and a destination address on the wide area network address.

8. The method of claim 1, further comprising:

receiving a user response indicating approval or denial of the intercepted access request.

9. The method of claim 8, further comprising:

maintaining an access rule data structure; and

prompting the user to provide an instruction whether to apply the user response against subsequent access requests matching the identified access request definition.

10. The method of claim 9, further comprising:

storing an access rule in the access rule data structure in accordance with the user instruction.

11. The method of claim 10, wherein the access rules comprise parameters selected from unique identifiers of approved applications, unique identifiers of unapproved applications, approved versions of the application program, unapproved versions of the application program, names of acceptable destination addresses on the wide area network, names of unacceptable destination addresses on the wide area network, and combinations thereof.

12. The method of claim 1, further comprising:

searching an access rule data structure for an access rule covering the access request.

13. The method of claim 10, further comprising:

receiving a subsequent access request matching the stored access rule;

automatically approving or denying the subsequent access request in accordance with the stored access rule.

14. The method of claim 13, wherein an access request matches the stored access rule when the access request contains at least one parameter in common with the stored access rule, wherein the at least one parameter is selected from unique identifiers of approved applications, unique identifiers of unapproved applications, approved versions of the application program, unapproved versions of the application program, names of acceptable destination addresses on the wide area network, names of unacceptable destination addresses on the wide area network, and combinations thereof.

15. The method of claim 1, further comprising:

passing approved access requests to the wide area network.

16. A computer program product including instructions embodied on a computer readable storage medium, the computer program product acting as a firewall to control access by an application program to a wide area network, comprising:

receiving instructions for receiving at least one access request definition from the application program, wherein each access request definition comprises a unique identification of the application program, a destination address on a wide area network, a port, and a corresponding justification statement;

intercepting instructions for intercepting an access request directed from the application program to a destination address on the wide area network;

identifying instructions for identifying one of the at least one access request definitions that matches the intercepted access request; and

prompting instructions for prompting a user to approve or deny the intercepted access request accompanied by the justification statement from the identified access request definition.

17. The computer program product of claim 16, wherein the wide area network is the Internet.

18. The computer program product of claim 16, wherein the at least one access request definition is received on a well-known port.

19. The computer program product of claim 16, wherein the at least one access request definition is received from the application program during startup of the application program.

20. The computer program product of claim 16, wherein the at least one access request definition is received by the firewall preceding the intercepted access request.

21. The computer program product of claim 16, wherein the justification statement comprises parameters selected from the unique identifier of the application program, the version of the application program, the destination address on the wide area network address, an entity responsible for a server at the destination address, a text string detailing a purpose for the access request, information to be delivered to the server at the destination address, information to be received from the server at the destination address, and combinations thereof.

22. The computer program product of claim 16, wherein the intercepted access request comprises the unique identifier of the application program and a destination address on the wide area network address.

23. The computer program product of claim 16, further comprising:

receiving instructions for receiving a user response indicating approval or denial of the intercepted access request.

24. The computer program product of claim 23, further comprising:

maintaining instructions for maintaining an access rule data structure; and

prompting instructions for prompting the user to provide an instruction whether to apply the user response against subsequent access requests matching the identified access request definition.

25. The computer program product of claim 24, further comprising:

storing instructions for storing an access rule in the access rule data structure in accordance with the user instruction.

26. The computer program product of claim 25, wherein the access rules comprise parameters selected from unique identifiers of approved applications, unique identifiers of unapproved applications, approved versions of the application program, unapproved versions of the application program, names of acceptable destination addresses on the wide area network, names of unacceptable destination addresses on the wide area network, and combinations thereof.

27. The computer program product of claim 16, further comprising:

searching instructions for searching an access rule data structure for an access rule covering the access request.

28. The computer program product of claim 25, further comprising:

receiving instructions for receiving a subsequent access request matching the stored access rule; and

automatic instructions for automatically approving or denying the subsequent access request in accordance with the stored access rule.

29. The computer program product of claim 28, wherein an access request matches the stored access rule when the access request contains at least one parameter in common with the stored access rule, wherein the at least one parameter is selected from unique identifiers of approved applications, unique identifiers of unapproved applications, approved versions of the application program, unapproved versions of the application program, names of acceptable destination addresses on the wide area network, names of unacceptable destination addresses on the wide area network, and combinations thereof.

30. The computer program product of claim 16, further comprising:

passing instructions for passing approved access requests to the wide area network.