Integrated computer security management system and method

• US 8,122,495 B2
• Filed: 12/11/2007
• Issued: 02/21/2012
• Est. Priority Date: 09/07/2001
• Status: Expired due to Term

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Ramsey, Jon, Ketts, Kevin, Buer, Steve
• Primary Examiner(s): SHAW, YIN CHEN
• Application Number:
  US12/001,465
• Publication Number:
  US 20080115204A1
• Time in Patent Office: 1,533 Days
• Field of Search: 713/188, 726/1, 726 11- 14, 726 23- 24
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

The present invention is generally directed to a computer security management system that integrates a firewall with an intrusion detection system (IDS). In other words, the firewall and IDS of the present invention can be designed to communicate process or status information and packets with one another. The present invention can facilitate centralized control of the firewall and the IDS and can increase the speed at which packets are passed between a secured computer network and an external network. Increased packet processing speed can be achieved in several ways. For example, the firewall and IDS can process packets in series, in parallel, and sometimes singularly when one of the components is not permitted to process a packet. Alternatively, singular processing can also be performed when one component is permitted to pass a packet to the secured computer network without checking with the other component.

Claims

1. A computer-implemented method for managing computer security information, comprising:

determining by a firewall whether a first packet should be deemed as accepted based upon a first firewall rule;

if the first packet is deemed as accepted, determining by a computer security device, whether to send the first packet based on the determination by the firewall that the first packet is deemed accepted and on a first evaluation by the computer security device, wherein the firewall is different from the computer security device, and wherein the determining by the firewall and the determining by the computer security device are performed in parallel;

determining by the firewall whether a second packet should be deemed as trusted by identifying a source of the second packet, comparing the identified source to a predetermined list, and, if the identified source matches a source on the list, designating the second packet as trusted and originating from a trusted data provider; and

if the second packet is deemed by the firewall as trusted, then sending the second packet without waiting for a second evaluation by the computer security device and irrespective of the second evaluation made by the computer security device.

2. The method of claim 1, wherein the computer security device comprises an intrusion detection system.

3. The method of claim 1, wherein determining by the firewall whether the second packet should be deemed trusted comprises comparing the second packet with a second firewall rule.

4. The method of claim 1, further comprising:

copying the second packet; and

forwarding the copy of the second packet to the computer security device.

5. The method of claim 1, further comprising:

determining if a third packet violates a third rule of the firewall; and

if the third packet violates the third rule, then dropping the third packet.

6. The method of claim 1, further comprising:

evaluating the second packet with a virus scanning device.

7. The method of claim 1, further comprising:

determining if a third packet is destined for a secured computer network; and

communicating the third packet to the computer security device even if the third packet is not destined for the secured computer network.

8. The method of claim 1, further comprising:

determining whether the firewall has deemed a third packet as rejected; and

determining whether the firewall has deemed a fourth packet as denied.

9. A computer-implemented method for managing computer security information, comprising:

determining by a firewall whether a first packet should be deemed as accepted based upon a first firewall rule;

if the first packet is deemed as accepted, determining by the firewall whether a computer security device comprises availability to evaluate the first packet, wherein the firewall is different from the computer security device, and wherein the determining by the firewall and the evaluation by the computer security device are performed in parallel;

if the computer security device does not comprise availability to evaluate the first packet, then determining by the firewall whether to block the first packet without consideration of the computer security device'"'"'s evaluation of the first packet or to process the first packet based on the firewall'"'"'s determination;

in response to a determination to process the first packet based on the firewall'"'"'s determination;

sending the first packet if the firewall determines that the first packet is deemed as acceptable; and

blocking the first packet if the firewall determines that the first packet should be blocked;

determining by the firewall whether a second packet should be deemed as trusted by identifying a source of the second packet, comparing the identified source to a predetermined list, and if the identified source matches a source on the list then designating the second packet as trusted and originating from a trusted data provider; and

if the second packet is deemed by the firewall as trusted, then sending the second packet without waiting for a second evaluation by the computer security device and irrespective of the second evaluation made by the computer security device.

10. The method of claim 9, wherein determining whether the second packet should be deemed trusted comprises comparing the second packet with one or more firewall rules.

11. The method of claim 9, wherein the computer security device comprises an intrusion detection system.

12. The method of claim 9, further comprising:

copying the first packet; and

forwarding the copy of the first packet to the computer security device.

17. The method of claim 9, further comprising:

if the computer security device comprises availability to evaluate the first packet, then evaluating the first packet with the computer security device by comparing the first packet with one or more rules; and

determining whether to send the first packet based upon a combination of the firewall evaluation and the computer security device evaluation.

13. An integrated computer security management system comprising:

a secured computer network;

a firewall adapted to perform an evaluation of a packet with one or more rules in order to determine whether to send the packet to the secured computer network, the firewall operative to determine whether the packet is deemed as;

accepted based upon the one or more rules, the firewall further operative to wait for further evaluation of the packet by a device other than the firewall before passing the packet, if the packet is accepted;

or

trusted by identifying the packet as originating from a trusted data provider, the firewall further operative to allow the packet to pass without waiting for the further evaluation of the packet by the other device if the packet is deemed as trusted;

a computer security device adapted to perform another evaluation of the packet in parallel with the evaluation made by the firewall, to compare the packet with one or more listed signatures, to generate an alert if a match between the packet and one or more listed signatures exists, and to determine whether to send the packet to the secured computer network based on the evaluation of the packet by the computer security device and the evaluation of the packet by the firewall if the firewall deems the packet as accepted, wherein the firewall is different from the computer security device; and

a central controller coupled to the firewall and the computer security device, adapted to configure at least one of the firewall and computer security device.

14. The system of claim 13, wherein the computer security device comprises an intrusion detection system.

15. The system of claim 13, wherein the central controller receives one or more alerts that are generated by the intrusion detection system.

16. The system of claim 13, wherein the computer security device and firewall reside on a single computer.

18. The system of claim 13, wherein the firewall is further operative to:

determine whether the computer security device comprises availability to evaluate the packet; and

based on a determination that the computer security device does not comprise availability to evaluate the packet, block the packet irrespective of the evaluation performed by the firewall.

19. The system of claim 13, wherein the firewall is further operative to:

determine whether the computer security device comprises availability to evaluate the packet; and

based on a determination that the computer security device does not comprise availability to evaluate the packet, allow the packet to pass if the firewall deems the packet as acceptable based on one or more rules.