Dynamically adaptive network firewalls and method, system and computer program product implementing same

• US 8,397,282 B2
• Filed: 04/22/2011
• Issued: 03/12/2013
• Est. Priority Date: 03/10/2004
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: RPX Corporation
• Inventors: White, Eric, Turley, Patrick
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US13/092,488
• Publication Number:
  US 20110219444A1
• Time in Patent Office: 690 Days
• Field of Search: None
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A system, method, and computer program product for controlling data through a firewall which may be dynamically configurable. The method may comprise defining at least one node, wherein the at least one node is associated with two or more network interfaces; associating a set of firewall rules with the at least one node; receiving a packet at a first node of the at least one node; and accepting or denying the packet based on the set of firewall rules. The firewall rules include dynamic chains of rules having defined places where firewall rules may be dynamically inserted into or deleted from the firewall while the firewall is operating on one or more machines connected to network segments where the nodes reside.

Claims

1. A method for controlling data through a firewall performed on at least one data controlling computer having computer instructions stored on at least one non-transitory computer readable medium, comprising:

defining at least one node, wherein the at least one node is associated with two or more network interfaces;

associating a set of firewall rules with the at least one node;

receiving a packet at a first node of the at least one node; and

accepting or denying the packet based on the set of firewall rules, wherein the set of firewall rules is dynamically self-configurable during runtime without operator interaction, wherein the set of firewall rules comprises a plurality of chains of rules forming various paths through a hierarchical structure, and wherein the hierarchical structure comprises defined places for dynamically updating the set of firewall rules during runtime.

2. A method according to claim 1, wherein dynamically updating the set of firewall rules during runtime further comprises, during runtime, adding a rule to the set of firewall rules, deleting a rule from the set of firewall rules, or modifying a rule in the set of firewall rules without operator interaction.

3. A method according to claim 1, wherein associating the set of firewall rules with the at least one node further comprises associating a first subset of the set of firewall rules with the first node.

4. A method according to claim 3, wherein the at least one node further comprises at least two nodes including a second node, further comprising associating a second subset of the set of firewall rules with the second node.

5. A method according to claim 4, wherein the first subset of firewall rules is the same as or at least partially different from the second subset of firewall rules.

6. A method according to claim 4, wherein one of the first subset of firewall rules or second subset of firewall rules equals the entire set of firewall rules.

7. A method according to claim 1, further comprising, after receiving the packet and prior to accepting or denying the packet, conditioning the packet based on the set of firewall rules.

8. A method according to claim 7, wherein conditioning the packet based on the set of firewall rules further comprises rewriting a portion of a network packet header associated with the packet.

9. A method according to claim 1, wherein each of the at least one node is associated with at least two network interfaces.

10. A method according to claim 1, wherein each of the two or more network interfaces is connected with at least one physical device.

11. A method according to claim 1, wherein the set of firewall rules being dynamically self-configurable further comprises dynamically updating the set of firewall rules during runtime without operator interaction.

12. A device for controlling data through a firewall, comprising:

a plurality of network interfaces, wherein each of the plurality of network interfaces is operable to utilize one or more physical devices;

a first computer readable storage medium storing a set of firewall rules, wherein the set of firewall rules is dynamically self-configurable during runtime without operator interaction, wherein the set of firewall rules comprises a plurality of chains of rules forming various paths through a hierarchical structure, and wherein the hierarchical structure comprises defined places for dynamically updating the set of firewall rules during runtime without operator interaction;

a data controlling computer program comprising data controlling computer program code stored on either the first computer readable storage medium or on a second computer readable storage medium, the data controlling computer program code being executable to;

define at least one node, wherein the at least one node is associated with two or more network interfaces of the plurality of network interfaces; and

when a packet is received at one of the two or more network interfaces associated with the at least one node, accept or deny the packet based on a review of the set of firewall rules.

13. A device according to claim 12, wherein the data controlling computer program code is further executable to, while the firewall is processing traffic through the at least one node, add a rule to the set of firewall rules, delete a rule from the set of firewall rules, or modify a rule in the set of firewall rules.

14. A device according to claim 12, wherein the at least one node comprises a first node, and wherein the data controlling computer program code is further executable to:

associate a first subset of the set of firewall rules with the first node; and

if the packet is received at the first node, apply the first subset of the set of firewall rules associated with the first node.

15. A device according to claim 14, wherein the at least one node further comprises at least two nodes including a second node, and wherein the data controlling computer program code is further executable to:

associate a second subset of the set of firewall rules with the second node; and

if the packet is received at the second node, apply the second subset of the set of firewall rules associated with the second node.

16. A device according to claim 15, wherein the first subset of the set of firewall rules is the same as or different from the second subset of the set of firewall rules.

17. A device according to claim 15, wherein either the first subset of the set of firewall rules or the second subset of the set of firewall rules equals the entire set of firewall rules.

18. A device according to claim 12, wherein the data controlling computer program code is further executable to condition the packet based on the set of firewall rules.

19. A device according to claim 18, wherein conditioning the packet based on the set of firewall rules further comprises rewriting a portion of a network packet header associated with the packet.

20. A device according to claim 12, wherein each of the at least one node is associated with at least two network interfaces.

21. A device according to claim 12, wherein each of the plurality of network interfaces is connected with at least one physical device.

22. A device according to claim 12, wherein each of the plurality of network interfaces is physically connected to every other network interface of the plurality of network interfaces and

wherein physical connection between the plurality of network interfaces comprises indirect physical connection between the plurality of network interfaces.

23. A device according to claim 12, wherein the data controlling computer program code is further executable to dynamically update the set of firewall rules during runtime without operator interaction.

24. A data controlling computer program product comprising computer instructions stored on at least one non-transitory computer readable medium, wherein the computer instructions are operable when executed by at least one processor to:

define at least one node for controlling data through a firewall, wherein at least one of the at least one node is associated with two or more network interfaces;

associate a set of firewall rules with the at least one node, wherein the set of firewall rules further comprises a plurality of chains of rules forming various paths through a hierarchical structure, and wherein the hierarchical structure comprises defined places for dynamically updating the set of firewall rules during runtime without operator interaction;

receive a packet at a first node of the at least one node; and

accept or deny the packet based on a review of the set of firewall rules, wherein the set of firewall rules is dynamically self-configurable during runtime without operator interaction.

25. A data controlling computer program product according to claim 24, wherein the computer instructions are further executable to dynamically update the set of firewall rules during runtime without operator interaction.

26. A data controlling computer program product according to claim 25, wherein the computer instructions are further executable to, while the firewall is processing traffic through the at least one node, add a rule to the set of firewall rules, delete a rule from the set of firewall rules, or modify a rule in the set of firewall rules.

27. A data controlling computer program product according to claim 26, wherein the computer instructions are further executable to:

associate a first subset of the set of firewall rules with the first node; and

if the packet is received at the first node, apply the first subset of the set of firewall rules associated with the first node.

28. A data controlling computer program product according to claim 27, wherein the at least one node further comprises at least two nodes including a second node, and wherein the computer instructions are further executable to:

associate a second subset of the set of firewall rules with the second node; and

if the packet is received at the second node, apply the second subset of the set of firewall rules associated with the second node.

29. A data controlling computer program product according to claim 28, wherein the first subset of the set of firewall rules is the same as or different from the second subset of the set of firewall rules.

30. A data controlling computer program product according to claim 28, wherein either the first subset of the set of firewall rules or the second subset of the set of firewall rules equals the entire set of firewall rules.

31. A data controlling computer program product according to claim 24, wherein the computer instructions are further executable to condition the packet based on the set of firewall rules.

32. A data controlling computer program product according to claim 31, wherein conditioning the packet based on the set of firewall rules further comprises rewriting a portion of a network packet header associated with the packet.

33. A data controlling computer program product according to claim 24, wherein each of the at least one node comprises at least two network interfaces.

34. A data controlling computer program product according to claim 24, wherein each of the two or more network interfaces is connected with at least one physical device.

35. A data controlling computer program product according to claim 24, wherein each of the two or more network interfaces is physically connected to every other network interface of the two or more network interfaces and wherein physical connection between the two or more network interfaces comprises indirect physical connection between the two or more network interfaces.