System and method for testing functionality of a firewall

• US 8,510,823 B2
• Filed: 06/18/2010
• Issued: 08/13/2013
• Est. Priority Date: 06/18/2010
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Kuckelman, Mark J., Dao, Quang, Logan, Jeffery Jay, Alexander, Michael
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sanders, Stephen
• Application Number:
  US12/818,238
• Publication Number:
  US 20110314536A1
• Time in Patent Office: 1,152 Days
• Field of Search: 726/12
• US Class Current: 726/12
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Described are computer-based methods and apparatuses, including computer program products, for testing functionality of a firewall. The testing the functionality of the firewall can include a method. The method can include selecting a plurality of valid message types, generating a percentage of valid and invalid messages from the plurality of valid message types, transmitting the plurality of valid and invalid messages to the firewall, receiving an indication of the firewall'"'"'s handling of valid and invalid messages based on the transmitted message, and determining the functionality of the firewall from the received indication.

Claims

1. A method for testing functionality of a firewall, the method comprising:

selecting a plurality of valid message types;

generating a percentage of valid and invalid messages from the plurality of valid message types;

transmitting the plurality of valid and invalid messages to the firewall;

receiving an indication of the firewall'"'"'s handling of valid and invalid messages based on the transmitted message; and

determining the functionality of the firewall from the received indication.

2. The method of claim 1, wherein the step of receiving an indication comprises one of:

receiving an acknowledgment that the message passed through the firewall; and

timing out responsive to the message not passing through the firewall.

3. The method of claim 1, wherein the step of determining the functionality of the firewall, further comprising comparing the transmitted message to the received indication.

4. The method of claim 3, further comprising:

updating a valid message counter if an acknowledgement is received for a valid message sent;

updating the valid message counter if a time out is determined for an invalid message sent;

updating an invalid message counter if the acknowledgement is received for the invalid message sent; and

updating the invalid message counter if the time out is determined for the valid message sent.

5. The method of claim 1, further comprising:

prior to the transmitting;

packetizing the plurality of the valid and invalid messages; and

updating a valid packet counter and an invalid packet counter based on the packetizing the plurality of the valid and invalid messages.

6. The method of claim 1, wherein the generating the percentage of the valid and invalid messages from the plurality of the valid message types further comprising automatically and iteratively generating the percentage of the valid and invalid messages from the plurality of the valid message types over a period of time.

7. The method of claim 1, wherein the generating the percentage of the valid and invalid messages from the plurality of the valid message types further comprising generating the percentage of the valid and invalid messages from the plurality of the valid message types based on an illegal payload format, an illegal header format, or any combination thereof associated with the plurality of valid message types.

8. The method of claim 1, wherein the step of generating the percentage of the valid and invalid messages comprising inserting an illegal packet bit into a valid message to form an invalid message.

9. The method of claim 1, wherein the step of generating the percentage of the valid and invalid messages comprising:

selecting a message type from a plurality of stored message types based on a random number; and

generating an invalid message based on the selected message type and the random number.

10. A computer program product, tangibly embodied in a machine-readable storage device, the computer program product including instructions being operable to cause a data processing apparatus to:

select a plurality of valid message types;

generate a percentage of valid and invalid messages from the plurality of valid message types;

transmit the plurality of valid and invalid messages to the firewall;

receive an indication of the firewall'"'"'s handling of valid and invalid messages based on the transmitted message; and

determine the functionality of the firewall from the received indication.

11. A system for testing functionality of a firewall, the system comprising:

a message type selection module configured to select a plurality of valid message types;

a message generation module configured to generate a percentage of valid and invalid messages from the plurality of valid message types;

a communication module configured to;

transmit the plurality of valid and invalid messages to the firewall;

receive an indication of the firewall'"'"'s handling of valid and invalid messages based on the transmitted message; and

a functionality determination module configured to determine the functionality of the firewall from the received indication.

12. The system of claim 11, wherein the communication module further configured to:

receive an acknowledgment that the message passed through the firewall; and

time out a response to the message, the time out of the response indicative of the message not passing through the firewall.

13. The system of claim 11, wherein the functionality determination module further configured to compare the transmitted message to the received indication.

14. The system of claim 13, further comprising:

a valid message counter module configured to;

update a valid message counter if an acknowledgement is received for a valid message sent, and

update the valid message counter if a time out is determined for an invalid message sent; and

an invalid message counter module configured to;

update an invalid message counter if the acknowledgement is received for the invalid message sent, and

update the invalid message counter if the time out is determined for the valid message sent.

15. The system of claim 11, wherein the communication module further configured to:

prior to the transmitting;

packetize the valid and invalid message; and

update a valid packet counter and an invalid packet counter.

16. The system of claim 11, wherein the message generation module further configured to automatically and iteratively generate the percentage of the valid and invalid messages from the plurality of the valid message types over a period of time.

17. The system of claim 11, wherein the message generation module further configured to generate the percentage of the valid and invalid messages from the plurality of the valid message types based on an illegal payload format, an illegal header format, or any combination thereof associated with the plurality of valid message types.

18. The system of claim 11, wherein the message generation module further configured to insert an illegal packet bit into the valid message to form the invalid message.

19. The system of claim 11,

wherein the message type selection module further configured to select a message type from a plurality of stored message types based on a random number;

and

wherein the message generation module further configured to generate an invalid message based on the selected message type and the random number.

20. The system of claim 11, wherein the firewall comprises a network edge protection device, an email gateway, a cross-domain device, a packet filter device, an application gateway, a proxy server, or any combination thereof.

21. A system for testing functionality of a firewall, the system comprising:

means for selecting a plurality of valid message types;

means for generating a percentage of valid and invalid messages from the plurality of valid message types;

means for transmitting the plurality of valid and invalid messages to the firewall;

means for receiving an indication of the firewall'"'"'s handling of valid and invalid messages based on the transmitted message; and

means for determining the functionality of the firewall from the received indication.