Host trust report based filtering mechanism in a reverse firewall

• US 8,819,808 B2
• Filed: 09/14/2012
• Issued: 08/26/2014
• Est. Priority Date: 12/19/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Fried, Eric P., Kosanam, Sipla, Sabarathinam, Suresh, Goyal, Anand
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US13/619,185
• Publication Number:
  US 20130247170A1
• Time in Patent Office: 711 Days
• Field of Search: None
• US Class Current: 726/14
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

Disclosed is a computer implemented method to report a bad host. A receiver host receives a packet from a sender host. The receiver host detects that the packet contains suspect hostile content. The receiver host transmits a negative trust report.

Claims

1. A computer implemented method to report a bad host, the computer implemented method comprising:

a receiver host receiving a packet from a sender host;

the receiver host detecting that the packet contains suspect hostile content;

the receiver host transmitting a negative trust report to a reverse firewall;

the receiver host receiving a request for a demanded positive trust report from the reverse firewall, wherein the reverse firewall connects a first network hosting the receiver host to a second network hosting the sender host that is described in the request for the demanded positive trust report;

responsive to receiving the request for the demanded positive trust report, incrementing a count;

the receiver host determining whether the count is below a threshold number of demanded positive trust reports;

responsive to a determination that the count is below the threshold number of demanded positive trust reports, the receiver host determining whether the sender host is marked good; and

responsive to a determination that the sender host is marked good, the receiver host transmitting a positive trust report to the reverse firewall.

2. The computer implemented method of claim 1, wherein the step of transmitting the negative trust report is responsive to the receiver host determining that the sender host is not marked good and the count exceeds the threshold number of demanded positive trust report.

3. The computer implemented method of claim 1, further comprising:

in response to the reverse firewall receiving the negative trust report from the receiver host concerning the sender host, the reverse firewall marking the sender host as bad.

4. The computer implemented method of claim 1, wherein the count determines a number of received demanded positive trust reports received during a recent period, wherein the demanded trust reports specify the sender host.