System and method for providing network and computer firewall protection with dynamic address isolation to a device

• US 9,391,956 B2
• Filed: 01/18/2013
• Issued: 07/12/2016
• Est. Priority Date: 05/30/2007
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US13/745,591
• Publication Number:
  US 20130219484A1
• Time in Patent Office: 1,271 Days
• Field of Search: 726/13
• US Class Current: 1/1
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer performs dynamic address isolation. The computer comprises an application associated with an application address, a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network, a network address translation engine configured to translate between the application address and a public address, and a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address. The computer may communicate with a firewall configured to handle both network-level security and application-level security.

Claims

1. A computer comprising:

one or more processors;

an application;

a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network;

a network address translation engine implemented with the one or more processors, the network address translation engine configured to dynamically assign an address to the application from a range of IP addresses utilizing dynamic host configuration protocol (DHCP), the network address translation engine further configured to translate between the dynamically assigned address and a public address; and

a driver configured to automatically forward the outgoing data packets to the network address translation engine to translate the dynamically assigned address to the public address, and to automatically forward the incoming data packets to the network address translation engine to dynamically assign the address to the application and translate the public address to the dynamically assigned address.

2. The computer of claim 1, wherein the network address translation engine is part of the driver.

3. The computer of claim 1, wherein the network address translation engine is part of a firewall.

4. The computer of claim 1, wherein the computer is configured to send data packets identifying the application to a firewall, and the firewall is configured to handle both network-level security and application-level security.

5. The computer of claim 1, wherein the network address translation engine is part of a security system configured to implement a security policy for the computer.

6. The computer of claim 5, wherein the computer is configured to redirect the incoming data packets to the security system before the driver automatically forwards the incoming data packets to the network address translation engine.