System and method for providing network and computer firewall protection with dynamic address isolation to a device

• US 9,756,079 B2
• Filed: 07/01/2016
• Issued: 09/05/2017
• Est. Priority Date: 05/30/2007
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US15/201,309
• Publication Number:
  US 20170155682A1
• Time in Patent Office: 431 Days
• Field of Search: 726 13
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer performs dynamic address isolation. The computer comprises an application associated with an application address, a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network, a network address translation engine configured to translate between the application address and a public address, and a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address. The computer may communicate with a firewall configured to handle both network-level security and application-level security.

Claims

1. A computer system comprising:

at least one processor and memory;

an application associated with an application address;

a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network;

an address translation engine configured to translate between the application address and an external address; and

a driver for automatically forwarding the outgoing data packets to the address translation engine to translate the application address to the external address, and for automatically forwarding the incoming data packets to the address translation engine to translate the external address to the application address, the driver coupled to transmit the incoming data packets to a firewall configured to reject the incoming data packets if the incoming data packets include malicious content according to a security policy, and allow the incoming data packets to be forwarded to the application if the incoming data packets do not include malicious content according to the security policy.

2. The computer system of claim 1, wherein the address translation engine is part of the driver.

3. The computer system of claim 1, wherein the address translation engine is part of the firewall.

4. The computer system of claim 3, wherein the firewall is located on a mobile security system configured to implement the security policy.

5. The computer system of claim 1, wherein the address translation engine is configured to use Dynamic Host Configuration Protocol to translate between the application address and the external address.

6. The computer system of claim 1, wherein the computer system is configured to send data packets identifying the application to the firewall, and the firewall is configured to handle both network-level security and application-level security.

7. A system comprising:

a network interface configured to be coupled to an external network;

a firewall in communication with the network interface, the firewall configured to perform both network-level security and application-level security on incoming data packets, the firewall being further configured to reject the incoming data packets if the incoming data packets include malicious content according to a security policy, the firewall being configured to allow the incoming data packets to pass to one or more applications if the incoming data packets do not include malicious content according to the security policy;

a computer system in communication with the firewall, the computer system having one or more applications associated with at least one application address, the computer system being configured to send to the firewall outgoing data packets including an application identifier identifying a particular application of the one or more applications to the firewall; and

an address translation engine configured to translate the at least one application address associated with the particular application of the one or more applications to an external address, thereby dynamically isolating the particular application of the one or more applications from the external network.

8. The system of claim 7, wherein each outgoing data packet comprises the application identifier identifying the application associated with the outgoing data packet.

9. The system of claim 8, wherein the firewall is configured to use the application identifier identifying the application associated with the outgoing data packet to handle application-level security, to create an outgoing data packet subset by removing the application identifier identifying the application from the outgoing data packet, and to send the outgoing data packet subset to the external network.

10. The system of claim 7, wherein the network interface is configured to route the incoming data packets to the firewall.

11. The system of claim 7, wherein the firewall comprises the address translation engine.

12. The system of claim 11, wherein the firewall is configured to dynamically isolate the at least one application address from the external network using Dynamic Host Configuration Protocol.