Client assisted firewall configuration

• US 20060253900A1
• Filed: 12/21/2005
• Published: 11/09/2006
• Est. Priority Date: 12/21/2004
• Status: Abandoned Application

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Rose, Gregory Gordon, Paddon, Michael, Hawkes, Philip Michael
• Application Number:
  US11/315,394
• Publication Number:
  US 20060253900A1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Embodiments describe techniques in connection with configuring a firewall and/or reducing network traffic. According to an embodiment is a method for configuring a firewall to reduce unwanted network traffic. The method includes executing a web-server and detecting a passive socket has been created. The method also includes establishing contact with a firewall and requesting the firewall to permit flows directed to the passive socket. According to some embodiments, the method can include closing the web-server and destroying the passive socket. The firewall can be contacted with the destroyed passive socket information and can be sent a request to deny flows directed to the destroyed passive socket. If the passive socket is closed, the method can automatically revoke the request to the firewall to permit flows directed to the passive socket.

Claims

1. A method for a mobile device to configure a firewall to reduce unwanted network traffic, comprising:

establishing a network connection with a network firewall; and

communicating with the network firewall to manage network traffic.

2. The method of claim 1, further comprising:

detecting if a passive socket has been created; and

requesting the network firewall to permit flows directed to the passive socket.

3. The method of claim 2, further comprising:

closing a web-server;

destroying the passive socket;

contacting the firewall; and

requesting the firewall to deny flows directed to the passive socket.

4. The method of claim 2, further comprising:

determining whether the passive socket is open or closed; and

allowing further communication directed to the passive socket if the socket is open.

5. The method of claim 2, further comprising:

determining whether the passive socket is open or closed; and

automatically revoking the request to the firewall to permit flows directed to the passive socket.

6. A method for a host to automatically recover from a broken session, comprising:

requesting a remote firewall to allow transit of packets directed to at least one open socket;

detecting a broken session;

revoking the packet request directed to at least one open socket;

reestablishing a new session; and

requesting transit of desired flows.

7. The method of claim 6, requesting packets directed to at least one open socket further comprising generating a list of current open sockets.

8. The method of claim 6, requesting transit of desired flows further comprising regenerating the list of open sockets.

9. The method of claim 6, detecting a broken session further comprising ascertaining that the at least one open socket is closed.

10. The method of claim 6, detecting a broken session further comprising observing a lack of traffic from a peer device.

11. A mobile device for configuring a network firewall, comprising:

a processor that analyzes information related to configuring a firewall to reduce traffic; and

a memory operatively connected to the processor.

12. The mobile device of claim 11, further comprising:

an establisher that establishes a communication with an external source; and

a designator that designates parameters associated with a packet received from the external source and communicates the parameters to a firewall.

13. The mobile device of claim 12, the external source is a web-server.

14. The mobile device of claim 12, the parameter is an open passive socket.

15. The mobile device of claim 12, further comprising an invalidator that requests revocation of transit for the at least one parameter.

16. The mobile device of claim 11, further comprising:

a transmitter that communicates to a firewall at least one policy update; and

a receiver that receives an acknowledgement or denial of the policy from the firewall.

17. An apparatus for use in mobile device for reducing network traffic, comprising:

means for detecting at least one firewall;

means for communicating with the at least one firewall; and

means for dynamically updating a policy associated with the at least one firewall.

18. The apparatus of claim 17, further comprising means for inspecting a list of passive sockets.

19. The apparatus of claim 17, further comprising means for specifying desired incoming flows.

20. A computer readable medium for use in a mobile device, said medium having computer-executable instructions for:

establishing a network connection;

detecting a passive socket associated with the established network connection;

contacting a firewall; and

requesting the firewall to allow flows directed to the passive socket.

21. The computer readable medium of claim 20, further comprising computer-executable instructions for:

terminating the network connection;

destroying the passive socket;

contacting the firewall; and

requesting the firewall to deny flows directed to the destroyed passive socket.

22. The computer readable medium of claim 20, further comprising computer-executable instructions for:

determining if the passive socket is open or closed; and

allowing further communication directed to the passive socket if the socket is open.

23. The computer readable medium of claim 20, further comprising computer-executable instructions for:

determining whether the passive socket is open or closed; and

automatically revoking the request to the firewall to permit flows directed to the passive socket if the passive socket is closed.

24. A processor for use in a mobile device to execute instructions for dynamically updating a firewall policy, the instructions comprising:

detecting at least one firewall;

communicating with the at least one firewall; and

dynamically updating a policy associated with the at least one firewall.

25. The processor of claim 24, the instructions further comprising:

automatically revoking the policy at substantially the same time as a session is broken.

26. A handset that dynamically configures a firewall, comprising:

an initializer that establishes a session with a firewall;

a designator that designates at least one flow and communicates the at least one flow to a firewall; and

an invalidator that can revoke transit of the least one flow.

27. The handset of claim 26, the designator specifies a parameter associated with at least one packet.

28. The handset of claim 27, the parameter comprising one of an exact value, a value list, a value range, and an open socket.

29. The handset of claim 27, the invalidator revokes transit of the at least one packet.

30. The handset of claim 26, the designator requests a packet from one or more senders.

31. The handset of claim 30, the invalidator rescinds the request for a packet from the one or more senders.

32. The handset of claim 26, the invalidator revokes the transit automatically based on at least one packet parameter.

33. The handset of claim 26, the invalidator revokes the transit based on a user input.