Computerized system and method for policy-based content filtering

• US 20070118893A1
• Filed: 11/22/2005
• Published: 05/24/2007
• Est. Priority Date: 11/22/2005
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Crawford, William
• Granted Patent: US 7,966,654 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Firewalls and other filtering gateways have become common security devices for improving computer network security. As more features and functionality are added to these devices they become quite complex to configure. By associating configuration schemes with firewall policies, configuration can be simplified without compromising flexibility. Administrators have more options to filter different traffic streams based on their type and sources. They also have increased flexibility to be able to filter traffic on a per user basis, through authentication mechanisms tied to various filtering options.

Claims

1. A computer-implemented method for processing network content, the method comprising:

a. receiving an incoming network connection, the incoming connection being characterized by a source network address, a destination network address and a network service protocol;

b. determining the network service protocol of the incoming network connection;

c. identifying a matching policy based on the source network address, the destination network address and the network service protocol;

d. retrieving one or more configuration scheme associated with the matching policy; and

e. processing network content associated with the incoming network connection based on the retrieved one or more configuration schemes.

2. The method of claim 1, wherein the network service protocol comprises at least one of a group consisting of HTTP, FTP, SMTP, POP3, IMAP, and SMB/CIFS.

3. The method of claim 1, wherein during the identifying, the matching policy is selected from a plurality of predefined policies.

4. The method of claim 3, wherein if the plurality of predefined policies does not contain the matching policy, a default policy is identified as the matching policy.

5. The method of claim 1, wherein during the retrieving, the one or more configuration scheme is selected from a plurality of predefined configuration schemes.

6. The method of claim 1, further comprising authenticating a user associated with the incoming connection and rejecting the incoming connection if the authentication is unsuccessful.

7. The method of claim 6, wherein the authenticated user is associated with one or more user groups.

8. The method of claim 7, wherein the retrieved configuration scheme is assigned to the one or more user groups.

9. The method of claim 6, wherein the retrieved configuration scheme is determined by the identity of the authenticated user.

10. A computer-readable medium embodying a configuration scheme for configuring a computerized firewall system to process network content associated with an incoming network connection, the configuration scheme comprising:

information on one or more communication protocols; and

one or more settings for each communication protocol;

wherein upon receiving the incoming network connection by the computerized firewall system, the one or more settings of the configuration scheme are applied to configure the computerized firewall system based on a source network address, a destination network address and a network service protocol associated with the incoming network connection.

11. The computer-readable medium of claim 10, wherein the one or more communication protocol comprises at least one of a group consisting of HTTP, FTP, SMTP, POP3, IMAP, and SMB/CIFS.

12. The computer-readable medium of claim 10, wherein the one or more settings comprise at least one of a group consisting of toggle switches, lists, text entries, selection boxes, radio buttons, and multioption selections.

13. The computer-readable medium of claim 10, wherein the one or more settings are configured using a Graphical User Interface (GUI).

14. The computer-readable medium of claim 10, wherein the one or more settings are configured using a Command Line Interface (CLI).

15. The computer-readable medium of claim 10, wherein the one or more settings are combined into one or more groups.

16. The computer-readable medium of claim 10, comprising additional configuration schemes.

17. The computer-readable medium of claim 10, wherein the configuration scheme is modifiable.

18. A computer-readable medium embodying a firewall policy for use in connection with a computerized firewall system, the firewall policy comprising:

at least one source network address;

at least one destination network address;

at least one service network protocol;

at least one configuration scheme identifier associating the firewall policy with a corresponding configuration scheme; and

information identifying an action to be taken when the policy is invoked;

wherein upon receiving the incoming network connection by the computerized firewall system, the firewall policy is invoked based on the at least one source network address, the at least one destination network address and the at least one network service protocol.

19. The computer-readable medium of claim 18, wherein the firewall policy further comprises information on at least one user group for authentication.

20. The computer-readable medium of claim 18, comprising additional firewall policies.

21. The computer-readable medium of claim 20, wherein the at least one configuration scheme identifier is assigned to one or more policies.

22. The computer-readable medium of claim 20, wherein each firewall policy has a different configuration scheme identifier.

23. The computer-readable medium of claim 18, wherein the firewall policy is modifiable.

24. The computer-readable medium of claim 18, wherein the at least one configuration scheme identifier comprises numeric information.

25. The computer-readable medium of claim 18, wherein the at least one configuration scheme identifier comprises character information.

26. The computer-readable medium of claim 18, wherein the at least one configuration scheme identifier comprises one or more binary bits.

27. A computer-readable medium embodying a configuration database for use in connection with a computerized firewall system, the configuration database comprising:

at least one configuration scheme; and

at least one firewall policy;

wherein the at least one firewall policy is linked to the at least one configuration scheme; and

wherein upon receiving an incoming network connection by the computerized firewall system, the computerized firewall system invokes the at least one firewall policy and applies the at least one configuration scheme.

28. The computer-readable medium of claim 27, wherein the configuration database further comprises policy settings for the at least one firewall policy.

29. The system as recited in claim 28, wherein the policy settings are capable of being configured using at least one of a group consisting of a Graphical User Interface (GUI) and Command Line Interface (CLI).

30. The computer-readable medium of claim 28, wherein the policy settings comprise at least one source network address, at least one destination network address and at least one network service protocol.

31. The computer-readable medium of claim 28, wherein the policy settings are accessible to a software executing within the computerized firewall system.

32. The computer-readable medium of claim 27, wherein the configuration database further comprises configuration scheme settings for the at least one firewall policy.

33. The computer-readable medium of claim 32, wherein the configuration scheme settings are capable of being configured using at least one of a group consisting of a Graphical User Interface (GUI) and Command Line Interface (CLI).

34. The computer-readable medium of claim 32, wherein the configuration scheme settings are accessible to a software executing within the computerized firewall system.

35. A firewall system for processing network content, the firewall system comprising:

a networking interface for receiving a network connection;

a networking subsystem;

a proxy subsystem supporting one or more network protocols; and

a configuration database for storing at least one firewall policy and at least one firewall configuration scheme;

wherein the networking subsystem re-directs the network connection to the proxy based on the at least one firewall policy and wherein the proxy subsystem processes the network content associated with the network connection based on the at least one firewall configuration scheme.

36. The firewall system of claim 35, wherein the proxy subsystem retrieves the at least one firewall configuration scheme from the configuration database.

37. The firewall system of claim 36, wherein the proxy subsystem retrieves the at least one firewall configuration scheme based on a configuration scheme identifier associated with a network session.

38. The firewall system of claim 37, wherein the configuration scheme identifier is assigned to the network session by the networking subsystem.

39. The firewall system of claim 35, wherein the processing of network content by the proxy subsystem comprises applying filters to the network content.

40. The firewall system of claim 35, comprising additional proxy subsystems, wherein multiple proxy subsystems support the one or more network protocols.

41. The firewall system of claim 35, wherein multiple instances of the proxy subsystem are used for each of the one or more network protocols

42. The firewall system of claim 35, wherein the proxy subsystem supports the entire communication language of the one or more network protocols.

43. The firewall system of claim 35, wherein the proxy subsystem supports at least a part of the communication language of the one or more network protocols.

44. The firewall system of claim 35, wherein the proxy subsystem comprises a cache storing the configuration settings of the at least one firewall configuration scheme.

45. The firewall system of claim 35, wherein the configuration database comprises an external database system.

46. The firewall system of claim 35, wherein the proxy subsystem utilizes an external program to retrieve and apply filters to the network content associated with a network session.