METHOD TO APPLY NETWORK ENCRYPTION TO FIREWALL DECISIONS

• US 20080256618A1
• Filed: 04/10/2007
• Published: 10/16/2008
• Est. Priority Date: 04/10/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: O'Connell, Brian Marshall, Hamilton, Rick Allen, Walker, Keith Raymond, Bansal, Ravi Prakash
• Granted Patent: US 8,695,081 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

A system and related methods for providing a handler for requests to access a wireless network, operable by or separate from an enhanced personal firewall system, which obtains connection-related information from the operating system, network interface drivers, or both, and then provides that information to a controller which determines to allow or deny access. By collecting certain connection-related information, new levels and granularities of control are allowed and enabled. The process is equally well suited for implementation by a wireless device which may be in range of multiple servers or networks, such that the device may allow different levels of access to the device by the different servers or networks according to the collected connection-related information.

Claims

1. A network access request handling system comprising:

a first handler portion configured to respond to a network access request from a requester device by collecting a network type and connection type between the requester and said first portion, to collect network connection sub-options if said network type is wireless or if any network security sub-options exist, and to transmit said collected information to a second handler portion; and

a second handler portion configured to receive said transmitted collected information, to parse said collected information, and to perform one or more access granting or denying decisions based on said parsed information.

2. The system as set forth in claim 1 wherein said first handler portion is configured to collect said information via queries to an Operating System.

3. The system as set forth in claim 1 wherein said first handler portion is configured to collect said information via queries to one or more network interface device drivers.

4. The system as set forth in claim 1 wherein said decisions comprise at least one decision selected from the group of controlling access to a virtual private network, controlling access to one or more internet protocol addresses, controlling access to one or more internet protocol ports, and shutting down one or more established connections which are using connections having security measures below an acceptable security threshold.

5. The system as set forth in claim 1 wherein said first and second portions are operable by or integral with a server.

6. The system as set forth in claim 5 wherein said server comprises a firewall server.

7. The system as set forth in claim 6 wherein said server comprises:

an inter-firewall connection listener configured to bind to a specified communications port, to listen for incoming, outgoing, or both incoming and outgoing firewall trust requests, and upon detection of a connection, to transfer firewall control to an inter-firewall controller; and

an inter-firewall controller configured to perform logical processes for establishing trusted communications through a local firewall and a remote firewall by performing one or both of the processes of;

(a) upon establishing an outgoing connection by an application program protected by a local firewall to a resource protected by a remote firewall, to;

(1) initiate and transmit a handshake identification request from a local firewall to a remote firewall;

(2) responsive to receipt of a handshake response from said remote firewall, to transmit a local firewall public encryption key to said remote firewall;

(3) responsive to receiving a host firewall public encryption key, to generate, sign, and transmit a trusted computer request with identification information to said remote firewall;

(4) upon receipt of a grant of trusted access from said remote firewall, to allow an application program from behind said local firewall to communicate to said remote firewall, otherwise to block said application program from communication with said remote firewall; and

(b) upon establishing an incoming connection by an application program protected by a remote firewall to a resource protected by a local firewall, to;

(1) transmit a firewall identification handshake response to said remote firewall upon receipt of a handshake identification request from said remote firewall;

(2) responsive to receipt of remote firewall public encryption key, transmitting a local firewall public encryption key to said remote firewall;

(3) responsive to receiving a signed trusted computer request from said remote firewall, if said remote firewall has previously requested a trusted access by checking a local public key store, using the signature of said trusted computer request using said received remote firewall public encryption key;

(4) responsive to determining that said remote firewall has been previously authorized to establish trusted access, modifying local firewall rules to allow data communications to and from one or more addresses associated with said remote firewall to be transceived through said local firewall.

8. The system as set forth in claim 5 wherein said server comprises a proxy server.

9. The system as set forth in claim 1 wherein said second portion is integral to or operable by said requester device.

10. An automated method for handling network access requests comprising:

by a first method portion;

responding to a network access request from a requester device by collecting a network type and connection type between the requester and said first portion, and

collecting network connection sub-options if said network type is wireless or if any network security sub-options exist, and to transmit said collected information to a second handler portion; and

by a second method portion;

receiving said transmitted collected information, to parse said collected information, and

performing one or more access granting or denying decisions based on said parsed information.

11. The method as set forth in claim 10 wherein collecting said information via queries to an Operating System is performed in said first method portion.

12. The method as set forth in claim 10 wherein collecting said information via queries to one or more network interface device drivers is performed in said first method portion.

13. The method as set forth in claim 10 wherein performing said access granting or denying decisions comprise at least one decision selected from the group of controlling access to a virtual private network, controlling access to one or more internet protocol addresses, controlling access to one or more internet protocol ports, and shutting down one or more established connections which are using connections having security measures below an acceptable security threshold.

14. The method as set forth in claim 10 wherein said first and second method portions are operable by or integral with a method for providing a computing server.

15. The method as set forth in claim 14 wherein said computer server method comprises a method for providing a firewall server.

16. The method as set forth in claim 15 wherein said method for providing a firewall server comprises:

binding a listener to a specified communications port;

listening by said listener for incoming, outgoing, or both incoming and outgoing firewall trust requests;

upon detection of a connection, performing logical processes for establishing trusted communications through a local firewall and a remote firewall by performing one or both of the processes of;

(a) upon establishing an outgoing connection by an application program protected by a local firewall to resource protected by a remote firewall;

(1) initiating and transmitting a handshake identification request from a local firewall to a remote firewall;

(2) responsive to receipt of a handshake response from said remote firewall, to transmitting a local firewall public encryption key to said remote firewall;

(3) responsive to receiving a host firewall public encryption key, to generating, signing, and transmitting a trusted computer request with identification information to said remote firewall;

(4) upon receipt of a grant of trusted access from said remote firewall, allowing an application program from behind said local firewall to communicate to said remote firewall, otherwise blocking said application program from communication with said remote firewall; and

(b) upon establishing an incoming connection by an application program protected by a remote firewall to a resource protected by a local firewall;

(1) transmit a firewall identification handshake response to said remote firewall upon receipt of a handshake identification request from said remote firewall;

(2) responsive to receipt of remote firewall public encryption key, transmitting a local firewall public encryption key to said remote firewall;

(3) responsive to receiving a signed trusted computer request from said remote firewall, if said remote firewall has previously requested a trusted access by checking a local public key store, using the signature of said trusted computer request using said received remote firewall public encryption key;

(4) responsive to determining that said remote firewall has been previously authorized to establish trusted access, modifying local firewall rules to allow data communications to and from one or more addresses associated with said remote firewall to be transceived through said local firewall.

17. The method as set forth in claim 14 wherein said method for providing a computing server comprises a method for providing a proxy server.

18. The method as set forth in claim 10 wherein said second method portion is integral to or operable by said requester device.

19. An article of manufacture comprising:

a computer readable medium suitable for storage of computer program code; and

computer program code stored by said medium, configured to automatically handle network access requests by performing the steps of;

responding by a first program code portion to a network access request from a requester device by collecting a network type and connection type between the requester and said first portion;

collecting network connection sub-options if said network type is wireless or if any network security sub-options exist, and to transmit said collected information to a second handler portion;

receiving by a second program code portion said transmitted collected information, to parse said collected information, and

performing one or more access granting or denying decisions based on said parsed information.