System And Method For Providing Network And Computer Firewall Protection With Dynamic Address Isolation To A Device

• US 20090126003A1
• Filed: 05/30/2008
• Published: 05/14/2009
• Est. Priority Date: 05/30/2007
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: Yoggie Security Systems, Ltd. (CUPP Computing AS)
• Inventors: Touboul, Shlomo
• Granted Patent: US 8,365,272 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer performs dynamic address isolation. The computer comprises an application associated with an application address, a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network, a network address translation engine configured to translate between the application address and a public address, and a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address. The computer may communicate with a firewall configured to handle both network-level security and application-level security.

Claims

1. A computer comprising:

an application associated with an application address;

a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network;

a network address translation engine configured to translate between the application address and a public address; and

a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address.

2. The computer of claim 1, wherein the network address translation engine is part of the driver.

3. The computer of claim 1, wherein the network address translation engine is part of a firewall.

4. The computer of claim 3, wherein the firewall is located on a mobile security system.

5. The computer of claim 1, wherein the network address translation engine is configured to use Dynamic Host Configuration Protocol.

6. The computer of claim 1, wherein the computer is configured to send data packets identifying the application to a firewall, and the firewall is configured to handle both network-level security and application-level security.

7. A system comprising:

a network interface;

a firewall in communication with the network interface configured to handle both network-level security and application-level security; and

a computer in communication with the firewall, having one or more applications, and being configured to send data packets identifying the one or more applications to the firewall.

8. The system of claim 7, wherein:

each data packet is associated with one of the one or more applications; and

each data packet comprises data identifying the application associated with the data packet.

9. The system of claim 8, wherein the firewall is configured to use the data identifying the application associated with the data packet to handle application-level security, to create a data packet subset by removing the data identifying the application from the data packet, and to send the data packet subset to an external network.

10. The system of claim 7, wherein the network interface is configured to receive incoming data from an external network, and to route the incoming data to the firewall.

11. The system of claim 7, wherein:

each application is associated with at least one address; and

the firewall is configured to dynamically isolate the address from an external network.

12. The system of claim 11, wherein the firewall is configured to dynamically isolate the address from the external network through the use of Dynamic Host Configuration Protocol.

13. A method within a personal computer of processing incoming data associated with a public address, the method comprising:

receiving the data from an external network;

translating the public address into an internal address associated with an application;

analyzing the data for malicious code; and

routing the data to the application if the data does not comprise malicious code.

14. The method of claim 13, wherein the analyzing step comprises analyzing the data for malicious code at both the network level and the application level.

15. The method of claim 13, wherein the translating step uses Dynamic Host Configuration Protocol.

16. A method within a computer of processing outgoing data, the method comprising:

receiving outgoing data from an application, the application being associated with an internal address;

translating the internal address into a public address; and

routing at least a subset of the outgoing data to an external network using the public address, thereby dynamically isolating the internal address from the external network.

17. The method of claim 16, wherein the translating step uses Dynamic Host Configuration Protocol.

18. The method of claim 16, further comprising:

configuring the outgoing data into one or more data packets;

associating each of the one or more data packets with the application; and

embedding application-identifying data in each of the one or more data packets.

19. The method of claim 18,

further comprising creating one or more data packet subsets by removing the application-identifying data from each of the one or more data packets,

wherein the routing step comprises routing the one or more data packet subsets to the external network.