INTEGRATED FIREWALL, IPS, AND VIRUS SCANNER SYSTEM AND METHOD

• US 20110296527A1
• Filed: 08/08/2011
• Published: 12/01/2011
• Est. Priority Date: 01/10/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gupta, Ramesh M., Raman, Ananth, Vissamsetti, Srikant, Haeffele, Steven M.
• Granted Patent: US 8,640,237 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method and computer program product are provided including a router and a security sub-system coupled to the router. Such security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners. Further, each of the virtual firewalls, IPSs, and virus scanners is assigned to at least one of a plurality of user and is configured in a user-specific.

Claims

1-18. -18. (canceled)

19. A security system, comprising:

a pair of parallel security systems that include virtual redundancy router protocol (VRRP) routers, wherein each VRRP router includes a security sub-system, wherein the security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners, wherein each of the virtual firewalls, IPSs, and virus scanners are assigned to at least one of a plurality of users and are configured in a user-specific manner; and

a set of redundant switches coupled to the pair of parallel security systems.

20. The system as recited in claim 19, wherein at least one of the pair of parallel security systems further comprises:

an active interface for processing traffic received from a network; and

a standby interface.

21. The system as recited in claim 20, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein if at least one of the interfaces fail, traffic is routed to the standby security system.

22. The system as recited in claim 20, wherein the active interface and the standby interface are active and process traffic in an asymmetric way.

23. The system as recited in claim 20, wherein the active interface and the standby interface exchange state information to ensure existing active flows on a failed active interface may be processed on the standby interface.

24. The system as recited in claim 19, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein the active security system and the standby security system exchange state information to ensure existing active flows on a failed active security system may be processed on the standby security system.

25. The system as recited in claim 19, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein packets received by the standby security system are dropped.

26. A method, comprising:

assigning a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners in a security sub-system to at least one of a plurality of users, wherein a pair of parallel security systems includes virtual redundancy router protocol (VRRP) routers, and each VRRP router includes the security sub-system;

configuring the plurality of virtual firewalls, the plurality of virtual intrusion prevention systems (IPSs), and the plurality of virtual virus scanners in a user-specific manner; and

coupling a set of redundant switches to the pair of parallel security systems.

27. The method of claim 26, wherein at least one of the pair of parallel security systems further comprises:

an active interface for processing traffic received from a network; and

a standby interface.

28. The method of claim 27, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein if at least one of the interfaces fail, traffic is routed to the standby security system.

29. The method of claim 27, wherein the active interface and the standby interface are active and process traffic in an asymmetric way.

30. The method of claim 27, further comprising:

exchanging state information between the active interface and the standby interface to ensure existing active flows on a failed active interface may be processed on the standby interface.

31. The method of claim 26, further comprising:

wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein the active security system and the standby security system exchange state information to ensure existing active flows on a failed active security system may be processed on the standby security system.

32. The method of claim 26, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein packets received by the standby security system are dropped.

33. Logic encoded in non-transitory media that includes code for execution and when executed by a processor operable to perform operations comprising:

assigning a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners in a security sub-system to at least one of a plurality of users, wherein a pair of parallel security systems includes virtual redundancy router protocol (VRRP) routers, and each VRRP router includes the security sub-system;

configuring the plurality of virtual firewalls, the plurality of virtual intrusion prevention systems (IPSs), and the plurality of virtual virus scanners in a user-specific manner; and

coupling a set of redundant switches to the pair of parallel security systems.

34. The logic of claim 33, wherein at least one of the pair of parallel security systems further comprises:

an active interface for processing traffic received from a network; and

a standby interface.

35. The logic of claim 34, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein if at least one of the interfaces fail, traffic is routed to the standby security system.

36. The logic of claim 34, wherein the active interface and the standby interface are active and process traffic in an asymmetric way.

37. The logic of claim 34, further comprising:

exchanging state information between the active interface and the standby interface to ensure existing active flows on a failed active interface may be processed on the standby interface.

38. The logic of claim 33, wherein at least one of the security systems is an active security system and the other security system is a standby security system, and wherein the active security system and the standby security system exchange state information to ensure existing active flows on a failed active security system may be processed on the standby security system.