Firewall system for protecting network elements connected to a public network

• US 6,061,798 A
• Filed: 10/19/1998
• Issued: 05/09/2000
• Est. Priority Date: 02/06/1996
• Status: Expired due to Term

• Current Assignee: Network Engineering Software, Inc. (Hopto Inc.)
• Original Assignee: Network Engineering Software, Inc. (Hopto Inc.)
• Inventors: Coley, Christopher D., Wesinger, Jr., Ralph E.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): ELMORE, STEPHEN C
• Application Number:
  US09/174,723
• Time in Patent Office: 568 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/200.55, 395/200.59, 395/726, 713/200, 713/201, 713/202, 340/825.31, 340/825.34, 364/222.5, 364/286.4, 364/286.5, 364/479.07, 380/3, 380/4, 380/24, 380/25, 380/30, 380/48
• US Class Current: 726/12
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A firewall for isolating network elements from a publicly accessible network to which such network elements are attached. The firewall operates on a stand alone computer connected between the public network and the network elements to be protected such that all access to the protected network elements must go through the firewall. The firewall application running on the stand alone computer is preferably the only application running on that machine. The application includes a variety of proxy agents that are specifically assigned to an incoming request in accordance with the service protocol (i.e., port number) indicated in the incoming access request. An assigned proxy agent verifies the authority of an incoming request to access a network element indicated in the request. Once verified, the proxy agent completes the connection to the protected network element on behalf of the source of the incoming request.

Claims

1. A firewall system for protecting network elements comprising:

a computing platform having a microprocessor and memory storage, wherein said computing platform provides access from a network connection to at least one network element, wherein said memory contains instructions causing said microprocessor to perform the steps of;

initializing a plurality of proxy agents, wherein each of said proxy agents is assigned a corresponding port number and protocol;

verifying that incoming connection requests are formatted in accordance with said corresponding protocol;

logging information associated with incoming connection requests; and

,

processing received packets to determine the presence of executable commands nested within received packets, and if detected, discarding said received packets.