Network attached device with dedicated firewall security

• US 7,739,302 B2
• Filed: 09/11/2001
• Issued: 06/15/2010
• Est. Priority Date: 09/01/1998
• Status: Expired due to Fees

• Current Assignee: FireNet Technologies, LLC (IP Investments Group LLC)
• Original Assignee: Robust Networks LLC (Intellectual Ventures LLC)
• Inventors: Kenworthy, Stacy
• Primary Examiner(s): ALAM, SHAHID AL
• Application Number:
  US09/951,877
• Publication Number:
  US 20020049899A1
• Time in Patent Office: 3,199 Days
• Field of Search: 707 1- 2, 707 9- 10, 707100-102, 707/104.1, 709203-230, 709/319, 709215-225, 709/245, 709/328, 713200-202, 713145-155, 713165-166, 726 11- 15, 726/8, 726/1, 726/22, 726 27- 28, 726/2, 380/30, 370/230, 370/351, 370/394, 702/186, 702/122, 702/187
• US Class Current: 707/783
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Dedicated firewall security for a network attached device (NAD) is provided by a firewall management system integrated directly into the NAD or into a NAD server. A local area network arrangement includes a network client and the NAD and the firewall management system includes computer readable medium having computer-executable instructions that perform the steps of receiving a request for network access to the NAD from the network client, determining whether the request for network access to the NAD is authorized, and only if the request for network access is authorized, providing the network client with network access to the NAD.

Claims

1. A network arrangement comprising:

a network client and at least one network attached device (NAD) residing on a same network;

a NAD server disposed between the network client and the NAD, the NAD server being configured to electronically communicate with the NAD over a connection, the NAD server being further configured to receive request contained in a data packet for network access to the NAD, the NAD server including computer executable instructions that, upon execution, cause the NAD server to;

determine whether the header of a received data packet containing the request for network access includes at least one of an IP address of a network source, an IP address of a network destination, and a route of the data packet, the NAD being further configured to filter the data packet based at least on an IP address in a header of the data packet and to;

determine whether the received request for network access to the NAD is authorized; and

provide the network client with network access to the NAD only if the request for network access is authorized, such that the NAD is protected from unauthorized access requests from the network client and other devices in a manner that is in addition to any protection afforded by a firewall.

2. The network arrangement of claim 1, wherein the NAD server comprises a plurality of network protocol programs for accepting requests for network access to the NAD from a plurality of network clients having different operating systems.

3. The network arrangement of claim 1, wherein the computer-executable instructions comprise distributed program modules.

4. The network arrangement of claim 1, wherein the step of determining whether the request for network access to the NAD is authorized comprises determining whether information in the header of a received data packet containing the request for network access is complete, the information relating to at least one of the network source, destination, and route of the data packet.

5. A local area network arrangement comprising a network client and at least one network attached device (NAD) disposed in electronic communication with each other over a same network, the NAD comprising;

a data management component, and

an internal firewall management component, the internal firewall management component being configured to receive a plurality of requests for network access to the NAD from the network client and, for each of the plurality of requests, to determine, independently of a firewall external to the NAD,

whether the request for network access to the NAD is authorized,

wherein the data packet includes a header and wherein the internal firewall management component of the NAD is configured to determine whether each of the plurality of requests for network access to the NAD is authorized by filtering the data packet based at least on IP addresses contained in the header, and wherein the request for network access to the NAD is determined to be authorized by determining whether the header includes at least information relating to a network source, a destination, and a route of the data packet,

wherein the data management component is configured to provide the network client with access to the NAD only if the request for network access is determined to be authorized by the internal firewall management component, and

wherein at least some of the plurality of requests originate from within the network without passing through the firewall.

6. The network arrangement of claim 5, wherein the internal firewall management component is further configured to determine whether the header indicates that the data packet arrived via an authorized network interface.

7. The network arrangement of claim 5, wherein the internal firewall management component is further configured to determine whether the header contains a valid source address.

8. The network arrangement of claim 5, wherein the internal firewall management component is further configured to determine whether the header contains a valid destination address.

9. The network arrangement of claim 5, wherein the internal firewall management component is further configured to:

determine whether the header contains information identifying a proper port of the NAD;

pass the data packet to the proper port; and

at the proper port,

provide the requested network access to the NAD.

10. A system for managing access from outside of a network running a bastion firewall to at least one network attached device (NAD) operatively connected to the network, the apparatus comprising:

means for receiving at least one request for network access to the NAD and for determining whether the received at least one request for network access to the NAD should be authorized by determining whether the header of a received data packet containing the request for network access includes at least one of an IP address of a network source, an IP address of a network destination, and a route of the data packet, the NAD being further configured to filter the data packet based at least on an IP address in a header of the data packet; and

means for providing network access to the NAD when the at least one request is authorized and for denying network access to the NAD when the at least one request is unauthorized, wherein the at least one request originates one of within the network and external to the network and wherein at least one request passed into the network through a firewall.

11. The system of claim 10, wherein the apparatus includes a server coupled to the NAD and wherein network access to the NAD is only available through the server.

12. An apparatus, comprising:

a processing unit;

a network interface coupled to the processing unit and to a network;

an attached device interface coupled to the processing unit and configured to provide a communication path to a directly attached device; and

a memory coupled to the processing unit and storing instructions that, upon execution, cause the processing unit to;

determine whether requests for access to the directly attached device received from the network interface should be authorized or unauthorized wherein each of the requests for access to the directly attached device is contained in a packet and determine whether the header of a received data packet containing the request for network access includes at least one of an IP address of a network source, an IP address of a network destination, and a route of the data packet, the NAD being further configured to filter the data packet based at least on an IP address in a header of the data packet;

deny requests for access to the directly attached device that are determined to be unauthorized;

allow requests for access to the directly attached device that are determined to be authorized, wherein each of the requests originates one of within and external to the network and wherein at least one of the requests for access has passed into the network through a firewall.

13. The apparatus of claim 12 wherein the instructions, when executed, further cause the processing unit to determine whether each packet arrived via an authorized network interface.

14. The apparatus of claim 13, wherein the instructions, when executed, cause the processing unit to determine whether each packet contains an unauthorized IP address.

15. The apparatus of claim 13, wherein the instructions, when executed, enable the processing unit to selectively generate a packet for communication to an intermediary computing device, the selectively generated packet containing the request for access to the directly attached device.

16. The apparatus of claim 12, wherein the instructions, when executed, cause the processing unit to determine whether the requests contain information to gain access to a proper port over the directly attached device interface.

17. The apparatus of claim 12, wherein the denying and allowing of the requests for access to the directly attached device are performed at an application layer.

18. The apparatus of claim 12, wherein the apparatus is configured to operate in a heterogeneous network environment comprising a plurality of network protocols.

19. The apparatus of claim 18 wherein one of the plurality of network protocols is TCP/IP.

20. The apparatus of claim 12 wherein the directly attached device interface comprises a SCSI interface.

21. The apparatus of claim 12 wherein the directly attached device comprises at least one of a printer, a storage device, and a video codec.

22. An apparatus, comprising:

means for receiving requests over a network for access to a network attached device (NAD), the requests originating one of within the network and external thereto, at least one of the requests having passed into the network through a firewall;

means for filtering each of the requests for access to the NAD to prevent unauthorized access to the NAD wherein each of the requests includes a packet having a header and wherein the means for filtering comprises means for examining the header of a packet received in connection with the request to determine whether the header includes at least one of an IP address of a network source, an IP address of a network destination, and a route of the data packet, the NAD being further configured to filter the data packet based at least on an IP address in a header of the data packet; and

means for allowing access to the NAD for each request that the filtering means determines is authorized such that the NAD is protected from unauthorized access requests from network clients and other devices in a manner that is in addition to any protection afforded by a firewall.

23. The apparatus of claim 22 further comprising means for managing access to the NAD over a device interface if the request is allowed.

24. The apparatus of claim 23, wherein the managing means is further configured to manage access over a SCSI interface.

25. The apparatus of claim 22, further comprising means for selectively generating a new packet and for communicating the new packet to another device if the request is determined to be allowed.

26. The apparatus of claim 22, further comprising means for logging each request that is determined to be allowed.

27. The apparatus of claim 22, wherein the requests comprise one of a plurality of protocols.

28. The apparatus of claim 22, wherein the filtering means is further configured to carry out the filtering at an application layer of a network stack.

29. The apparatus of claim 22, wherein the NAD comprises at least one of a printer, a storage device, and a video codec.

30. The apparatus of claim 22, wherein the requests are directed to one of a plurality of network attached devices (NADs).