Automatically configuring a computer firewall based on network connection

• US 8,468,256 B1
• Filed: 07/02/2007
• Issued: 06/18/2013
• Est. Priority Date: 03/08/2001
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: McArdle, Mark J., Johnston, Brent A., Nathan, Philip D. R., Dool, James
• Primary Examiner(s): CHOUDHURY, AZIZUL Q
• Application Number:
  US11/772,759
• Time in Patent Office: 2,178 Days
• Field of Search: None
• US Class Current: 709/228
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method, system, and policy file data structure stored on computer-readable medium comprise reading a policy identifier field containing data representing an identifier for a security policy. Further, a protocol identifier field is read containing data representing an identifier for a protocol associated with the security policy identified in the policy identifier field. In addition, a protocol element entry containing data representing a protocol element for protocol identified by the protocol identifier field is associated with a network adapter.

Claims

1. A policy file data structure stored in a memory of a computer that includes a processor, and a network adapter, the policy file data structure which is read by the processor, comprises:

a policy identifier field containing data representing an identifier for a security policy that is associated with the network adapter and a network address zone;

a protocol identifier field containing data representing an identifier for a protocol associated with the security policy identified in the policy identifier field;

a protocol element entry containing data representing a protocol element for the protocol identified by the protocol identifier field, wherein the protocol element entry is associated with port filtering, and the security policy specifies filters for services related to the protocol associated with the security policy, wherein the protocol element entry comprises;

an element identifier field containing data representing an identifier for the protocol element field;

a setting field containing data representing a filter setting for the protocol element identified by the element identifier field; and

a log indicator field containing data representing a decision on logging data utilizing the protocol element identified by the element identifier field; and

a zone identifier field associated with restricting communications for the network address zone, wherein connecting to a network causes the computer to read the data structure and configure itself according to the security policy that is associated with a particular network address of the network address zone.

2. The policy file data structure of claim 1, wherein the filter setting is chosen from at least one of allow, disallow, source address and destination address.

3. The policy file data structure of claim 1 further comprising:

an address parameters field containing data representing a set of network addresses that defines the zone identified by the zone identifier field; and

an assigned policy identifier containing data representing the identifier for the security zone assigned to the zone identified by the zone identifier field.

4. The policy file data structure of claim 3, wherein the address parameters field contains data representing at least one address within the zone.

5. The policy file data structure of claim 3, wherein the address parameters field contains data representing at least one address outside the zone.

6. A method for managing network communications for a computer that includes a processor, a memory, and a network adapter, comprising:

reading a policy identifier field containing data representing an identifier for a security policy that is associated with the network adapter and a network address zone;

reading a protocol identifier field containing data representing an identifier for a protocol associated with the security policy identified in the policy identifier field;

associating a protocol element entry containing data representing a protocol element for the protocol identified by the protocol identifier field with the network adapter, wherein the protocol element entry is associated with port filtering, and the security policy specifies filters for services related to the protocol associated with the security policy, wherein the protocol element entry comprises;

an element identifier field containing data representing an identifier for the protocol element field;

a setting field containing data representing a filter setting for the protocol element identified by the element identifier field; and

a log indicator field containing data representing a decision on logging data utilizing the protocol element identified by the element identifier field; and

reading a zone identifier field associated with restricting communications for the network address zone, wherein connecting to a network causes the computer to configure itself according to the security policy that is associated with a particular network address of the network address zone.

7. The method of claim 6, wherein the protocol element entry comprises:

a setting field containing data representing a filter setting for the protocol element identified by the element identifier field.

8. The method of claim 7, wherein the filter setting is chosen from at least one of allow, disallow, source address and destination address.

9. The method of claim 6 further comprising:

reading an address parameters field containing data representing a set of network addresses that defines the zone identified by the zone identifier field; and

reading an assigned policy identifier containing data representing the identifier for the security zone assigned to the zone identified by the zone identifier field.

10. A system comprising:

a processor, a memory, and a network adapter, the system being executed to;

read a policy identifier field containing data representing an identifier for a security policy that is associated with the network adapter and a network address zone;

read a protocol identifier field containing data representing an identifier for a protocol associated with the security policy identified in the policy identifier field;

associate a protocol element entry containing data representing a protocol element for the protocol identified by the protocol identifier field with the network adapter, wherein the protocol element entry is associated with port filtering, and the security policy specifies filters for services related to the protocol associated with the security policy, wherein the protocol element entry comprises;

an element identifier field containing data representing an identifier for the protocol element field;

a setting field containing data representing a filter setting for the protocol element identified by the element identifier field; and

a log indicator field containing data representing a decision on logging data utilizing the protocol element identified by the element identifier field; and

read a zone identifier field associated with restricting communications for the network address zone, wherein connecting to a network causes the computer to read and configure itself according to the security policy that is associated with a particular network address of the network address zone.

11. The system of claim 10, wherein the protocol element entry comprises:

a setting field containing data representing a filter setting for the protocol element identified by the element identifier field.

12. The system of claim 11, wherein the filter setting is chosen from at least one of allow, disallow, source address and destination address.