Integrated firewall, IPS, and virus scanner system and method

• US 8,555,389 B2
• Filed: 08/08/2011
• Issued: 10/08/2013
• Est. Priority Date: 01/10/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Haeffele, Steven M., Gupta, Ramesh M., Raman, Ananth, Vissamsetti, Srikant
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US13/205,444
• Publication Number:
  US 20110296516A1
• Time in Patent Office: 792 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method and computer program product are provided including a router and a security sub-system coupled to the router. Such security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), and a plurality of virtual virus scanners. Further, each of the virtual firewalls, IPSs, and virus scanners is assigned to at least one of a plurality of user and is configured in a user-specific.

Claims

1. A method, comprising:

processing content received at a router with a security sub-system, wherein the security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), a plurality of virtual virus scanners, and a plurality of content filtering modules, wherein each of the virtual firewalls, IPSs, virus scanners, and content filtering modules are assigned to at least one of a plurality of users;

exchanging state information with a different security sub-system on a different router to support a failover, the state information including an active status or a standby status per port;

renegotiating a respective status of each security sub-system component for a port if the exchange state information indicates that both the security sub-system component and the different security sub-system are active for the port; and

prohibiting certain details associated with policies applied above a user'"'"'s domain from being displayed to a particular one of the users, wherein the policies relate to the virtual firewalls, IPSs, virus scanners, and content filtering modules.

2. The method as recited in claim 1, further comprising:

creating a profile to be used in the plurality of content filtering modules to block categories of content, wherein once the profile is assigned to the particular user, the uniform resource locators assigned to the profile are blocked from the user.

3. The method as recited in claim 1, wherein the virtual firewalls, IPSs, virus scanners, and content filtering modules are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

4. The method as recited in claim 1, wherein the security sub-system further includes a plurality of anti-spam modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

5. The method as recited in claim 1, wherein the security sub-system further includes a plurality of virtual private network (VPN) modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

6. The method as recited in claim 1, wherein the security sub-system further includes a plurality of spyware filtering modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

7. The method as recited in claim 1, wherein the security sub-system further includes a plurality of adware filtering modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

8. Logic encoded in non-transitory media that includes code for execution and when executed by a processor operable to perform operations comprising:

processing content received at a router with a security sub-system component of the router, wherein the security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), a plurality of virtual virus scanners, and a plurality of content filtering modules, wherein each of the virtual firewalls, IPSs, virus scanners, and content filtering modules are assigned to at least one of a plurality of users; and

exchanging state information with a different security sub-system on a different router to support a failover, the state information including an active status or a standby status per port;

renegotiating a respective status of each security sub-system component for a port if the exchange state information indicates that both the security sub-system component and the different security sub-system are active for the port; and

prohibiting certain details associated with policies applied above a user'"'"'s domain from being displayed to a particular one of the users, wherein the policies relate to the virtual firewalls, IPSs, virus scanners, and content filtering modules.

9. The logic of claim 8, the operations further comprising:

creating a profile to be used in the plurality of content filtering modules to block categories of content, wherein once the profile is assigned to the particular user, the uniform resource locators assigned to the profile are blocked from the user.

10. The logic of claim 8, wherein the virtual firewalls, IPSs, virus scanners, and content filtering modules are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

11. The logic of claim 8, wherein the security sub-system further includes a plurality of anti-spam modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

12. The logic of claim 8, wherein the security sub-system further includes a plurality of virtual private network (VPN) modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

13. The logic of claim 8, wherein the security sub-system further includes a plurality of spyware filtering modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

14. The logic of claim 8, wherein the security sub-system further includes a plurality of adware filtering modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

15. An apparatus, comprising:

a memory element;

a processor coupled to the memory element; and

an analyzer module configured to interface with the processor such that the apparatus is configured for;

processing content received at a router with a security sub-system component of the router, wherein the security sub-system includes a plurality of virtual firewalls, a plurality of virtual intrusion prevention systems (IPSs), a plurality of virtual virus scanners, and a plurality of content filtering modules, wherein each of the virtual firewalls, IPSs, virus scanners, and content filtering modules are assigned to at least one of a plurality of users; and

exchanging state information with a different security sub-system on a different router to support a failover, the state information including an active status or a standby status per port;

renegotiating a respective status of each security sub-system component for a port if the exchange state information indicates that both the security sub-system component and the different security sub-system are active for the port; and

prohibiting certain details associated with policies applied above a user'"'"'s domain from being displayed to a particular one of the users, wherein the policies relate to the virtual firewalls, IPSs, virus scanners, and content filtering modules.

16. The apparatus of claim 15, further comprising:

creating a profile to be used in the plurality of content filtering modules to block categories of content, wherein once the profile is assigned to the particular user, the uniform resource locators assigned to the profile are blocked from the user.

17. The apparatus of claim 15, wherein the virtual firewalls, IPSs, virus scanners, and content filtering modules are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

18. The apparatus of claim 15, wherein the security subsystem further includes a plurality of anti-spam modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

19. The apparatus of claim 15, wherein the security sub-system further includes a plurality of virtual private network (VPN) modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.

20. The apparatus of claim 15, wherein the security sub-system further includes a plurality of spyware filtering modules that are assigned to at least one of the plurality of the users and that are configured at a first level by an administrator and at a second level by the particular user, wherein the second level is more restrictive than the first level.