CA2401577C - System, device and method for rapid packet filtering and processing - Google Patents
System, device and method for rapid packet filtering and processing Download PDFInfo
- Publication number
- CA2401577C CA2401577C CA002401577A CA2401577A CA2401577C CA 2401577 C CA2401577 C CA 2401577C CA 002401577 A CA002401577 A CA 002401577A CA 2401577 A CA2401577 A CA 2401577A CA 2401577 C CA2401577 C CA 2401577C
- Authority
- CA
- Canada
- Prior art keywords
- packet
- firewall
- permitted
- connection
- filtering module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/02—Details
- H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0254—Stateful filtering
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
Abstract
A method, device, and system for packet filtration (fig. 1) by supplementing a firewall (18) with a pre-filtering module (30). The pre-filtering module (30) performs a limited set of actions with regard to the packets according to whether the packets are received from a particular connection, otherwise, the packets are forwarded to the firewall (18) for handling.
Description
SY STEIvi, DEVICE AND METHOD FOR RAPID PACKET FILTERTNG
AND PROCESSING
FIELD AND BACKGROUND OF THE INVENTTON
The present invention is of a system, a device and method for rapid packet filtering on a packet-switched netrivork, and in particular, to such a system, a device and method in which the efficiency of packet filtration is increased by session-based filtering.
Connectivity and security are rivo conflicting objectives in the .10 computing environment of most organizations. The typical modern computing sysiem is built around network communications, supplying transparent access to a multitude of services. The global availability of these services is perhaps the single most important feature of moderncomputing solutions. Demand for connectivity comes both from within organizations and from outside them.
Protecting nehvork services from unauthorized usage is of paramount rmportance to any organization. As the need for increased security grows, the means of controlling access to network resources has become an administrative priority. In order to save cost and maintain productivity, access control must be simple to configure and transparent to users and applications. The minimization of setup costs and down time are also important factors.
Packet filtering is a method which allows connectivity yet provides security by controlling the traffic being passed, thus preventing illegal communication attempts, both within single networks and behveen connected nelhvorks.
U.S. Patent Nos. 5,835,726 (filed on June 17, 1996) and 5,606,668 (filed on December 15, 1993) describe methods for providing network security by controlling the inbound and outbound data packet flow in a computer network. The flow of packets is controlled through packet filtering, performed according to a user-generated rule base which is then converted into a set of filter language instructions. Each rule in the rule base includes a source, destination, service, whether to accept or reject the packet and whether to log, encrypt and/or authenticate the event. The set of filter language instructions are installed and execute on inspection engines which are placed on computers acting as firewalls. The inspection engines perform stateful inspection in order to determine whether a packet should be permitted to enter through the firewall.
The firewalls are positioned in the computer network such that all traffic to and from the network to be protected is forced to pass through the firewall. Thus, packets are filtered as they flow into and out of the network in accordance with the rules comprising the rule base.
According to these references, the inspection engine acts as a virtual packet filtering machine which determines on a packet by packet basis whether to reject or accept a packet. If a packet is rejected, it is dropped. If it is accepted, the packet may then be modified. Modification may include encryption, decryption, signature generation, signature verification or address translation. All modifications are performed in accordance with the contents of the rule base.
Unfortunately, one drawback of the disclosed method is that a large computational burden is placed upon the computer which operates the firewall.
The previously disclosed processes of packet filtration require each packet to be separately analyzed, with many different comparisons to the set of rules according to which packet entry through the firewall is determined. However, once a session, or connection between two nodes which is established through the firewall, has been validated as permitted, then in most cases, further intensive analysis may not be necessary. Thus, reducing or even eliminating the requirement for continued analysis of packets from a permitted connection would significantly reduce the computational burden imposed by a firewall and accelerate the process of packet filtering, while still maintaining the security of the protected system.
There is thus a need for, and it would be useful to have, a system, a device and a method for rapid packet filtration according to the connection from which a packet is received, such that if a packet is received from a permitted connection, the requirement for complete packet analysis is reduced or even eliminated, while the ability to rapidly and efficiently modify packets is still maintained, optionally through hardware acceleration of the modification process.
SUMMARY OF THE INVENTION
The present invention is of a system, a device, and a method for accelerating packet filtration on a packet-switched network, preferably an IP
network, by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a limited set of actions with regard to the packets, according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or "off-loaded" the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with a particular session-control field value which indicates that the session is finished, such that the connection is closed.
For example, for the preferred implementation of the present invention with IP networks, such a session-control field value is a FIN/RST flag which is set for the packet.
One advantage of reducing or even eliminating the amount of analysis which is required for packets from a permitted connection is that the firewall can optionally be supplemented by hardware acceleration. Such hardware acceleration has the advantage of being much more rapid than software-based packet processing, and can therefore significantly increase the efficiency of the firewall system. In addition, hardware acceleration of the modification process can maintain the ability to rapidly and efficiently modify packets, since the modification process requires less "intelligence" for modifying the packets but faster processing, while the opposite characteristics are true for the process of packet analysis. Thus, optionally and preferably, the pre-filtering module is implemented as hardware.
According to the present invention, there is provided a system for accelerated packet filtering, the system comprising: (a) a source node for transmitting a packet; (b) a destination node for receiving the packet; (c) a firewall interposed between the source node and the destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module being in communication with the firewall, for receiving at least one instruction from the firewall and for receiving the packet before the firewall, such that if the packet is permitted according to the at least one instruction, the pre-filtering module handles the packet, and alternatively the pre-filtering module forwards the packet to the firewall for handling.
According to another embodiment of the present invention, there is provided a system for accelerated filtering of a packet on a network, the system comprising: (a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module located on the network and in communication with the firewall, for receiving at least one instruction from the firewall, the at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before the firewall, such that if the packet is permitted according to the simple comparison, the pre-filtering module at least transmits the packet on the network.
According to yet another embodiment of the present invention, there is provided, for use in a system for accelerated packet filtration, the system featuring a network for transmitting a packet and a firewall on the network for filtering the packet, a device for receiving the packet before the firewall, the device comprising: (a) a memory for storing at least one instruction for analyzing at least one parameter of the packet from the firewall, the at least one instruction including the at least one parameter for identifying the packet;
and 5 (b) a classification engine for analyzing at least a portion of the packet and for comparing the at least a portion of the packet to the at least one parameter according to the at least one instruction.
According to still another embodiment of the present invention, there is provided a method for accelerated packet filtering on a network in conjunction with a firewall, the method comprising the steps of: (a) providing a pre-filtering module for receiving a packet before the firewall; (b) receiving the packet by the pre-filtering module; (c) determining whether the packet is permitted; and (d) if the packet is permitted, handling the packet by the pre-filtering module.
Hereinafter, the term "network" includes a connection between any two or more computational devices which permits the transmission of data.
Hereinafter, the term "computational device" includes, but is not limited to, personal computers (PC) having an operating system such as WindowsTM, or Linux; MacintoshT"" computers; computers having JAVATM-OS as the operating system; workstations such as the computers of Sun MicrosystemsT"" and Silicon GraphicsTM, and other computers having some version of the UNIX operating system such as AIXTM or SOLARISTM of Sun MicrosystemsTM; any other known and available operating system; any type of computer; any device which can be connected to a packet switched network and which has an operating system, including but not limited to VxWorksTM and PSOST"'; or any device which can be so connected to a packet switched network, which is capable of transmitting and receiving packets, and which has at least a data processor, such as a network processor for example, including but not limited to, a bridge, a switch or a router. Hereinafter, the term "WindowsTM" includes but is not limited to Windows NTTM, Windows98TM, Windows2000TM, Windows CET"~ and any upgraded versions of these operating systems by Microsoft Corp. (USA).
The method of the present invention could be described as a series of steps performed by a data processor, and as such could optionally be implemented as software, hardware or firmware, or a combination thereof. For the present invention, a software application could be written in substantially any suitable programming language, which could easily be selected by one of ordinary skill in the art. The programming language chosen should be compatible with the computational device according to which the software application is executed. Examples of suitable programming languages include, but are not limited to, C, C++ and Java.
BRIEF DESCRIPTION OF THE DRAWINGS
The foregoing and other objects, aspects and advantages will be better understood from the following detailed description of a preferred embodiment of the invention with reference to the drawings, wherein:
FIG. 1 is a schematic block diagram of a system according to the present invention;
FIG. 2 is a schematic block diagram of an exemplary but preferred embodiment of the pre-filtering module of Figure 1 according to the present invention; and FIG. 3 is a flowchart of an exemplary method according to the present invention.
DETAILED DESCRIPTION OF THE INVENTION
The present invention is of a system, a device and a method for accelerating packet filtration by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a simple comparison with regard to the packets, for example according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. In addition, preferably packets are forwarded to the firewall for handling if these packets have particular session-control field values which require intervention by the firewall. For example, for the preferred implementation of the present invention with IP networks, and in particular with TCP/IP traffic, such session-control field values include a set SYN/FIN/RST flag for the packet. Such session-control field values are indicative of packets which carry information about the connection state, and are therefore important for the firewall to receive and analyze, in order to determine the state of the connection. Optionally, fragment packets are also forwarded to the firewall if the pre-filtering module is not able to perform certain functions, such as virtual defragmentation for the preferred embodiment of the present invention with IP networks, and in particular with IP traffic.
Once the firewall has determined that a connection is permitted, or has otherwise determined at least one parameter for performing the simple comparison, the firewall preferably sends a message to the pre-filtering module with the details of the new permitted packets. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or "off-loaded" the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with particular session-control field values indicating that the session is finished, for example by having the FIN/RST flag set for the preferred implementation with IP networks, such that the connection is closed. A
"timeout" occurs if a packet has not been received by the firewall for a predefined period of time.
The pre-filtering module is preferably implemented as hardware, in order to take advantage of hardware acceleration. Such hardware acceleration has the advantage of being much more rapid than software-based packet processing. Therefore, the pre-filtering module is preferably implemented as a hardware-based device, although the pre-filtering module could alternatively be implemented as software or firmware. Optionally, the pre-filtering module and the firewall could be implemented as a combined device, which could be a "black box" added to, or alternatively as a replacement for, the gateway node of a network, for ease of installation and operation.
The principles and operation of a system, a device and a method according to the present invention may be better understood with reference to the drawings and the accompanying description, it being understood that these drawings are given for illustrative purposes only and are not meant to be limiting. Although the following description centers around IP networks, and in particular around TCP/IP packet traffic, it is understood that this is for the purposes of illustration only and is not intended to be limiting in any way.
Referring now to the drawings, Figure 1 is a schematic block diagram of a system according to the present invention. A system 10 features a protected network 12, which is a packet-switched network, such that data is transmitted in the form of packets. Protected network 12 is separated from an external packet-switched network 14 by a gateway 16, which could optionally be any type of computational device, also termed herein an "intermediate node".
External network 14 could optionally be the Internet, for example. Gateway 16 is connected to each of external network 14 and protected network 12 through a hardware connector, shown herein as a NIC 17.
Gateway 16 operates a firewall 18 for performing packet analysis and packet filtering. Packets which are permitted to pass through gateway 16 from external network 14 are then received by one of a plurality of protected nodes 20, which are connected to protected network 12. Such network traffic is typically bi-directional, such that packets are received by gateway 16 from protected network 12 for transmission to external network 14 and vice versa.
Firewall 18 is preferably implemented as previously described in U.S.
Patent Nos. 5,835,726 and 5,606,668. Firewall 18 features a packet filter 22 for performing packet filtration. Packet filter 22 in turn is preferably composed of an analysis module 24 for analyzing packets and a rule base 26. Rule base 26 preferably contains one or more rules which are defined according to the preferences of the system administrator or other controlling user. Analysis module 24 extracts and compares the contents of the analyzed packets to the rules in rule base 26. If the result of the comparison is such that the packet is permitted according to rule base 26, then packet filter 22 permits the packet to enter protected network 12.
Alternatively, if the packet is not permitted according to rule base 26, then the packet is optionally dropped. The packet may also optionally be determined to be not permitted if rule base 26 does not specifically allow the packet to be passed.
Also optionally and preferably, packet filter 22 features a modification module 28 for modifying the packet, if the packet is accepted.
Other optional features of firewall 18 include an ability to perform accounting for the packets, in order to determine the amount of data being transferred on all packets which belong to a specific connection; the ability to modify address(es) within the packet; and the ability to encrypt the packets.
Packet encryption in particular has been previously described in U.S. Patent No. 5,835,726. Briefly, packets can optionally be encrypted for transmission between two firewalls 18, such that the packets are encrypted for passing through external network 14. Encryption is also optionally used for communication between firewall 18 and a node from external network 14, for example. The encrypted packets are then decrypted by the receiving firewall 18, and passed to protected network 12. Thus, the processes of encryption and transmission are automated, and can be performed in a manner which is transparent to the communicating software.
These features of firewall 18 are preferably implemented as previously described in U.S. Patent Nos. 5,835,726 and 5,606,668. However, passing all packets through firewall 18 before they are allowed to enter gateway 16 places a large computational burden on firewall 18. Therefore, according to the present invention, gateway 16 also features a pre-filtering module 30 which receives the packets before firewall 18, but which is preferably directly connected to protected network 12. Pre-filtering module 30 also preferably receives instructions from firewall 18, concerning packets which are permitted 5 to enter protected network 12. These instructions are more preferably determined by firewall 18 from an analysis of one or more previously received and related packets, such that if a previously received and related packet has been permitted to enter protected network 12, then the current packet should also be permitted to enter protected network 12. Thus, if pre-filtering module 10 30 determines that the current packet is permitted to enter, then preferably pre-filtering module 30 passes the packet directly through to protected network 12.
In order to increase the efficiency of operation of pre-filtering module 30, preferably pre-filtering module 30 can only perform restricted analysis of each packet. Specifically, more preferably only a portion of each packet is analyzed by pre-filtering module 30. Most preferably, pre-filtering module 30 analyzes each packet only with regard to a simple comparison. By "simple comparison", it is meant that the information is extracted in the form of one or more predefined parameters which are compared to a predefined pattern of such parameters.
In a particularly preferred example of a simple comparison, the packet is only analyzed until pre-filtering module 30 is able to determine whether the packet has been received from a permitted data transmission. Such a permitted transmission may be termed a connection, between a source node which initiates the connection, for example from external network 14, to a destination node which accepts the connection, for example a protected node 20. It is understood that once the connection has been established, communication between the source node and destination may optionally be bi-directional.
With regard to packet analysis, a "connection" is defined according to at least one, and preferably a plurality of, parameters which describe the data transmission to which the packet belongs. Examples of these parameters include but are not limited to, the source address and port of the packet; the destination address and port of the packet; the protocol of the packet and the interface from which the packet was received. The connection is used to classify the packet, and to determine whether the packet is permitted to enter to, or to leave from, protected network 12.
Firewall 18 defines each connection from an analysis of one or more previously received and examined packets. Firewall 18 inspects the contents of such packet or packets, and based upon the output of analysis module 24 with rulebase 26, determines whether packets from the corresponding connection should be permitted to enter and/or leave protected network 12. In addition, from the rules which are stored in rule base 26, analysis module 24 is able to determine one or more actions which should be associated with each connection. Examples of such actions include, but are not limited to, performing an accounting action in order to count the amount of data in the packet, encrypting/decrypting the packet, performing network address translation (NAT) by rewriting the address fields, and so forth. A preferred example for modifying the packet is to mark the packet, by assigning a priority number to the packet by pre-filtering module 30, according to the instructions of firewall 18. This priority number determines the order of transmission of the packet, and hence its "priority".
Firewall 18 then passes the relevant instructions concerning at least whether the packet is permitted to enter protected network 12, and more preferably, the actions which should be taken with subsequent packets from this connection, to pre-filtering module 30.
Optionally and preferably, pre-filtering module 30 performs an anti-spoofing method. Since pre-filtering module 30 may optionally be connected to a plurality of networks, packets can come from any one of these networks. The anti-spoofing method determines whether an IP packet, indicated as originating from a certain network, has indeed arrived from that network. As pre-filtering module 30 knows which network is connected to which interface, pre-filtering module 30 can determine whether a packet received from a particular interface is permitted.
The easiest way to implement the anti-spoofing method in an accelerator, such as pre-filtering module 30, is to include information regarding the network interface as part of the connection information which is available to pre-filtering module 30. Thus, if a packet comes from an allowed source node, is to be sent to an allowed destination, and has arrived through the expected interface, the packet can be processed by pre-filtering module 30.
Alternatively and optionally, even if only the interface is not correct, pre-filtering module 30 may determine that the packet represents a violation which should be further inspected by firewall 18 for validity. There are other ways to implement an anti-spoofing method, without including information concerning the interface as part of the stored instructions for pre-filtering module 30, which are also considered to be within the scope of the present invention.
In a preferred embodiment of pre-filtering module 30 which is shown in Figure 2, pre-filtering module 30 is embodied in hardware, or at the very least firmware, rather than purely as software. The advantage of hardware is that is is much faster than software for performing the required actions. The schematic block diagram of Figure 2 is a logic-based, rather than structural, illustration of the components of pre-filtering module 30. For example, the physical connections between components are not specified, and may be for example, a PCI bus on which all of the components are located. Optionally, the components may be connected with substantially any type of internal and/or external bus, for example.
For this implementation, pre-filtering module 30 may be described as a "device", preferably featuring a memory 36. Pre-filtering module 30 features a connection database 32 for storing the relevant instructions from firewall 18, which is stored in memory 36. Connection database 32 stores at least the parameter or parameters of the packet which are required to define the connection, but also preferably stores at least one action to be performed on packets from that connection.
Pre-filtering module 30 also preferably features a classification engine 38, including a data processor, for at least partially analyzing the information from the packet and for retrieving information from connection database 32.
Pre-filtering module 30 also preferably features a modifier 34, for performing the associated action or actions for packets from that connection, which is preferably stored in connection database 32 as previously described.
Pre-filtering module 30 also optionally and preferably communicates certain, selected information concerning at least one packet to firewall 18.
The selected information optionally includes at least one of, but is not limited to, the previously described parameters for analyzing the packet. The communication between pre-filtering module 30 and firewall 18 is optionally and preferably performed according to one of a number of embodiments. In a first embodiment, pre-filtering module 30 actively notifies firewall 18 upon the receipt of such information, in a state or event driven implementation.
Alternatively, in a second embodiment, firewall 18 queries pre-filtering module 30, in a polling implementation. For example, the polling may optionally be performed after a particular interval of time has passed, or alternatively according to a user query for such information, for example from a system administrator.
In addition, pre-filtering module 30 also preferably features at least one, and preferably a plurality of, network interfaces, shown as MAC (media access control) 40, which is hardware .for sending and receiving packets from the physical network (not shown). Pre-filtering module 30 more preferably features a firewall interface 42 for transferring packets to, and receiving packets from, the firewall (not shown).
The flow of operations is preferably as follows. Packets are optionally received from MAC 40, labeled "MAC one", which are then passed to classification engine 38. With the help of information and instructions retrieved from database 32 in memory 36, classification engine 38 then analyzes at least a portion of the information in each packet, and determines whether the packet is permitted. If the packet is permitted, then it is passed to modifier 34 for optional modification according to at least one instruction from the firewall (not shown), such that if modification is not necessary, then the at least one relevant instruction is not sent from the firewall.
The firewall may optionally determine an interface to which a packet should be sent, for example to a particular MAC 40. However, it should be noted that although the firewall may instruct pre-filtering module 30 for sending the packet to a particular interface, if routing is supported, then such.
routing would be used to route the packet, and not the instructions from the firewall (not shown).
Alternatively, the packet may be optionally and preferably forwarded to the firewall. Also alternatively, under certain circumstances as described in greater detail below, the packet may be dropped, particularly with regard to packets received from firewall interface 42, which are optionally similarly analyzed. In order to avoid dropping packets which may not be IP packets, optionally and preferably, information regarding one or more "default" packet types may be stored in database 32, such that if such information is not stored in database 32, the packet is defined as being "not permitted". One example of such a default packet type is an ARP (address resolution protocol) packet.
As can be seen with regard to the implementation of pre-filtering module 30 of Figure 2, packets may optionally arrive at pre-filtering module from an external source, such as MAC 40 for example, or alternatively may be received from firewall interface 42. If the packet is received from firewall interface 42, it may have been generated by the firewall itself, or alternatively may have been forwarded or generated by the IP stack of the host. Therefore, optionally and more preferably, for such packets which are received through firewall interface 42, pre-filtering module 30 is able to drop such packets if they are not permitted, rather than forwarding them to the firewall. Thus, the determination of whether to drop or forward packets by pre-filtering module 30 is optionally and preferably performed at least partially according to the interface through which the packets are received.
5 Of course, other implementations of pre-filtering module 30 are possible and are considered to be within the scope of the present invention .
Figure 3 is a flowchart of an exemplary method for operating the present invention. In step 1, a packet is received by the pre-filtering module. In step 2, at least one parameter of the packet is retrieved by the pre-filtering module.
In 10 step 3, the at least one parameter is used for examining the known connections, preferably by performing a look-up in a table of such known connections.
In step 4a, if an entry is found for the packet, then the action or actions defined for this connection are performed by the pre-filtering module. In step 5a, the packet is forwarded to its destination. Steps 4a and 5a are not 15 performed if the packet has certain session-control field values, such as a set SYN/FIN/RST flag for a packet transmitted over an IP network, in which case the packet is preferably forwarded to the firewall for handling. Such session-control field values are indicative of packets which carry information about the connection state, and are therefore important for the firewall to receive and analyze, in order to determine the state of the connection.
Optionally, fragmented packets are also forwarded to the firewall if the pre-filtering module is not able to perform certain functions, such as virtual defragmentation for the preferred embodiment of the present invention with IP
networks, and in particular with TCP/IP traffic. Virtual defragmentation is performed after an IP packet has become too large to be transmitted, and is therefore divided into a plurality of smaller packets, called fragments.
Virtual defragmentation is the process by which all of the received fragments are reassembled into the original big packet.
In order to prevent various sorts of attacks which may be attempted with fragments, preferably the pre-filtering module of the present invention, but alternatively the firewall, drops duplicate packet fragments. In other words, if a previously received fragment is received again, that fragment is dropped.
Turning again to the flowchart of Figure 3, alternatively, in step 4b, if an entry for the packet is not found in the table of connections, then the packet is forwarded to the firewall for handling. In step 5b, if the firewall determines that the connection to which the packet belongs is permitted, then the firewall optionally sends a message to the pre-filtering module with the necessary information concerning the new connection. Such a message preferably includes a key for identifying the new connection, information concerning address translation and optionally information concerning encryption, both of which are processes which involve the modification of the packet itself. The key for identifying the new connection preferably includes such information as the source IP address and port, the destination IP address and port, the protocol field and optionally the interface(s) from which a packet is expected to be received, for anti-spoofing protection. The address translation information includes the translated source IP address and port, the destination IP address and port.
According to preferred embodiments of the present invention, once the firewall has sent this message to the pre-filtering module, the connection is "offloaded" to the pre-filtering module, such that the firewall no longer receives any packets for this connection. Preferably, the firewall does not receive any further packets until a packet with certain session-control field values is received for this connection, indicating that the session is finished.
For example, for IP networks, such values include having a set FIN/RST flag.
More preferably, a timeout occurs when no packet has been received for a particular connection within a certain period of time. Since the firewall does not see any packets for the offloaded connection, the firewall queries the pre-filtering module about the last time that a packet was received for the connection. According to the received response, the firewall determines whether to keep or delete the connection. If the firewall deletes the connection, the connection is preferably deleted from the tables of the pre-filtering module.
According to other preferred embodiments of the present invention, the firewall receives updated accounting information from the pre-filtering module at regular intervals. This information is optionally and preferably pushed to the firewall by the pre-filtering module, rather than by having the firewall poll the pre-filtering module. The accounting information preferably includes the number of packets and of bytes which have been received by the pre-filtering module for a particular connection since the last time that the accounting information was updated, and the last time that a packet was received by the pre-filtering module for this particular connection. This information is then reset within the pre-filtering module. Optionally and more preferably, if the pre-filtering module deletes the connection, then the pre-filtering module pushes the last accounting information about this connection to the firewall.
It will be appreciated that the above descriptions are intended only to serve as examples, and that many other embodiments are possible within the spirit and the scope of the present invention.
AND PROCESSING
FIELD AND BACKGROUND OF THE INVENTTON
The present invention is of a system, a device and method for rapid packet filtering on a packet-switched netrivork, and in particular, to such a system, a device and method in which the efficiency of packet filtration is increased by session-based filtering.
Connectivity and security are rivo conflicting objectives in the .10 computing environment of most organizations. The typical modern computing sysiem is built around network communications, supplying transparent access to a multitude of services. The global availability of these services is perhaps the single most important feature of moderncomputing solutions. Demand for connectivity comes both from within organizations and from outside them.
Protecting nehvork services from unauthorized usage is of paramount rmportance to any organization. As the need for increased security grows, the means of controlling access to network resources has become an administrative priority. In order to save cost and maintain productivity, access control must be simple to configure and transparent to users and applications. The minimization of setup costs and down time are also important factors.
Packet filtering is a method which allows connectivity yet provides security by controlling the traffic being passed, thus preventing illegal communication attempts, both within single networks and behveen connected nelhvorks.
U.S. Patent Nos. 5,835,726 (filed on June 17, 1996) and 5,606,668 (filed on December 15, 1993) describe methods for providing network security by controlling the inbound and outbound data packet flow in a computer network. The flow of packets is controlled through packet filtering, performed according to a user-generated rule base which is then converted into a set of filter language instructions. Each rule in the rule base includes a source, destination, service, whether to accept or reject the packet and whether to log, encrypt and/or authenticate the event. The set of filter language instructions are installed and execute on inspection engines which are placed on computers acting as firewalls. The inspection engines perform stateful inspection in order to determine whether a packet should be permitted to enter through the firewall.
The firewalls are positioned in the computer network such that all traffic to and from the network to be protected is forced to pass through the firewall. Thus, packets are filtered as they flow into and out of the network in accordance with the rules comprising the rule base.
According to these references, the inspection engine acts as a virtual packet filtering machine which determines on a packet by packet basis whether to reject or accept a packet. If a packet is rejected, it is dropped. If it is accepted, the packet may then be modified. Modification may include encryption, decryption, signature generation, signature verification or address translation. All modifications are performed in accordance with the contents of the rule base.
Unfortunately, one drawback of the disclosed method is that a large computational burden is placed upon the computer which operates the firewall.
The previously disclosed processes of packet filtration require each packet to be separately analyzed, with many different comparisons to the set of rules according to which packet entry through the firewall is determined. However, once a session, or connection between two nodes which is established through the firewall, has been validated as permitted, then in most cases, further intensive analysis may not be necessary. Thus, reducing or even eliminating the requirement for continued analysis of packets from a permitted connection would significantly reduce the computational burden imposed by a firewall and accelerate the process of packet filtering, while still maintaining the security of the protected system.
There is thus a need for, and it would be useful to have, a system, a device and a method for rapid packet filtration according to the connection from which a packet is received, such that if a packet is received from a permitted connection, the requirement for complete packet analysis is reduced or even eliminated, while the ability to rapidly and efficiently modify packets is still maintained, optionally through hardware acceleration of the modification process.
SUMMARY OF THE INVENTION
The present invention is of a system, a device, and a method for accelerating packet filtration on a packet-switched network, preferably an IP
network, by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a limited set of actions with regard to the packets, according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or "off-loaded" the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with a particular session-control field value which indicates that the session is finished, such that the connection is closed.
For example, for the preferred implementation of the present invention with IP networks, such a session-control field value is a FIN/RST flag which is set for the packet.
One advantage of reducing or even eliminating the amount of analysis which is required for packets from a permitted connection is that the firewall can optionally be supplemented by hardware acceleration. Such hardware acceleration has the advantage of being much more rapid than software-based packet processing, and can therefore significantly increase the efficiency of the firewall system. In addition, hardware acceleration of the modification process can maintain the ability to rapidly and efficiently modify packets, since the modification process requires less "intelligence" for modifying the packets but faster processing, while the opposite characteristics are true for the process of packet analysis. Thus, optionally and preferably, the pre-filtering module is implemented as hardware.
According to the present invention, there is provided a system for accelerated packet filtering, the system comprising: (a) a source node for transmitting a packet; (b) a destination node for receiving the packet; (c) a firewall interposed between the source node and the destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module being in communication with the firewall, for receiving at least one instruction from the firewall and for receiving the packet before the firewall, such that if the packet is permitted according to the at least one instruction, the pre-filtering module handles the packet, and alternatively the pre-filtering module forwards the packet to the firewall for handling.
According to another embodiment of the present invention, there is provided a system for accelerated filtering of a packet on a network, the system comprising: (a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module located on the network and in communication with the firewall, for receiving at least one instruction from the firewall, the at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before the firewall, such that if the packet is permitted according to the simple comparison, the pre-filtering module at least transmits the packet on the network.
According to yet another embodiment of the present invention, there is provided, for use in a system for accelerated packet filtration, the system featuring a network for transmitting a packet and a firewall on the network for filtering the packet, a device for receiving the packet before the firewall, the device comprising: (a) a memory for storing at least one instruction for analyzing at least one parameter of the packet from the firewall, the at least one instruction including the at least one parameter for identifying the packet;
and 5 (b) a classification engine for analyzing at least a portion of the packet and for comparing the at least a portion of the packet to the at least one parameter according to the at least one instruction.
According to still another embodiment of the present invention, there is provided a method for accelerated packet filtering on a network in conjunction with a firewall, the method comprising the steps of: (a) providing a pre-filtering module for receiving a packet before the firewall; (b) receiving the packet by the pre-filtering module; (c) determining whether the packet is permitted; and (d) if the packet is permitted, handling the packet by the pre-filtering module.
Hereinafter, the term "network" includes a connection between any two or more computational devices which permits the transmission of data.
Hereinafter, the term "computational device" includes, but is not limited to, personal computers (PC) having an operating system such as WindowsTM, or Linux; MacintoshT"" computers; computers having JAVATM-OS as the operating system; workstations such as the computers of Sun MicrosystemsT"" and Silicon GraphicsTM, and other computers having some version of the UNIX operating system such as AIXTM or SOLARISTM of Sun MicrosystemsTM; any other known and available operating system; any type of computer; any device which can be connected to a packet switched network and which has an operating system, including but not limited to VxWorksTM and PSOST"'; or any device which can be so connected to a packet switched network, which is capable of transmitting and receiving packets, and which has at least a data processor, such as a network processor for example, including but not limited to, a bridge, a switch or a router. Hereinafter, the term "WindowsTM" includes but is not limited to Windows NTTM, Windows98TM, Windows2000TM, Windows CET"~ and any upgraded versions of these operating systems by Microsoft Corp. (USA).
The method of the present invention could be described as a series of steps performed by a data processor, and as such could optionally be implemented as software, hardware or firmware, or a combination thereof. For the present invention, a software application could be written in substantially any suitable programming language, which could easily be selected by one of ordinary skill in the art. The programming language chosen should be compatible with the computational device according to which the software application is executed. Examples of suitable programming languages include, but are not limited to, C, C++ and Java.
BRIEF DESCRIPTION OF THE DRAWINGS
The foregoing and other objects, aspects and advantages will be better understood from the following detailed description of a preferred embodiment of the invention with reference to the drawings, wherein:
FIG. 1 is a schematic block diagram of a system according to the present invention;
FIG. 2 is a schematic block diagram of an exemplary but preferred embodiment of the pre-filtering module of Figure 1 according to the present invention; and FIG. 3 is a flowchart of an exemplary method according to the present invention.
DETAILED DESCRIPTION OF THE INVENTION
The present invention is of a system, a device and a method for accelerating packet filtration by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a simple comparison with regard to the packets, for example according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. In addition, preferably packets are forwarded to the firewall for handling if these packets have particular session-control field values which require intervention by the firewall. For example, for the preferred implementation of the present invention with IP networks, and in particular with TCP/IP traffic, such session-control field values include a set SYN/FIN/RST flag for the packet. Such session-control field values are indicative of packets which carry information about the connection state, and are therefore important for the firewall to receive and analyze, in order to determine the state of the connection. Optionally, fragment packets are also forwarded to the firewall if the pre-filtering module is not able to perform certain functions, such as virtual defragmentation for the preferred embodiment of the present invention with IP networks, and in particular with IP traffic.
Once the firewall has determined that a connection is permitted, or has otherwise determined at least one parameter for performing the simple comparison, the firewall preferably sends a message to the pre-filtering module with the details of the new permitted packets. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or "off-loaded" the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with particular session-control field values indicating that the session is finished, for example by having the FIN/RST flag set for the preferred implementation with IP networks, such that the connection is closed. A
"timeout" occurs if a packet has not been received by the firewall for a predefined period of time.
The pre-filtering module is preferably implemented as hardware, in order to take advantage of hardware acceleration. Such hardware acceleration has the advantage of being much more rapid than software-based packet processing. Therefore, the pre-filtering module is preferably implemented as a hardware-based device, although the pre-filtering module could alternatively be implemented as software or firmware. Optionally, the pre-filtering module and the firewall could be implemented as a combined device, which could be a "black box" added to, or alternatively as a replacement for, the gateway node of a network, for ease of installation and operation.
The principles and operation of a system, a device and a method according to the present invention may be better understood with reference to the drawings and the accompanying description, it being understood that these drawings are given for illustrative purposes only and are not meant to be limiting. Although the following description centers around IP networks, and in particular around TCP/IP packet traffic, it is understood that this is for the purposes of illustration only and is not intended to be limiting in any way.
Referring now to the drawings, Figure 1 is a schematic block diagram of a system according to the present invention. A system 10 features a protected network 12, which is a packet-switched network, such that data is transmitted in the form of packets. Protected network 12 is separated from an external packet-switched network 14 by a gateway 16, which could optionally be any type of computational device, also termed herein an "intermediate node".
External network 14 could optionally be the Internet, for example. Gateway 16 is connected to each of external network 14 and protected network 12 through a hardware connector, shown herein as a NIC 17.
Gateway 16 operates a firewall 18 for performing packet analysis and packet filtering. Packets which are permitted to pass through gateway 16 from external network 14 are then received by one of a plurality of protected nodes 20, which are connected to protected network 12. Such network traffic is typically bi-directional, such that packets are received by gateway 16 from protected network 12 for transmission to external network 14 and vice versa.
Firewall 18 is preferably implemented as previously described in U.S.
Patent Nos. 5,835,726 and 5,606,668. Firewall 18 features a packet filter 22 for performing packet filtration. Packet filter 22 in turn is preferably composed of an analysis module 24 for analyzing packets and a rule base 26. Rule base 26 preferably contains one or more rules which are defined according to the preferences of the system administrator or other controlling user. Analysis module 24 extracts and compares the contents of the analyzed packets to the rules in rule base 26. If the result of the comparison is such that the packet is permitted according to rule base 26, then packet filter 22 permits the packet to enter protected network 12.
Alternatively, if the packet is not permitted according to rule base 26, then the packet is optionally dropped. The packet may also optionally be determined to be not permitted if rule base 26 does not specifically allow the packet to be passed.
Also optionally and preferably, packet filter 22 features a modification module 28 for modifying the packet, if the packet is accepted.
Other optional features of firewall 18 include an ability to perform accounting for the packets, in order to determine the amount of data being transferred on all packets which belong to a specific connection; the ability to modify address(es) within the packet; and the ability to encrypt the packets.
Packet encryption in particular has been previously described in U.S. Patent No. 5,835,726. Briefly, packets can optionally be encrypted for transmission between two firewalls 18, such that the packets are encrypted for passing through external network 14. Encryption is also optionally used for communication between firewall 18 and a node from external network 14, for example. The encrypted packets are then decrypted by the receiving firewall 18, and passed to protected network 12. Thus, the processes of encryption and transmission are automated, and can be performed in a manner which is transparent to the communicating software.
These features of firewall 18 are preferably implemented as previously described in U.S. Patent Nos. 5,835,726 and 5,606,668. However, passing all packets through firewall 18 before they are allowed to enter gateway 16 places a large computational burden on firewall 18. Therefore, according to the present invention, gateway 16 also features a pre-filtering module 30 which receives the packets before firewall 18, but which is preferably directly connected to protected network 12. Pre-filtering module 30 also preferably receives instructions from firewall 18, concerning packets which are permitted 5 to enter protected network 12. These instructions are more preferably determined by firewall 18 from an analysis of one or more previously received and related packets, such that if a previously received and related packet has been permitted to enter protected network 12, then the current packet should also be permitted to enter protected network 12. Thus, if pre-filtering module 10 30 determines that the current packet is permitted to enter, then preferably pre-filtering module 30 passes the packet directly through to protected network 12.
In order to increase the efficiency of operation of pre-filtering module 30, preferably pre-filtering module 30 can only perform restricted analysis of each packet. Specifically, more preferably only a portion of each packet is analyzed by pre-filtering module 30. Most preferably, pre-filtering module 30 analyzes each packet only with regard to a simple comparison. By "simple comparison", it is meant that the information is extracted in the form of one or more predefined parameters which are compared to a predefined pattern of such parameters.
In a particularly preferred example of a simple comparison, the packet is only analyzed until pre-filtering module 30 is able to determine whether the packet has been received from a permitted data transmission. Such a permitted transmission may be termed a connection, between a source node which initiates the connection, for example from external network 14, to a destination node which accepts the connection, for example a protected node 20. It is understood that once the connection has been established, communication between the source node and destination may optionally be bi-directional.
With regard to packet analysis, a "connection" is defined according to at least one, and preferably a plurality of, parameters which describe the data transmission to which the packet belongs. Examples of these parameters include but are not limited to, the source address and port of the packet; the destination address and port of the packet; the protocol of the packet and the interface from which the packet was received. The connection is used to classify the packet, and to determine whether the packet is permitted to enter to, or to leave from, protected network 12.
Firewall 18 defines each connection from an analysis of one or more previously received and examined packets. Firewall 18 inspects the contents of such packet or packets, and based upon the output of analysis module 24 with rulebase 26, determines whether packets from the corresponding connection should be permitted to enter and/or leave protected network 12. In addition, from the rules which are stored in rule base 26, analysis module 24 is able to determine one or more actions which should be associated with each connection. Examples of such actions include, but are not limited to, performing an accounting action in order to count the amount of data in the packet, encrypting/decrypting the packet, performing network address translation (NAT) by rewriting the address fields, and so forth. A preferred example for modifying the packet is to mark the packet, by assigning a priority number to the packet by pre-filtering module 30, according to the instructions of firewall 18. This priority number determines the order of transmission of the packet, and hence its "priority".
Firewall 18 then passes the relevant instructions concerning at least whether the packet is permitted to enter protected network 12, and more preferably, the actions which should be taken with subsequent packets from this connection, to pre-filtering module 30.
Optionally and preferably, pre-filtering module 30 performs an anti-spoofing method. Since pre-filtering module 30 may optionally be connected to a plurality of networks, packets can come from any one of these networks. The anti-spoofing method determines whether an IP packet, indicated as originating from a certain network, has indeed arrived from that network. As pre-filtering module 30 knows which network is connected to which interface, pre-filtering module 30 can determine whether a packet received from a particular interface is permitted.
The easiest way to implement the anti-spoofing method in an accelerator, such as pre-filtering module 30, is to include information regarding the network interface as part of the connection information which is available to pre-filtering module 30. Thus, if a packet comes from an allowed source node, is to be sent to an allowed destination, and has arrived through the expected interface, the packet can be processed by pre-filtering module 30.
Alternatively and optionally, even if only the interface is not correct, pre-filtering module 30 may determine that the packet represents a violation which should be further inspected by firewall 18 for validity. There are other ways to implement an anti-spoofing method, without including information concerning the interface as part of the stored instructions for pre-filtering module 30, which are also considered to be within the scope of the present invention.
In a preferred embodiment of pre-filtering module 30 which is shown in Figure 2, pre-filtering module 30 is embodied in hardware, or at the very least firmware, rather than purely as software. The advantage of hardware is that is is much faster than software for performing the required actions. The schematic block diagram of Figure 2 is a logic-based, rather than structural, illustration of the components of pre-filtering module 30. For example, the physical connections between components are not specified, and may be for example, a PCI bus on which all of the components are located. Optionally, the components may be connected with substantially any type of internal and/or external bus, for example.
For this implementation, pre-filtering module 30 may be described as a "device", preferably featuring a memory 36. Pre-filtering module 30 features a connection database 32 for storing the relevant instructions from firewall 18, which is stored in memory 36. Connection database 32 stores at least the parameter or parameters of the packet which are required to define the connection, but also preferably stores at least one action to be performed on packets from that connection.
Pre-filtering module 30 also preferably features a classification engine 38, including a data processor, for at least partially analyzing the information from the packet and for retrieving information from connection database 32.
Pre-filtering module 30 also preferably features a modifier 34, for performing the associated action or actions for packets from that connection, which is preferably stored in connection database 32 as previously described.
Pre-filtering module 30 also optionally and preferably communicates certain, selected information concerning at least one packet to firewall 18.
The selected information optionally includes at least one of, but is not limited to, the previously described parameters for analyzing the packet. The communication between pre-filtering module 30 and firewall 18 is optionally and preferably performed according to one of a number of embodiments. In a first embodiment, pre-filtering module 30 actively notifies firewall 18 upon the receipt of such information, in a state or event driven implementation.
Alternatively, in a second embodiment, firewall 18 queries pre-filtering module 30, in a polling implementation. For example, the polling may optionally be performed after a particular interval of time has passed, or alternatively according to a user query for such information, for example from a system administrator.
In addition, pre-filtering module 30 also preferably features at least one, and preferably a plurality of, network interfaces, shown as MAC (media access control) 40, which is hardware .for sending and receiving packets from the physical network (not shown). Pre-filtering module 30 more preferably features a firewall interface 42 for transferring packets to, and receiving packets from, the firewall (not shown).
The flow of operations is preferably as follows. Packets are optionally received from MAC 40, labeled "MAC one", which are then passed to classification engine 38. With the help of information and instructions retrieved from database 32 in memory 36, classification engine 38 then analyzes at least a portion of the information in each packet, and determines whether the packet is permitted. If the packet is permitted, then it is passed to modifier 34 for optional modification according to at least one instruction from the firewall (not shown), such that if modification is not necessary, then the at least one relevant instruction is not sent from the firewall.
The firewall may optionally determine an interface to which a packet should be sent, for example to a particular MAC 40. However, it should be noted that although the firewall may instruct pre-filtering module 30 for sending the packet to a particular interface, if routing is supported, then such.
routing would be used to route the packet, and not the instructions from the firewall (not shown).
Alternatively, the packet may be optionally and preferably forwarded to the firewall. Also alternatively, under certain circumstances as described in greater detail below, the packet may be dropped, particularly with regard to packets received from firewall interface 42, which are optionally similarly analyzed. In order to avoid dropping packets which may not be IP packets, optionally and preferably, information regarding one or more "default" packet types may be stored in database 32, such that if such information is not stored in database 32, the packet is defined as being "not permitted". One example of such a default packet type is an ARP (address resolution protocol) packet.
As can be seen with regard to the implementation of pre-filtering module 30 of Figure 2, packets may optionally arrive at pre-filtering module from an external source, such as MAC 40 for example, or alternatively may be received from firewall interface 42. If the packet is received from firewall interface 42, it may have been generated by the firewall itself, or alternatively may have been forwarded or generated by the IP stack of the host. Therefore, optionally and more preferably, for such packets which are received through firewall interface 42, pre-filtering module 30 is able to drop such packets if they are not permitted, rather than forwarding them to the firewall. Thus, the determination of whether to drop or forward packets by pre-filtering module 30 is optionally and preferably performed at least partially according to the interface through which the packets are received.
5 Of course, other implementations of pre-filtering module 30 are possible and are considered to be within the scope of the present invention .
Figure 3 is a flowchart of an exemplary method for operating the present invention. In step 1, a packet is received by the pre-filtering module. In step 2, at least one parameter of the packet is retrieved by the pre-filtering module.
In 10 step 3, the at least one parameter is used for examining the known connections, preferably by performing a look-up in a table of such known connections.
In step 4a, if an entry is found for the packet, then the action or actions defined for this connection are performed by the pre-filtering module. In step 5a, the packet is forwarded to its destination. Steps 4a and 5a are not 15 performed if the packet has certain session-control field values, such as a set SYN/FIN/RST flag for a packet transmitted over an IP network, in which case the packet is preferably forwarded to the firewall for handling. Such session-control field values are indicative of packets which carry information about the connection state, and are therefore important for the firewall to receive and analyze, in order to determine the state of the connection.
Optionally, fragmented packets are also forwarded to the firewall if the pre-filtering module is not able to perform certain functions, such as virtual defragmentation for the preferred embodiment of the present invention with IP
networks, and in particular with TCP/IP traffic. Virtual defragmentation is performed after an IP packet has become too large to be transmitted, and is therefore divided into a plurality of smaller packets, called fragments.
Virtual defragmentation is the process by which all of the received fragments are reassembled into the original big packet.
In order to prevent various sorts of attacks which may be attempted with fragments, preferably the pre-filtering module of the present invention, but alternatively the firewall, drops duplicate packet fragments. In other words, if a previously received fragment is received again, that fragment is dropped.
Turning again to the flowchart of Figure 3, alternatively, in step 4b, if an entry for the packet is not found in the table of connections, then the packet is forwarded to the firewall for handling. In step 5b, if the firewall determines that the connection to which the packet belongs is permitted, then the firewall optionally sends a message to the pre-filtering module with the necessary information concerning the new connection. Such a message preferably includes a key for identifying the new connection, information concerning address translation and optionally information concerning encryption, both of which are processes which involve the modification of the packet itself. The key for identifying the new connection preferably includes such information as the source IP address and port, the destination IP address and port, the protocol field and optionally the interface(s) from which a packet is expected to be received, for anti-spoofing protection. The address translation information includes the translated source IP address and port, the destination IP address and port.
According to preferred embodiments of the present invention, once the firewall has sent this message to the pre-filtering module, the connection is "offloaded" to the pre-filtering module, such that the firewall no longer receives any packets for this connection. Preferably, the firewall does not receive any further packets until a packet with certain session-control field values is received for this connection, indicating that the session is finished.
For example, for IP networks, such values include having a set FIN/RST flag.
More preferably, a timeout occurs when no packet has been received for a particular connection within a certain period of time. Since the firewall does not see any packets for the offloaded connection, the firewall queries the pre-filtering module about the last time that a packet was received for the connection. According to the received response, the firewall determines whether to keep or delete the connection. If the firewall deletes the connection, the connection is preferably deleted from the tables of the pre-filtering module.
According to other preferred embodiments of the present invention, the firewall receives updated accounting information from the pre-filtering module at regular intervals. This information is optionally and preferably pushed to the firewall by the pre-filtering module, rather than by having the firewall poll the pre-filtering module. The accounting information preferably includes the number of packets and of bytes which have been received by the pre-filtering module for a particular connection since the last time that the accounting information was updated, and the last time that a packet was received by the pre-filtering module for this particular connection. This information is then reset within the pre-filtering module. Optionally and more preferably, if the pre-filtering module deletes the connection, then the pre-filtering module pushes the last accounting information about this connection to the firewall.
It will be appreciated that the above descriptions are intended only to serve as examples, and that many other embodiments are possible within the spirit and the scope of the present invention.
Claims (28)
1. A system for accelerated packet filtering, the system comprising:
(a) a source node for transmitting a packet;
(b) a destination node for receiving said packet;
(c) a firewall interposed between said source node and said destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module being in communication with said firewall, for receiving at least one instruction from said firewall and for receiving said packet before said firewall, such that if said packet is permitted according to said at least one instruction, said pre-filtering module handles said packet, and alternatively said pre-filtering module forwards said packet to said firewall for handling;
wherein said at least one instruction is for performing an analysis of said packet that is restricted relative to said packet filtering that is performed by said firewall.
(a) a source node for transmitting a packet;
(b) a destination node for receiving said packet;
(c) a firewall interposed between said source node and said destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module being in communication with said firewall, for receiving at least one instruction from said firewall and for receiving said packet before said firewall, such that if said packet is permitted according to said at least one instruction, said pre-filtering module handles said packet, and alternatively said pre-filtering module forwards said packet to said firewall for handling;
wherein said at least one instruction is for performing an analysis of said packet that is restricted relative to said packet filtering that is performed by said firewall.
2. The system of claim 1, wherein packet transmission between said source node and said destination node forms a connection, and said firewall determines whether said connection is permitted, such that said at least one instruction includes at least one parameter of said packet for identifying a permitted connection, such that if said connection -is permitted, said pre-filtering module handles said packet.
3. The system of claim 2, wherein said firewall receives a packet from said permitted connection from said pre-filtering module if said packet has a selected session-control field value.
4. The system of claim 2, wherein said at least one parameter for identifying said permitted connection includes a source address and a destination address for said packet.
5. The system of claim 4, wherein said at least one parameter for identifying said permitted connection further includes a source port and a destination port for said packet.
6. The system of claim 2, wherein if an additional packet has not been received for said permitted connection after a predefined period of time, said connection is deleted by said firewall.
7. The system of claim 2, wherein if a packet with a particular session-control field value indicative of information about a connection state is received for said permitted connection, said packet is forwarded to said firewall.
8. The system of claim 2, wherein said pre-filtering module further comprises:
(i) a connection database for storing said at least one parameter of said packet for identifying said permitted connection.
(i) a connection database for storing said at least one parameter of said packet for identifying said permitted connection.
9. The system of claim 8, wherein said pre-filtering module further comprises:
(ii) a classification engine for analyzing at least a portion of said packet and for comparing said at least a portion of said packet to said at least one parameter.
(ii) a classification engine for analyzing at least a portion of said packet and for comparing said at least a portion of said packet to said at least one parameter.
10. The system of claim 9, wherein said pre-filtering module further comprises:
(iii) a modifier for performing at least one action on said packet if said packet is received from said permitted connection, said at least one action being defined according to an instruction from said firewall.
(iii) a modifier for performing at least one action on said packet if said packet is received from said permitted connection, said at least one action being defined according to an instruction from said firewall.
11. The system of claim 10, wherein said pre-filtering module is implemented as a hardware device.
12. The system of claim 10, further comprising:
(e) a computational device interposed between said source node and said destination node, wherein said pre-filtering module and said firewall are operated by said computational device.
(e) a computational device interposed between said source node and said destination node, wherein said pre-filtering module and said firewall are operated by said computational device.
13. A system for accelerated filtering of a packet on a network, the system comprising:
(a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module located on the network and in communication with said firewall, for receiving at least one instruction from said firewall, said at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before said firewall, such that if the packet is permitted according to said simple comparison, said pre-filtering module at least transmits the packet on the network.
(a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module located on the network and in communication with said firewall, for receiving at least one instruction from said firewall, said at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before said firewall, such that if the packet is permitted according to said simple comparison, said pre-filtering module at least transmits the packet on the network.
14. The system of claim 13, wherein if the packet is not permitted, said pre-filtering module either forwards the packet to said firewall for handling if the packet is received from the network, and alternatively drops the packet if the packet is received from said firewall.
15. The system of claim 13, further comprising:
(c) a source node for transmitting the packet; and (d) a destination node for receiving the packet;
wherein packet transmission between said source node and said destination node forms a connection, and said firewall determines whether said connection is permitted, such that said at least one instruction includes at least one parameter of the packet for identifying a permitted connection, such that if said connection is permitted, said pre-filtering module at least transmits the packet on the network.
(c) a source node for transmitting the packet; and (d) a destination node for receiving the packet;
wherein packet transmission between said source node and said destination node forms a connection, and said firewall determines whether said connection is permitted, such that said at least one instruction includes at least one parameter of the packet for identifying a permitted connection, such that if said connection is permitted, said pre-filtering module at least transmits the packet on the network.
16. The system of claim 15, wherein if said connection is not a permitted connection, said pre-filtering module drops the packet.
17. For use in a system for accelerated packet filtration, the system featuring a network for transmitting a packet and a firewall on the network for filtering the packet, a device for receiving the packet before the firewall, the device comprising:
(a) a memory for storing at least one instruction from the firewall for analyzing at least one parameter of the packet, said at least one instruction including said at least one parameter for identifying the packet;
(b) a classification engine for analyzing at least a portion of the packet and for comparing said at least a portion of the packet to said at least one parameter according to said at least one instruction; and (c) a firewall interface for sending the packet to the firewall.
(a) a memory for storing at least one instruction from the firewall for analyzing at least one parameter of the packet, said at least one instruction including said at least one parameter for identifying the packet;
(b) a classification engine for analyzing at least a portion of the packet and for comparing said at least a portion of the packet to said at least one parameter according to said at least one instruction; and (c) a firewall interface for sending the packet to the firewall.
18. The device of claim 17, further comprising:
(d) a modifier for performing at least one action on the packet if the packet is permitted, said at least one action being defined according to said at least one instruction from the firewall.
(d) a modifier for performing at least one action on the packet if the packet is permitted, said at least one action being defined according to said at least one instruction from the firewall.
19. A method for accelerated packet filtering on a network in conjunction with a firewall, the method comprising the steps of:
(a) providing a pre-filtering module for receiving a packet before the firewall;
(b) receiving said packet by said pre-filtering module;
(c) determining whether said packet is permitted, according to at least one instruction received from the firewall;
(d) if said packet is permitted, handling said packet by said pre-filtering module; and (e) alternatively, forwarding said packet to the firewall.
(a) providing a pre-filtering module for receiving a packet before the firewall;
(b) receiving said packet by said pre-filtering module;
(c) determining whether said packet is permitted, according to at least one instruction received from the firewall;
(d) if said packet is permitted, handling said packet by said pre-filtering module; and (e) alternatively, forwarding said packet to the firewall.
20. The method of claim 19, wherein step (e) is performed if said packet is received from the network.
21. The method of claim 20, wherein if said packet is received from the firewall, dropping said packet.
22. The method of claim 19, wherein step (d) includes the step of marking said packet with a priority number.
23. The method of claim 19, wherein if the packet is received as a plurality of fragments, step (d) includes the step of determining if a fragment is a duplicate fragment, such that if said fragment is a duplicate fragment, the method further comprises the step of:
(f) dropping said duplicate fragment.
(f) dropping said duplicate fragment.
24. The method of claim 19, wherein said packet has a destination address and wherein step (d) includes the step of forwarding said packet to said destination address.
25. The method of claim 24, wherein step (d) includes the step of performing at least one action on said packet by said pre-filtering module, said at least one action being determined according to an instruction from the firewall.
26. The method of claim 19, wherein said packet features at least one parameter, and said at least one instruction identifies said packet as a permitted packet according to said at least one parameter, such that step (c) includes the step of analyzing said packet to retrieve said at least one parameter.
27. The method of claim 26, wherein the firewall classifies at least one previously received packet according to at least a source address and a destination address of said at least one previously received packet, said source address and said destination address together forming a connection, such that the firewall sends said source address and said destination address for identifying said connection as a permitted connection to said pre-filtering module as said at least one instruction.
28. The method of claim 27, wherein the network communicates with a plurality of interfaces, and said pre-filtering module is connected to each of said plurality of interfaces, such that step (c) includes the step of determining whether said packet is received from said permitted connection and from a permitted interface, such that said packet is permitted only if said packet is received from said permitted connection through said permitted interface.
Applications Claiming Priority (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US09/517,276 | 2000-03-02 | ||
| US09/517,276 US6496935B1 (en) | 2000-03-02 | 2000-03-02 | System, device and method for rapid packet filtering and processing |
| PCT/US2001/005925 WO2001065343A1 (en) | 2000-03-02 | 2001-02-26 | System, device and method for rapid packet filtering and processing |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2401577A1 CA2401577A1 (en) | 2001-09-07 |
| CA2401577C true CA2401577C (en) | 2007-09-18 |
Family
ID=24059131
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002401577A Expired - Fee Related CA2401577C (en) | 2000-03-02 | 2001-02-26 | System, device and method for rapid packet filtering and processing |
Country Status (17)
| Country | Link |
|---|---|
| US (1) | US6496935B1 (en) |
| EP (1) | EP1266277B1 (en) |
| JP (1) | JP3954385B2 (en) |
| KR (1) | KR20020092972A (en) |
| CN (1) | CN100474213C (en) |
| AT (1) | ATE312463T1 (en) |
| AU (2) | AU2001241717B2 (en) |
| BR (1) | BR0109035A (en) |
| CA (1) | CA2401577C (en) |
| DE (1) | DE60115615T2 (en) |
| EA (1) | EA004423B1 (en) |
| HU (1) | HUP0300039A2 (en) |
| IL (2) | IL151522A0 (en) |
| NO (1) | NO324958B1 (en) |
| NZ (1) | NZ520984A (en) |
| PL (1) | PL357181A1 (en) |
| WO (1) | WO2001065343A1 (en) |
Families Citing this family (194)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7089588B2 (en) * | 2000-01-19 | 2006-08-08 | Reynolds And Reynolds Holdings, Inc. | Performance path method and apparatus for exchanging data among systems using different data formats |
| US6854063B1 (en) * | 2000-03-03 | 2005-02-08 | Cisco Technology, Inc. | Method and apparatus for optimizing firewall processing |
| US6732209B1 (en) * | 2000-03-28 | 2004-05-04 | Juniper Networks, Inc. | Data rate division among a plurality of input queues |
| DE10025929B4 (en) * | 2000-05-26 | 2006-02-16 | Harman Becker Automotive Systems (Becker Division) Gmbh | Method for transmitting data |
| US7120931B1 (en) * | 2000-08-31 | 2006-10-10 | Cisco Technology, Inc. | System and method for generating filters based on analyzed flow data |
| US7111072B1 (en) | 2000-09-13 | 2006-09-19 | Cosine Communications, Inc. | Packet routing system and method |
| US8250357B2 (en) | 2000-09-13 | 2012-08-21 | Fortinet, Inc. | Tunnel interface for securing traffic over a network |
| US7487232B1 (en) * | 2000-09-13 | 2009-02-03 | Fortinet, Inc. | Switch management system and method |
| US7574495B1 (en) | 2000-09-13 | 2009-08-11 | Fortinet, Inc. | System and method for managing interworking communications protocols |
| US7272643B1 (en) * | 2000-09-13 | 2007-09-18 | Fortinet, Inc. | System and method for managing and provisioning virtual routers |
| US7389358B1 (en) * | 2000-09-13 | 2008-06-17 | Fortinet, Inc. | Distributed virtual system to support managed, network-based services |
| US7054930B1 (en) * | 2000-10-26 | 2006-05-30 | Cisco Technology, Inc. | System and method for propagating filters |
| US6922786B1 (en) * | 2000-10-31 | 2005-07-26 | Nortel Networks Limited | Real-time media communications over firewalls using a control protocol |
| US7131140B1 (en) * | 2000-12-29 | 2006-10-31 | Cisco Technology, Inc. | Method for protecting a firewall load balancer from a denial of service attack |
| US6731652B2 (en) * | 2001-02-14 | 2004-05-04 | Metro Packet Systems Inc. | Dynamic packet processor architecture |
| CA2476722C (en) * | 2001-02-20 | 2011-12-20 | Eyeball Networks Inc. | Method and apparatus to permit data transmission to traverse firewalls |
| US7664119B2 (en) * | 2001-03-30 | 2010-02-16 | Intel Corporation | Method and apparatus to perform network routing |
| US7277953B2 (en) * | 2001-04-18 | 2007-10-02 | Emc Corporation | Integrated procedure for partitioning network data services among multiple subscribers |
| US6816455B2 (en) * | 2001-05-09 | 2004-11-09 | Telecom Italia S.P.A. | Dynamic packet filter utilizing session tracking |
| JP2002358239A (en) * | 2001-06-04 | 2002-12-13 | Fuji Electric Co Ltd | Copyright protection system |
| US7181547B1 (en) | 2001-06-28 | 2007-02-20 | Fortinet, Inc. | Identifying nodes in a ring network |
| US20040001433A1 (en) * | 2001-07-18 | 2004-01-01 | Gram Charles Andrew | Interactive control of network devices |
| US7134012B2 (en) * | 2001-08-15 | 2006-11-07 | International Business Machines Corporation | Methods, systems and computer program products for detecting a spoofed source address in IP datagrams |
| ATE477540T1 (en) * | 2001-09-14 | 2010-08-15 | Nokia Inc | APPARATUS AND METHOD FOR PACKET FORWARDING |
| US7409706B1 (en) | 2001-10-02 | 2008-08-05 | Cisco Technology, Inc. | System and method for providing path protection of computer network traffic |
| KR100452143B1 (en) * | 2001-10-16 | 2004-10-08 | 주식회사 플랜티넷 | apparatus and method for web filtering using asymmetry traffic flow mode |
| JP2003242714A (en) * | 2001-10-24 | 2003-08-29 | Fuji Electric Co Ltd | Information recording medium, manufacturing method therefor, information processor and copyright management system |
| US9392002B2 (en) * | 2002-01-31 | 2016-07-12 | Nokia Technologies Oy | System and method of providing virus protection at a gateway |
| US7216260B2 (en) * | 2002-03-27 | 2007-05-08 | International Business Machines Corporation | Method, system and program product for dynamically detecting errant data sequences and performing corresponding actions |
| US7185365B2 (en) * | 2002-03-27 | 2007-02-27 | Intel Corporation | Security enabled network access control |
| CN1152531C (en) * | 2002-04-23 | 2004-06-02 | 华为技术有限公司 | Network addressing control method of zone message |
| US20030200463A1 (en) * | 2002-04-23 | 2003-10-23 | Mccabe Alan Jason | Inter-autonomous system weighstation |
| US7120797B2 (en) * | 2002-04-24 | 2006-10-10 | Microsoft Corporation | Methods for authenticating potential members invited to join a group |
| AUPS214802A0 (en) * | 2002-05-01 | 2002-06-06 | Firebridge Systems Pty Ltd | Firewall with stateful inspection |
| US20030212901A1 (en) * | 2002-05-13 | 2003-11-13 | Manav Mishra | Security enabled network flow control |
| US7161904B2 (en) | 2002-06-04 | 2007-01-09 | Fortinet, Inc. | System and method for hierarchical metering in a virtual router based network switch |
| US7340535B1 (en) * | 2002-06-04 | 2008-03-04 | Fortinet, Inc. | System and method for controlling routing in a virtual router system |
| US7376125B1 (en) * | 2002-06-04 | 2008-05-20 | Fortinet, Inc. | Service processing switch |
| US7116665B2 (en) * | 2002-06-04 | 2006-10-03 | Fortinet, Inc. | Methods and systems for a distributed provider edge |
| US7203192B2 (en) | 2002-06-04 | 2007-04-10 | Fortinet, Inc. | Network packet steering |
| US7177311B1 (en) * | 2002-06-04 | 2007-02-13 | Fortinet, Inc. | System and method for routing traffic through a virtual router-based network switch |
| US9088494B2 (en) * | 2002-06-26 | 2015-07-21 | Avaya Communication Israel Ltd. | Packet fragmentation prevention |
| US7146638B2 (en) * | 2002-06-27 | 2006-12-05 | International Business Machines Corporation | Firewall protocol providing additional information |
| US6983323B2 (en) * | 2002-08-12 | 2006-01-03 | Tippingpoint Technologies, Inc. | Multi-level packet screening with dynamically selected filtering criteria |
| US7096383B2 (en) | 2002-08-29 | 2006-08-22 | Cosine Communications, Inc. | System and method for virtual router failover in a network routing system |
| US20100138909A1 (en) * | 2002-09-06 | 2010-06-03 | O2Micro, Inc. | Vpn and firewall integrated system |
| US7315890B2 (en) * | 2002-10-02 | 2008-01-01 | Lockheed Martin Corporation | System and method for managing access to active devices operably connected to a data network |
| US7440573B2 (en) * | 2002-10-08 | 2008-10-21 | Broadcom Corporation | Enterprise wireless local area network switching system |
| US20040078422A1 (en) * | 2002-10-17 | 2004-04-22 | Toomey Christopher Newell | Detecting and blocking spoofed Web login pages |
| US7266120B2 (en) | 2002-11-18 | 2007-09-04 | Fortinet, Inc. | System and method for hardware accelerated packet multicast in a virtual routing system |
| TW200412101A (en) * | 2002-12-23 | 2004-07-01 | Shaw-Hwa Hwang | Directly peer-to peer transmission protocol between two virtual network |
| MY141160A (en) * | 2003-01-13 | 2010-03-31 | Multimedia Glory Sdn Bhd | System and method of preventing the transmission of known and unknown electronic content to and from servers or workstations connected to a common network |
| JP4257151B2 (en) * | 2003-02-28 | 2009-04-22 | 富士通株式会社 | Packet control system, packet control device, packet relay device, and packet control program |
| TW200420021A (en) * | 2003-03-19 | 2004-10-01 | Etrunk Technologies Inc | Network packet routing control device |
| US7325002B2 (en) * | 2003-04-04 | 2008-01-29 | Juniper Networks, Inc. | Detection of network security breaches based on analysis of network record logs |
| US7760729B2 (en) | 2003-05-28 | 2010-07-20 | Citrix Systems, Inc. | Policy based network address translation |
| WO2004107130A2 (en) | 2003-05-28 | 2004-12-09 | Caymas Systems, Inc. | Multilayer access control security system |
| US7509673B2 (en) * | 2003-06-06 | 2009-03-24 | Microsoft Corporation | Multi-layered firewall architecture |
| US7308711B2 (en) * | 2003-06-06 | 2007-12-11 | Microsoft Corporation | Method and framework for integrating a plurality of network policies |
| US7260840B2 (en) * | 2003-06-06 | 2007-08-21 | Microsoft Corporation | Multi-layer based method for implementing network firewalls |
| US6985920B2 (en) * | 2003-06-23 | 2006-01-10 | Protego Networks Inc. | Method and system for determining intra-session event correlation across network address translation devices |
| US7620070B1 (en) * | 2003-06-24 | 2009-11-17 | Nvidia Corporation | Packet processing with re-insertion into network interface circuitry |
| US20050022017A1 (en) | 2003-06-24 | 2005-01-27 | Maufer Thomas A. | Data structures and state tracking for network protocol processing |
| US7305705B2 (en) * | 2003-06-30 | 2007-12-04 | Microsoft Corporation | Reducing network configuration complexity with transparent virtual private networks |
| US20050144290A1 (en) * | 2003-08-01 | 2005-06-30 | Rizwan Mallal | Arbitrary java logic deployed transparently in a network |
| US7522594B2 (en) * | 2003-08-19 | 2009-04-21 | Eye Ball Networks, Inc. | Method and apparatus to permit data transmission to traverse firewalls |
| US7720095B2 (en) | 2003-08-27 | 2010-05-18 | Fortinet, Inc. | Heterogeneous media packet bridging |
| US7464181B2 (en) * | 2003-09-11 | 2008-12-09 | International Business Machines Corporation | Method for caching lookups based upon TCP traffic flow characteristics |
| US7594018B2 (en) * | 2003-10-10 | 2009-09-22 | Citrix Systems, Inc. | Methods and apparatus for providing access to persistent application sessions |
| US20050100019A1 (en) * | 2003-11-10 | 2005-05-12 | Sahita Ravi L. | Rule based packet processing engine |
| US7978716B2 (en) | 2003-11-24 | 2011-07-12 | Citrix Systems, Inc. | Systems and methods for providing a VPN solution |
| US7792147B1 (en) * | 2004-02-09 | 2010-09-07 | Symantec Corporation | Efficient assembly of fragmented network traffic for data security |
| KR100609170B1 (en) * | 2004-02-13 | 2006-08-02 | 엘지엔시스(주) | system of network security and working method thereof |
| US6972226B2 (en) * | 2004-03-31 | 2005-12-06 | Infineon Technologies Ag | Charge-trapping memory cell array and method for production |
| US20050268331A1 (en) * | 2004-05-25 | 2005-12-01 | Franck Le | Extension to the firewall configuration protocols and features |
| US7757074B2 (en) | 2004-06-30 | 2010-07-13 | Citrix Application Networking, Llc | System and method for establishing a virtual private network |
| US8739274B2 (en) | 2004-06-30 | 2014-05-27 | Citrix Systems, Inc. | Method and device for performing integrated caching in a data communication network |
| US8495305B2 (en) | 2004-06-30 | 2013-07-23 | Citrix Systems, Inc. | Method and device for performing caching of dynamically generated objects in a data communication network |
| US8914522B2 (en) | 2004-07-23 | 2014-12-16 | Citrix Systems, Inc. | Systems and methods for facilitating a peer to peer route via a gateway |
| KR20070037650A (en) | 2004-07-23 | 2007-04-05 | 사이트릭스 시스템스, 인크. | A method and systems for routing packets from an endpoint to a gateway |
| US7865944B1 (en) * | 2004-09-10 | 2011-01-04 | Juniper Networks, Inc. | Intercepting GPRS data |
| GB0420684D0 (en) * | 2004-09-17 | 2004-10-20 | Oostendorp Jeroen | Platform for intelligent Email distribution |
| US7499419B2 (en) | 2004-09-24 | 2009-03-03 | Fortinet, Inc. | Scalable IP-services enabled multicast forwarding with efficient resource utilization |
| US7748032B2 (en) | 2004-09-30 | 2010-06-29 | Citrix Systems, Inc. | Method and apparatus for associating tickets in a ticket hierarchy |
| US7711835B2 (en) | 2004-09-30 | 2010-05-04 | Citrix Systems, Inc. | Method and apparatus for reducing disclosure of proprietary data in a networked environment |
| US8613048B2 (en) | 2004-09-30 | 2013-12-17 | Citrix Systems, Inc. | Method and apparatus for providing authorized remote access to application sessions |
| KR100624483B1 (en) * | 2004-10-06 | 2006-09-18 | 삼성전자주식회사 | Apparatus and method for intrusion detection in network |
| US7808904B2 (en) * | 2004-11-18 | 2010-10-05 | Fortinet, Inc. | Method and apparatus for managing subscriber profiles |
| JP2006174350A (en) * | 2004-12-20 | 2006-06-29 | Fujitsu Ltd | Communication apparatus |
| US8700695B2 (en) | 2004-12-30 | 2014-04-15 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP pooling |
| US7810089B2 (en) | 2004-12-30 | 2010-10-05 | Citrix Systems, Inc. | Systems and methods for automatic installation and execution of a client-side acceleration program |
| US8954595B2 (en) | 2004-12-30 | 2015-02-10 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP buffering |
| US8706877B2 (en) | 2004-12-30 | 2014-04-22 | Citrix Systems, Inc. | Systems and methods for providing client-side dynamic redirection to bypass an intermediary |
| US8549149B2 (en) | 2004-12-30 | 2013-10-01 | Citrix Systems, Inc. | Systems and methods for providing client-side accelerated access to remote applications via TCP multiplexing |
| US8255456B2 (en) | 2005-12-30 | 2012-08-28 | Citrix Systems, Inc. | System and method for performing flash caching of dynamically generated objects in a data communication network |
| US8024568B2 (en) | 2005-01-28 | 2011-09-20 | Citrix Systems, Inc. | Method and system for verification of an endpoint security scan |
| US7665128B2 (en) * | 2005-04-08 | 2010-02-16 | At&T Corp. | Method and apparatus for reducing firewall rules |
| US7634584B2 (en) | 2005-04-27 | 2009-12-15 | Solarflare Communications, Inc. | Packet validation in virtual network interface architecture |
| US20070097976A1 (en) * | 2005-05-20 | 2007-05-03 | Wood George D | Suspect traffic redirection |
| US7881291B2 (en) * | 2005-05-26 | 2011-02-01 | Alcatel Lucent | Packet classification acceleration using spectral analysis |
| US8631483B2 (en) * | 2005-06-14 | 2014-01-14 | Texas Instruments Incorporated | Packet processors and packet filter processes, circuits, devices, and systems |
| CN100448227C (en) * | 2005-08-30 | 2008-12-31 | 杭州华三通信技术有限公司 | Business flow idnetifying method |
| KR100753815B1 (en) * | 2005-08-31 | 2007-08-31 | 한국전자통신연구원 | Apparatus and method for packet filtering |
| US8347373B2 (en) | 2007-05-08 | 2013-01-01 | Fortinet, Inc. | Content filtering of remote file-system access protocols |
| DE602006014192D1 (en) | 2005-12-02 | 2010-06-17 | Citrix Systems Inc | CERTIFICATION CERTIFICATES FROM A PROXY SERVER FOR A VIRTUALIZED CALCULATION ENVIRONMENT TO ACCESS A REMOTE RESOURCE |
| JP4545085B2 (en) * | 2005-12-08 | 2010-09-15 | 富士通株式会社 | Firewall device |
| US8730834B2 (en) * | 2005-12-23 | 2014-05-20 | General Electric Company | Intelligent electronic device with embedded multi-port data packet controller |
| US7921184B2 (en) | 2005-12-30 | 2011-04-05 | Citrix Systems, Inc. | System and method for performing flash crowd caching of dynamically generated objects in a data communication network |
| US8301839B2 (en) | 2005-12-30 | 2012-10-30 | Citrix Systems, Inc. | System and method for performing granular invalidation of cached dynamically generated objects in a data communication network |
| US8584226B2 (en) | 2006-01-26 | 2013-11-12 | Iorhythm, Inc. | Method and apparatus for geographically regulating inbound and outbound network communications |
| US7606225B2 (en) * | 2006-02-06 | 2009-10-20 | Fortinet, Inc. | Integrated security switch |
| US7784086B2 (en) * | 2006-03-08 | 2010-08-24 | Panasonic Corporation | Method for secure packet identification |
| JP4823728B2 (en) * | 2006-03-20 | 2011-11-24 | 富士通株式会社 | Frame relay device and frame inspection device |
| US8151323B2 (en) * | 2006-04-12 | 2012-04-03 | Citrix Systems, Inc. | Systems and methods for providing levels of access and action control via an SSL VPN appliance |
| US8122492B2 (en) * | 2006-04-21 | 2012-02-21 | Microsoft Corporation | Integration of social network information and network firewalls |
| US8079073B2 (en) * | 2006-05-05 | 2011-12-13 | Microsoft Corporation | Distributed firewall implementation and control |
| US8176157B2 (en) * | 2006-05-18 | 2012-05-08 | Microsoft Corporation | Exceptions grouping |
| US7603333B2 (en) * | 2006-06-14 | 2009-10-13 | Microsoft Corporation | Delayed policy evaluation |
| US7865878B2 (en) * | 2006-07-31 | 2011-01-04 | Sap Ag | Method and apparatus for operating enterprise software from a detachable storage device |
| US8533846B2 (en) | 2006-11-08 | 2013-09-10 | Citrix Systems, Inc. | Method and system for dynamically associating access rights with a resource |
| US7688821B2 (en) * | 2006-11-21 | 2010-03-30 | O2Micro International Ltd. | Method and apparatus for distributing data packets by using multi-network address translation |
| US8984620B2 (en) * | 2007-07-06 | 2015-03-17 | Cyberoam Technologies Pvt. Ltd. | Identity and policy-based network security and management system and method |
| US10540651B1 (en) | 2007-07-31 | 2020-01-21 | Intuit Inc. | Technique for restricting access to information |
| US8060927B2 (en) * | 2007-10-31 | 2011-11-15 | Microsoft Corporation | Security state aware firewall |
| JP5223376B2 (en) * | 2008-02-29 | 2013-06-26 | 日本電気株式会社 | Remote access system, method and program |
| US20090235355A1 (en) * | 2008-03-17 | 2009-09-17 | Inventec Corporation | Network intrusion protection system |
| US8336094B2 (en) * | 2008-03-27 | 2012-12-18 | Juniper Networks, Inc. | Hierarchical firewalls |
| JP5153480B2 (en) * | 2008-06-27 | 2013-02-27 | 三菱電機株式会社 | Gateway device and packet filtering method |
| US7908376B2 (en) * | 2008-07-31 | 2011-03-15 | Broadcom Corporation | Data path acceleration of a network stack |
| US8769665B2 (en) * | 2009-09-29 | 2014-07-01 | Broadcom Corporation | IP communication device as firewall between network and computer system |
| CN105376167A (en) * | 2009-10-28 | 2016-03-02 | 惠普公司 | Distributed packet stream inspection and processing |
| US8656492B2 (en) * | 2011-05-16 | 2014-02-18 | General Electric Company | Systems, methods, and apparatus for network intrusion detection |
| WO2012163587A1 (en) * | 2011-05-31 | 2012-12-06 | Alcatel Lucent | Distributed access control across the network firewalls |
| US8881258B2 (en) * | 2011-08-24 | 2014-11-04 | Mcafee, Inc. | System, method, and computer program for preventing infections from spreading in a network environment using dynamic application of a firewall policy |
| US8681794B2 (en) | 2011-11-30 | 2014-03-25 | Broadcom Corporation | System and method for efficient matching of regular expression patterns across multiple packets |
| US8724496B2 (en) * | 2011-11-30 | 2014-05-13 | Broadcom Corporation | System and method for integrating line-rate application recognition in a switch ASIC |
| WO2014017467A1 (en) * | 2012-07-24 | 2014-01-30 | 日本電気株式会社 | Filtering setting support device, filtering setting support method and program |
| WO2014077615A1 (en) * | 2012-11-19 | 2014-05-22 | Samsung Sds Co., Ltd. | Anti-malware system, method of processing packet in the same, and computing device |
| US9319351B1 (en) * | 2012-11-26 | 2016-04-19 | Marvell Israel (M.I.S.L.) Ltd. | Mechanism for wire-speed stateful packet inspection in packet processors |
| US10033693B2 (en) | 2013-10-01 | 2018-07-24 | Nicira, Inc. | Distributed identity-based firewalls |
| US9276904B2 (en) | 2014-02-20 | 2016-03-01 | Nicira, Inc. | Specifying point of enforcement in a firewall rule |
| US9384033B2 (en) | 2014-03-11 | 2016-07-05 | Vmware, Inc. | Large receive offload for virtual machines |
| US9742682B2 (en) | 2014-03-11 | 2017-08-22 | Vmware, Inc. | Large receive offload for virtual machines |
| US9755981B2 (en) | 2014-03-11 | 2017-09-05 | Vmware, Inc. | Snooping forwarded packets by a virtual machine |
| US9503427B2 (en) | 2014-03-31 | 2016-11-22 | Nicira, Inc. | Method and apparatus for integrating a service virtual machine |
| US9906494B2 (en) | 2014-03-31 | 2018-02-27 | Nicira, Inc. | Configuring interactions with a firewall service virtual machine |
| US9215210B2 (en) | 2014-03-31 | 2015-12-15 | Nicira, Inc. | Migrating firewall connection state for a firewall service virtual machine |
| US9825913B2 (en) | 2014-06-04 | 2017-11-21 | Nicira, Inc. | Use of stateless marking to speed up stateful firewall rule processing |
| US9774707B2 (en) | 2014-06-04 | 2017-09-26 | Nicira, Inc. | Efficient packet classification for dynamic containers |
| US9729512B2 (en) | 2014-06-04 | 2017-08-08 | Nicira, Inc. | Use of stateless marking to speed up stateful firewall rule processing |
| WO2015187201A1 (en) * | 2014-06-04 | 2015-12-10 | Nicira, Inc. | Use of stateless marking to speed up stateful firewall rule processing |
| US10110712B2 (en) | 2014-06-04 | 2018-10-23 | Nicira, Inc. | Efficient packet classification for dynamic containers |
| US9419897B2 (en) | 2014-06-30 | 2016-08-16 | Nicira, Inc. | Methods and systems for providing multi-tenancy support for Single Root I/O Virtualization |
| US9692698B2 (en) | 2014-06-30 | 2017-06-27 | Nicira, Inc. | Methods and systems to offload overlay network packet encapsulation to hardware |
| US9692727B2 (en) | 2014-12-02 | 2017-06-27 | Nicira, Inc. | Context-aware distributed firewall |
| US10606626B2 (en) | 2014-12-29 | 2020-03-31 | Nicira, Inc. | Introspection method and apparatus for network access filtering |
| US9680706B2 (en) | 2015-06-30 | 2017-06-13 | Nicira, Inc. | Federated firewall management for moving workload across data centers |
| US10324746B2 (en) | 2015-11-03 | 2019-06-18 | Nicira, Inc. | Extended context delivery for context-based authorization |
| KR102068228B1 (en) | 2016-04-12 | 2020-01-21 | 가드녹스 사이버 테크놀로지스 엘티디. | Specially programmed computer system with associated device configured to implement secure lockdown and method of use thereof |
| US10135727B2 (en) | 2016-04-29 | 2018-11-20 | Nicira, Inc. | Address grouping for distributed service rules |
| US10348685B2 (en) | 2016-04-29 | 2019-07-09 | Nicira, Inc. | Priority allocation for distributed service rules |
| US11171920B2 (en) | 2016-05-01 | 2021-11-09 | Nicira, Inc. | Publication of firewall configuration |
| US11425095B2 (en) | 2016-05-01 | 2022-08-23 | Nicira, Inc. | Fast ordering of firewall sections and rules |
| US11258761B2 (en) | 2016-06-29 | 2022-02-22 | Nicira, Inc. | Self-service firewall configuration |
| US11082400B2 (en) | 2016-06-29 | 2021-08-03 | Nicira, Inc. | Firewall configuration versioning |
| US11115385B1 (en) * | 2016-07-27 | 2021-09-07 | Cisco Technology, Inc. | Selective offloading of packet flows with flow state management |
| US10938837B2 (en) | 2016-08-30 | 2021-03-02 | Nicira, Inc. | Isolated network stack to manage security for virtual machines |
| US10333983B2 (en) | 2016-08-30 | 2019-06-25 | Nicira, Inc. | Policy definition and enforcement for a network virtualization platform |
| US10193862B2 (en) | 2016-11-29 | 2019-01-29 | Vmware, Inc. | Security policy analysis based on detecting new network port connections |
| WO2018106612A1 (en) | 2016-12-06 | 2018-06-14 | Nicira, Inc. | Performing context-rich attribute-based services on a host |
| US10581960B2 (en) | 2016-12-22 | 2020-03-03 | Nicira, Inc. | Performing context-rich attribute-based load balancing on a host |
| US10802857B2 (en) | 2016-12-22 | 2020-10-13 | Nicira, Inc. | Collecting and processing contextual attributes on a host |
| US10805332B2 (en) | 2017-07-25 | 2020-10-13 | Nicira, Inc. | Context engine model |
| US10812451B2 (en) | 2016-12-22 | 2020-10-20 | Nicira, Inc. | Performing appID based firewall services on a host |
| US10803173B2 (en) | 2016-12-22 | 2020-10-13 | Nicira, Inc. | Performing context-rich attribute-based process control services on a host |
| US11032246B2 (en) | 2016-12-22 | 2021-06-08 | Nicira, Inc. | Context based firewall services for data message flows for multiple concurrent users on one machine |
| US10313926B2 (en) | 2017-05-31 | 2019-06-04 | Nicira, Inc. | Large receive offload (LRO) processing in virtualized computing environments |
| US10778651B2 (en) | 2017-11-15 | 2020-09-15 | Nicira, Inc. | Performing context-rich attribute-based encryption on a host |
| US10802893B2 (en) | 2018-01-26 | 2020-10-13 | Nicira, Inc. | Performing process control services on endpoint machines |
| US10862773B2 (en) | 2018-01-26 | 2020-12-08 | Nicira, Inc. | Performing services on data messages associated with endpoint machines |
| US11388141B1 (en) * | 2018-03-28 | 2022-07-12 | Juniper Networks, Inc | Apparatus, system, and method for efficiently filtering packets at network devices |
| US11310202B2 (en) | 2019-03-13 | 2022-04-19 | Vmware, Inc. | Sharing of firewall rules among multiple workloads in a hypervisor |
| US11539718B2 (en) | 2020-01-10 | 2022-12-27 | Vmware, Inc. | Efficiently performing intrusion detection |
| US11108728B1 (en) | 2020-07-24 | 2021-08-31 | Vmware, Inc. | Fast distribution of port identifiers for rule processing |
| US20220038372A1 (en) * | 2020-08-02 | 2022-02-03 | Mellanox Technologies Tlv Ltd. | Stateful filtering systems and methods |
| US11875172B2 (en) | 2020-09-28 | 2024-01-16 | VMware LLC | Bare metal computer for booting copies of VM images on multiple computing devices using a smart NIC |
| US11792134B2 (en) | 2020-09-28 | 2023-10-17 | Vmware, Inc. | Configuring PNIC to perform flow processing offload using virtual port identifiers |
| US20220100432A1 (en) | 2020-09-28 | 2022-03-31 | Vmware, Inc. | Distributed storage services supported by a nic |
| US11593278B2 (en) | 2020-09-28 | 2023-02-28 | Vmware, Inc. | Using machine executing on a NIC to access a third party storage not supported by a NIC or host |
| US11636053B2 (en) | 2020-09-28 | 2023-04-25 | Vmware, Inc. | Emulating a local storage by accessing an external storage through a shared port of a NIC |
| US11863376B2 (en) | 2021-12-22 | 2024-01-02 | Vmware, Inc. | Smart NIC leader election |
| US11899594B2 (en) | 2022-06-21 | 2024-02-13 | VMware LLC | Maintenance of data message classification cache on smart NIC |
| US11928062B2 (en) | 2022-06-21 | 2024-03-12 | VMware LLC | Accelerating data message classification with smart NICs |
| US11928367B2 (en) | 2022-06-21 | 2024-03-12 | VMware LLC | Logical memory addressing for network devices |
Family Cites Families (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5400331A (en) * | 1993-04-28 | 1995-03-21 | Allen-Bradley Company, Inc. | Communication network interface with screeners for incoming messages |
| US5623601A (en) * | 1994-11-18 | 1997-04-22 | Milkway Networks Corporation | Apparatus and method for providing a secure gateway for communication and data exchanges between networks |
| US5802320A (en) * | 1995-05-18 | 1998-09-01 | Sun Microsystems, Inc. | System for packet filtering of data packets at a computer network interface |
| US5648965A (en) * | 1995-07-07 | 1997-07-15 | Sun Microsystems, Inc. | Method and apparatus for dynamic distributed packet tracing and analysis |
| US5801753A (en) * | 1995-08-11 | 1998-09-01 | General Instrument Corporation Of Delaware | Method and apparatus for providing an interactive guide to events available on an information network |
| US6147976A (en) * | 1996-06-24 | 2000-11-14 | Cabletron Systems, Inc. | Fast network layer packet filter |
| US5828833A (en) * | 1996-08-15 | 1998-10-27 | Electronic Data Systems Corporation | Method and system for allowing remote procedure calls through a network firewall |
| US6119236A (en) * | 1996-10-07 | 2000-09-12 | Shipley; Peter M. | Intelligent network security device and method |
| US5835727A (en) * | 1996-12-09 | 1998-11-10 | Sun Microsystems, Inc. | Method and apparatus for controlling access to services within a computer network |
| US6070242A (en) * | 1996-12-09 | 2000-05-30 | Sun Microsystems, Inc. | Method to activate unregistered systems in a distributed multiserver network environment |
| US6073178A (en) * | 1996-12-09 | 2000-06-06 | Sun Microsystems, Inc. | Method and apparatus for assignment of IP addresses |
| US5848233A (en) * | 1996-12-09 | 1998-12-08 | Sun Microsystems, Inc. | Method and apparatus for dynamic packet filter assignment |
| US6208651B1 (en) * | 1997-06-10 | 2001-03-27 | Cornell Research Foundation, Inc. | Method and system for masking the overhead of protocol layering |
| US6158008A (en) * | 1997-10-23 | 2000-12-05 | At&T Wireless Svcs. Inc. | Method and apparatus for updating address lists for a packet filter processor |
| US6092110A (en) * | 1997-10-23 | 2000-07-18 | At&T Wireless Svcs. Inc. | Apparatus for filtering packets using a dedicated processor |
| EP1062785A2 (en) * | 1998-03-18 | 2000-12-27 | Secure Computing Corporation | System and method for controlling interactions between networks |
| US6092108A (en) * | 1998-03-19 | 2000-07-18 | Diplacido; Bruno | Dynamic threshold packet filtering of application processor frames |
| AU5567499A (en) * | 1998-08-17 | 2000-03-06 | Vitesse Semiconductor Corporation | Packet processing architecture and methods |
-
2000
- 2000-03-02 US US09/517,276 patent/US6496935B1/en not_active Expired - Lifetime
-
2001
- 2001-02-26 AU AU2001241717A patent/AU2001241717B2/en not_active Ceased
- 2001-02-26 NZ NZ520984A patent/NZ520984A/en unknown
- 2001-02-26 AU AU4171701A patent/AU4171701A/en active Pending
- 2001-02-26 KR KR1020027011384A patent/KR20020092972A/en not_active Application Discontinuation
- 2001-02-26 BR BR0109035-6A patent/BR0109035A/en not_active Application Discontinuation
- 2001-02-26 PL PL01357181A patent/PL357181A1/en unknown
- 2001-02-26 CA CA002401577A patent/CA2401577C/en not_active Expired - Fee Related
- 2001-02-26 WO PCT/US2001/005925 patent/WO2001065343A1/en active IP Right Grant
- 2001-02-26 EP EP01912998A patent/EP1266277B1/en not_active Expired - Lifetime
- 2001-02-26 CN CNB018058892A patent/CN100474213C/en not_active Expired - Fee Related
- 2001-02-26 AT AT01912998T patent/ATE312463T1/en not_active IP Right Cessation
- 2001-02-26 DE DE60115615T patent/DE60115615T2/en not_active Expired - Lifetime
- 2001-02-26 EA EA200200814A patent/EA004423B1/en not_active IP Right Cessation
- 2001-02-26 IL IL15152201A patent/IL151522A0/en active IP Right Grant
- 2001-02-26 JP JP2001563973A patent/JP3954385B2/en not_active Expired - Lifetime
- 2001-02-26 HU HU0300039A patent/HUP0300039A2/en unknown
-
2002
- 2002-08-28 IL IL151522A patent/IL151522A/en unknown
- 2002-08-29 NO NO20024113A patent/NO324958B1/en not_active IP Right Cessation
Also Published As
| Publication number | Publication date |
|---|---|
| EA004423B1 (en) | 2004-04-29 |
| JP2003525557A (en) | 2003-08-26 |
| NO324958B1 (en) | 2008-01-14 |
| IL151522A (en) | 2007-12-03 |
| NZ520984A (en) | 2003-02-28 |
| NO20024113L (en) | 2002-11-01 |
| WO2001065343A1 (en) | 2001-09-07 |
| IL151522A0 (en) | 2003-04-10 |
| NO20024113D0 (en) | 2002-08-29 |
| US6496935B1 (en) | 2002-12-17 |
| AU2001241717B2 (en) | 2005-12-22 |
| CA2401577A1 (en) | 2001-09-07 |
| CN1406351A (en) | 2003-03-26 |
| CN100474213C (en) | 2009-04-01 |
| EP1266277A1 (en) | 2002-12-18 |
| EA200200814A1 (en) | 2003-02-27 |
| HUP0300039A2 (en) | 2003-05-28 |
| EP1266277A4 (en) | 2003-07-02 |
| JP3954385B2 (en) | 2007-08-08 |
| PL357181A1 (en) | 2004-07-26 |
| ATE312463T1 (en) | 2005-12-15 |
| AU4171701A (en) | 2001-09-12 |
| EP1266277B1 (en) | 2005-12-07 |
| DE60115615D1 (en) | 2006-01-12 |
| KR20020092972A (en) | 2002-12-12 |
| DE60115615T2 (en) | 2006-07-06 |
| BR0109035A (en) | 2003-06-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2401577C (en) | System, device and method for rapid packet filtering and processing | |
| AU2001241717A1 (en) | System, device and method for rapid packet filtering and processing | |
| US9094372B2 (en) | Multi-method gateway-based network security systems and methods | |
| EP1634175B1 (en) | Multilayer access control security system | |
| KR101026558B1 (en) | A multi-layer based method for implementing network firewalls | |
| US7509673B2 (en) | Multi-layered firewall architecture | |
| US8006297B2 (en) | Method and system for combined security protocol and packet filter offload and onload | |
| EP1231754B1 (en) | Handling information about packet data connections in a security gateway element | |
| US20070022474A1 (en) | Portable firewall | |
| JP2004304752A (en) | System and method of defending attack | |
| JPH11163940A (en) | Method for inspecting packet | |
| WO2007034535A1 (en) | Network device, data relaying method, and program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| MKLA | Lapsed |
Effective date: 20150226 |