Method and apparatus for a distributed firewall

Abstract

A method and apparatus for implementing a distributed firewall is described. A packet filter processor receives a packet sent from a first device to a second device. The packet filter processor authenticates an identifier for the packet. For example, authentication could be performed using a cryptographically-verifiable identifier. The packet filter processor determines whether to send the packet to the second device, based on the authentication and a set of policy rules. The packet filter processor sends the packet to the second device in accordance with the determination

Description

FIELD OF THE INVENTION [0001] The invention relates to communications in general. More particularly, the invention relates to a method and apparatus for creating a distributed firewall using cryptographic techniques. BACKGROUND OF THE INVENTION [0002] Conventional firewalls rely on the notions of restricted topology and control entry points to function. More precisely, they rely on the assumption that everyone on one side of the firewall is to be trusted, while those on the other side are not. The vastly expanded Internet connectivity in recent years has called that assumption into question. So-called “extranets” can allow outsiders to reach the “inside” of the firewall. Conversely, telecommuters' machines that traditionally do not have the protection of a firewall use the Internet for connectivity. These machines in particular need protection when encrypted tunnels are not in place. Other trends are also threatening the traditional notion of firewalls. For example, some machines ne...

AI Technical Summary

Problems solved by technology

Other trends are also threatening the traditional notion of firewalls.

Conventional firewalls are not suited to deal with these types of problems, especially as internally assigned Internet Protocol (IP) addresses change.

End-to-end encryption is another threat, since the firewall generally does not have the necessary codes (or keys) to peer through the encryption.

Conventional distributed firewalls, such as the one disclosed in the '668 patent, however, are less than satisfactory for a number of reasons.

For example, the distributed firewall described in the '668 patent is not capable to preventing “spoofing.” Spoofing refers to a technique wherein a packet sender attempts to access a firewall by impersonating another sender's address.

In other words, there is no technique for authenticating the identity of the sender.

In another example, the '668 patent fails to address the telecommuting situation where a user often connects a computer to a corporate network via an unsecured link, e.g., the Internet.

In such a case, there is no mechanism for protecting communications between the corporate network and the telecommuters' computer.

Part of the problem with telecommuters is triangle routing, plus lack of protection for their machines when on the outside Internet.

Images