Firewall security method and apparatus

FIELD OF THE INVENTION

The present invention relates to network security and, more particularly, to a firewall security technique employed in computer networks.

BACKGROUND OF THE INVENTION

Advances in communications technology and the availability of powerful desktop computer hardware has increased the use of computers to access a variety of publicly available computer networks. For example, the speed of modems, which are well-known communication devices used for transforming a digital bit stream into an analog signal, has significantly increased thereby providing for the high-speed exchange of information across, e.g., the public switched telephone network (PSTN.) Today, a tremendous amount of information is exchanged between individual users located around the world via public computer networks, e.g., the Internet. One class of users includes private individuals and professional users interconnected via a private network, e.g., a corporate intranet.

The exchange of information between private and public computer networks has presented a variety of critical security issues for the protection of information on the private computer networks and the overall functionality of the private computer network itself. Numerous well publicized accounts exist of individuals known as “hackers” who have improperly breached the security of private computer networks and caused severe damage. In particular, some of the most sophisticated types of security threats are posed by programs which exploit certain vulnerabilities within network computing systems. To name a few, these program-related security threats include well-known logic bombs, trapdoors, trojan horses, viruses and worms, as described, e.g., by W. Stallings, <i>Network and Internetwork Security Principles and Practice</i>, Prentice-Hall, Inc., Englewood Cliffs, N.J., 1995. Such well-known software program threats either work independently (e.g., worms) to achieve their desired security breach, or require the invocation of a host program to be invoked to perform the desired disruptive actions (e.g., trapdoors, logic bombs, trojan horses or viruses.) Such damage has included the destruction of electronic files, alteration of databases, or the introduction of computer viruses which affect the operability of the private computer network or computer hardware connected to the private network.

Computer network security, at a minimum, is directed to ensuring the reliable operation of computing and networking resources, and protecting information within the private network from unauthorized disclosure or access. Network administrators responsible for the operation of private computer networks employ a variety of security measures to protect the network from external security breaches by unauthorized users. One well-known technique uses so-called “firewalls”. This security scheme essentially places a separate computer system, i.e., the firewall, between the private network and the public network, e.g., the Internet. Commonly, these firewalls are software-based gateways that are typically installed on a separate server to protect computers on a local area network (“LAN”) within a private network from attacks by outsiders, i.e., unauthorized users.

In particular, the firewall server maintains control over communications from and to the private network. Essentially, the firewall server imposes certain security measures on all users employing the private network. For example, firewalls may block access to new Internet services or sites on the well-known World Wide Web (“WWW”) because the security consequences are unknown or not accounted for by the present firewall configuration. One potential installation configuration of a firewall is that WWW clients can no longer directly contact WWW servers. Typically, this proves too restrictive, and network administrators employ so-called “proxy servers”. Proxy servers are designed with certain features which provide for the forwarding of requests from WWW clients through the firewall thereby providing communication flow to and from servers on the Internet.

FIG. 1 shows such a prior art network configuration <b>100</b> employing separate servers, e.g., firewall server <b>120</b> and proxy server <b>140</b>, for delivering firewall security to, e.g., private network <b>130</b>. As shown in FIG. 1, firewall server <b>120</b> is a separate computer system situated between public network <b>110</b> and private network <b>130</b> for delivering network security measures to the communications exchanged between the networks. As will be appreciated, the investment in delivering the server-based firewall of FIG. 1 from a hardware, facilities management and network management perspective is significant. Of course, for very large private networks the cost of installing and maintaining such a dedicated server-based firewall is justified in view of the potential damage which network security breaches can inflict inside the private network. However, for small/medium sized networks and individual computer users, the cost of a server-based firewall security configuration can be prohibitive.

A need exists therefore for a client-based firewall technique which provides for network security within e.g., a private network.

SUMMARY OF THE INVENTION

The present invention provides a technique for delivering a client-based firewall. In accordance with the invention, a firewall security device is configured for connection to individual clients, e.g., personal computers, for providing firewall security measures directly to the client. The firewall security device, in accordance with the preferred embodiment of the invention, is configured as a electronic dongle which is attached to a communications port of the client, e.g., the parallel communications port. In accordance with the invention, the incoming communications stream to the client from, e.g., public networks, is passed through the firewall security device. In this way, the firewall security device applies and delivers a set of standard security routines thereby protecting the client from security breaches triggered by the communications traffic received from the public network. Illustratively, the set of security routines define at least one security level to which all communications exchanged by the client must comply thereby insuring that the integrity of the private network in which the client is interconnected. Advantageously, in accordance with the invention, the firewall is delivered directly by the client without intervention, use, or connection to a separate firewall server.

Electronic dongle devices are not new. Dongles have been used previously for the protection and control of individual software programs. Such dongles are described in, for example, U.S. Pat. No. 5,668,419, issued to O. Oktay, entitled “Reconfigurable Connector” which describes a reconfigurable connector for a peripheral device, and U.S. Pat. No. 5,568,552, issued to D. L. Davis, entitled “Method For Providing A Roving Software License From One Node To Another Node” which describes a device for enforcing certain software licensing restrictions. One conventional use of dongles was the packing of such devices along with a particular software package purchased or licensed by an individual user. Typically, the dongle was coupled to the parallel port of the user's personal computer. Thereafter, at various times during the execution of the software by the user, the software program transmits an authorization message to the computer's external communications port. Upon receipt of such a message, the dongle (if present) generates a unique identifier, e.g., a token, for transmission back to the executing software program. If the dongle is not present, the software program terminates. Otherwise, the software program compares the token to an internally stored identifier and permits further execution only if the responses match.

Thus, dongles are well-known devices for controlling access to and execution of individual programs by authorized users. It has, however, remained for the inventors herein to recognize that such devices provide an elegant tool by which a client-based firewall can be delivered to the reduce the risk of computer network security breaches in today's complex computer network arrangements resulting from the widespread exchange of communications between a variety of disparate networks.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a network configuration having a prior art server-based firewall;

FIG. 2 shows an illustrative firewall security device configured in accordance with the principles of the invention;

FIG. 3 shows an illustrative client configured with the firewall security device of FIG. 2 for delivering a client-based firewall in accordance with the invention;

FIG. 4 is a flowchart of illustrative operations performed, in accordance with the invention, by the firewall security device of FIG. 2;

FIG. 5 shows an illustrative system incorporating the client-based firewall of the invention and as depicted, illustratively, in FIG. <b>2</b> and FIG. 3; and

FIG. 6 shows an illustrative TCP/IP stack arrangement of the client configured with the firewall security device as shown in FIG. <b>3</b>.

DETAILED DESCRIPTION

The present invention provides a technique for delivering a client-based firewall. In accordance with the invention, a firewall security device is configured for connection to individual clients, e.g., personal computers, for providing firewall security measures directly to the client. The firewall security device, in accordance with the preferred embodiment of the invention, is configured as a electronic dongle which is attached to a communications port of the client, e.g., the parallel communications port. In accordance with the invention, the incoming communications stream to the client from, e.g., public networks, is passed through the firewall security device. In this way, the firewall security device applies and delivers a set of standard security routines thereby protecting the client from security breaches triggered by the communications traffic received from the public network. Illustratively, the set of security routines define at least one security level to which all communications exchanged by the client must comply thereby insuring the integrity of the private network in which the client is interconnected. Advantageously, in accordance with the invention, the firewall is delivered directly by the client without intervention, use, or connection to a separate firewall server.

FIG. 2 shows an illustrative firewall security device <b>200</b> configured in accordance with the principles of the invention. More particularly, firewall security device <b>200</b> includes processor <b>205</b>, communications buffer <b>210</b>, peripheral device I/O interface <b>215</b>, memory element <b>220</b> (comprising random access memory (“RAM”) <b>225</b> and non-volatile memory <b>230</b>), firewall routines <b>235</b>, cryptography routines <b>240</b> and connector <b>245</b>. Connector <b>245</b> is, illustratively, a conventional parallel-type connector (e.g., a DB-25 connector) for coupling to, illustratively, a standard parallel communications port of a personal computer. In accordance with preferred embodiments of the invention, firewall security device <b>200</b> is powered in a conventional manner as supplied from, e.g., the parallel communications port into which firewall security device <b>200</b> is connected. In accordance with further embodiments of the invention, power is supplied to firewall security device <b>200</b> from a conventional battery source incorporated within the device itself. As will be appreciated, memory element <b>220</b> further includes RAM <b>225</b> in order to store data, e.g., certain computational results, generated in a conventional manner from processor <b>205</b>.

Turning our attention briefly to FIG. 3, an illustrative embodiment of the invention is shown for configuring a user terminal, e.g., personal computer <b>300</b>, with firewall security device <b>200</b> by connecting (see, directional arrow <b>310</b>) firewall security device <b>200</b> to parallel communications port <b>305</b>. Thus configured, firewall security device <b>200</b>, in accordance with the invention, provides personal computer <b>300</b> with a complete client-based firewall security arrangement as further described below. As will be appreciated, the user terminal can by any hardware apparatus (e.g., stand-alone personal computer, networked personal computer, network terminal, etc.) which requires some level of security protection from unauthorized access to the apparatus itself or the network in which the apparatus is interconnected. Advantageously, in accordance with the invention, a client-based firewall is delivered without the need for the user terminal, e.g., personal computer <b>300</b>, to have a connection with a separate server in a private network for the delivery of firewall security measures.

Turning our attention back to FIG. 2, peripheral device I/O interface <b>215</b> facilitates the transfer of a communications stream through firewall security device <b>200</b> in accordance with the invention. As will be appreciated the communications stream represents any conventional exchange of information by, e.g., a personal computer. For example, the communications stream can be a series of data bits as exchanged via conventional modem devices or a plurality of Transfer Control Protocol/Internet Protocol (“TCP/IP”) packets. Thus, the principles of the invention apply to a variety of communications streams for delivering the various security aspects of the invention. As will be readily understood, the communications stream is, in accordance with various embodiments of the invention, data which is exchanged via a conventional TCP/IP connection between a user terminal and network resource. As is well-known, TCP/IP is the protocol which is used in describing the way in which information is transferred across the Internet. Essentially, TCP/IP separates information into individual packets and routes these packets between the sending computer, e.g., server, and the receiving computer, e.g., client. TCP/IP and Internet communications are discussed in more detail, e.g., by D. Comer., <i>Internetworking with TCP/IP</i>, Third edition, Prentice-Hall, Englewood Cliffs, N.J., 1995.

That is, when firewall security device <b>200</b> is connected to a user terminal, e.g., as shown in FIG. 3, all communications traffic to and from the user terminal is passed through firewall security device <b>200</b>. Thus, peripheral device I/O interface <b>215</b> facilitates the exchange of data communications between the firewall security device <b>200</b>, the user terminal to which firewall security device <b>200</b> is connected, and some external network, e.g., the Internet. The data communications exchange itself occurs in a conventional manner, e.g., in accordance with well-known parallel data communications transfers between computer hardware devices. In accordance with the preferred embodiment of the invention, the user terminal to which firewall security device <b>200</b> is connected has certain conventional software drivers to facilitate the direction of all communications traffic exchanged by the user terminal through firewall security device <b>200</b>. In accordance with preferred embodiments of the invention, such software drivers are in the form of well-known dynamic link library (“DLL”) drivers. DLL's are well-known libraries of functions that applications link to at execution time as opposed to compile time and are described in more detail, e.g., by A. King, <i>Inside Windows</i>™95, Microsoft Press, Redmond, Wash., 1994. Thus, in accordance with the preferred embodiments of the invention, DLL's provide the facilities for the direction of all communications traffic exchanged by the user terminal through firewall security device <b>200</b>.

For example, the DLL can provide an additional layer in a conventional TCP/IP stack, between either the user terminal and IP layers, or between IP layers and well-known TCP/UDP layers, to intercept, divert, and/or block packets in accordance with invention. More particularly, turning our attention briefly to FIG. 6, an illustrative TCP/IP stack <b>600</b> arrangement is shown for a client configured with firewall security device <b>200</b> (see, e.g., the client configuration shown in FIG. 3.) TCP/IP stack <b>600</b> residing on the client, e.g., personal computer <b>300</b>, has various conventional layers such as ethernet layer <b>630</b>, IP layer <b>650</b>, TCP layer <b>660</b>, and application layer <b>670</b>. As will be understood, such layers correspond to the well-known network interface layer, network (Internet) layer, transport layer, and application layer, respectively, of the standard TCP/IP stack. In accordance with this embodiment of the invention, TCP/IP stack <b>600</b> further includes firewall security layer <b>640</b> implemented through a DLL, as described above, which facilitates the direction of all communications traffic exchanged by the client through firewall security device <b>200</b> for delivering the various security aspects of the invention.

For example, as shown in FIG. 6, incoming communications stream <b>610</b> (e.g., as received by personal computer <b>300</b>) is received and processed through ethernet layer <b>630</b> and immediately directed through firewall security device <b>200</b> for delivery of the client-base firewall in accordance with the invention. The direction of incoming communications stream <b>610</b> is facilitated by firewall security layer <b>640</b> as well as the continuing transmission and processing of incoming communications stream <b>610</b> up through TCP/IP stack <b>600</b>. Further, outgoing communications stream <b>620</b> from the client, e.g., personal computer <b>300</b>, is also transmitted down through TCP/IP <b>600</b> stack to firewall security device <b>200</b> to ensure the security of the outgoing transmission, in accordance with the client-based firewall of the invention. As described above, in accordance with preferred embodiments of the invention, the exchange of communications between the client and firewall security device <b>200</b> is enable through the direct coupling of the security device to the parallel communications port of the client.

In various embodiments of the invention, communications buffer <b>210</b>, e.g., a first-in-first-out (“FIFO”) buffer, is used for queuing, in a conventional manner, the incoming communications stream to firewall security device <b>200</b>. As will be appreciated, in further embodiments of the invention, the need for communications buffer <b>210</b> can be eliminated when, e.g., the speed or configuration of processor <b>205</b> eliminates the need for any such data buffering. Processor <b>205</b> in conjunction with firewall routines <b>235</b> and cryptography routines <b>240</b> facilitate the delivery of the client-based firewall in accordance with the principles of the invention.

That is, in accordance with the preferred embodiment of the invention, firewall routines <b>235</b> and cryptography routines <b>240</b> govern the specific firewall security measures which will be applied to any communications stream being transmitted through the particular user terminal, e.g., personal computer <b>300</b>, to which firewall security device <b>200</b> is connected. As described previously, firewall routines <b>235</b> and/or cryptography routines <b>240</b> define at least one security level to which the communications stream of the user terminal must comply. Illustratively, firewall routines <b>235</b> are delivered by commercially available firewall application software, e.g., the Lucent Managed Firewall available from Lucent Technologies Inc., which provide for conventional firewall functions such as the filtering and auditing of a communications stream at the packet, circuit, and/or application levels. Further, cryptography routines <b>240</b> include, e.g., symmetric cryptography routines such as well-known Data Encryption Standard (“DES”) routines, or asymmetric cryptography routines such as well-known Rivest-Shamir-Adleman (“RSA”) routines. As will be appreciated, firewall routines <b>235</b> and cryptography routines <b>240</b> can be periodically updated directly by the user of firewall security device <b>200</b> or by downloading certain updated routines from a central source, e.g., a server on the Internet.

In accordance with the invention, firewall routines <b>235</b> facilitate the delivery of firewall security measures by firewall security device <b>200</b> to, e.g., the user terminal to which it is connected. For example, firewall security device <b>200</b> may deliver a packet or circuit filter which permits all outgoing TCP connections but blocks all incoming TCP connections (except electronic mail) and also blocks all conventional User Datagram Protocol C“UDP”) packets except for well-known Domain Name Service (“DNS”) packets. Further, illustratively, firewall security device <b>200</b> can deliver an application-level filter for checking the addressing and content of electronic mail transmitted to/from, e.g. personal computer <b>300</b>, for appropriate addressing schemes, file size, and/or the presence of computer viruses. As will be appreciated, in accordance with the invention, firewall security device <b>200</b> can be configured to deliver a wide variety of firewall filtering arrangements useful in detecting and averting network security breaches.

FIG. 4 is a flowchart of illustrative operations performed by firewall security device <b>200</b> (see, FIG. 2) in accordance with the principles of the invention. In particular, the communications stream exchanged by the user terminal to which firewall security device <b>200</b> is connected is received (see, block <b>400</b>) by firewall security device <b>200</b>. As described above, in accordance various embodiments of the invention, the communications stream is a plurality of TCP/IP packets being routed from a source machine to a destination machine. Thus, firewall security device <b>200</b> applies the particular security measures defined by firewall routines <b>235</b> to the communications stream (see, block <b>405</b>). Therefore, through the application of firewall routines <b>235</b> and/or cryptography routines <b>240</b>, firewall security device <b>200</b> is enabled for determining whether the communications stream complies with the desired security level for the client to which firewall security device <b>235</b> is connected. Moreover, in accordance with the invention, firewall security device <b>200</b> provides for the detection of specific security violations contained within the communications stream and/or suspect communications (see, block <b>410</b>) which may lead to a security breach. If no such security violations are detected, the communications traffic is passed and continued for further transmission to the user terminal (see, block <b>425</b>.) Otherwise, if a security violation is detected, the individual non-complying packets are identified and blocked from further transmission (see, block <b>415</b>) within the user terminal thereby protecting the user terminal from any potential security breach. In further embodiments of the invention, it may also be desirable to generate a security alert (see, block <b>420</b>) to, e.g., a network security administrator, for further remedial action in addressing the security breach.

To further facilitate an understanding of the invention and further to the description of the invention above, FIG. 5 shows an illustrative system incorporating the client-based firewall of the invention. As shown in FIG. 5, the system includes public network <b>500</b>, e.g., the Internet, and network resources <b>505</b>, <b>510</b>, <b>515</b>, <b>520</b>, and <b>525</b>. Illustratively, network resources <b>505</b> through <b>525</b> can be linked together using files written in the well-known Hypertext Mark-up Language (“HTML”) thereby representing the well-known WWW. The WWW and HTML are described in more detail, e.g., by B. White, <i>HTML and the Art of Authoring for the World Wide Web</i>, Kluwer Academic Publishers, Norwell, Mass., 1996. Illustratively, private network <b>530</b> is a network located within a particular user site, e.g., a corporation's headquarters building, having user terminals <b>535</b>-<b>1</b>, <b>535</b>-<b>2</b>, <b>535</b>-<b>3</b>, and <b>535</b>-<b>4</b>, each configured, in accordance with the invention, with firewall security device <b>200</b> and linked together via LAN <b>545</b>. As will be appreciated, user terminals <b>535</b>-<b>1</b> through <b>5354</b> can be, e.g., stand-alone personal computers or network terminals. For simplicity of explanation herein, only one such LAN configuration is shown in FIG. 5, however, as will be appreciated private network <b>530</b> may include several such LAN configurations similar in nature to LAN <b>545</b>.

A particular user of any one of user terminals <b>535</b>-<b>1</b> through <b>535</b>-<b>4</b> may cause a client program executing on, e.g., user terminal <b>535</b>-<b>3</b>, to request certain resources which are available on the WWW, e.g., network resources <b>505</b>-<b>525</b>. As mentioned previously, such requests to the WWW via the Internet from private network <b>530</b> pose certain security risks to both private network <b>530</b> and user terminals <b>535</b>-<b>1</b> through <b>535</b>-<b>4</b>. Thus, as shown in FIG. 5, user terminals <b>535</b>-<b>1</b>, <b>535</b>-<b>2</b>, <b>535</b>-<b>3</b> and <b>535</b>-<b>4</b>, are each configured with firewall security device <b>200</b> (see, also FIG. 3) for the delivery of certain security features, in accordance with the invention, to protect private network <b>530</b> and its various computing resources. Illustratively, firewall security device <b>200</b> is configured either locally, e.g., directly by user terminal <b>535</b>-<b>1</b>, or from central source, e.g., a communications server <b>550</b>. Advantageously, in accordance with the invention, the need for a separate firewall computer system, i.e., a firewall server, between private network <b>530</b> and public network <b>560</b>, e.g., the Internet, is completely eliminated.

That is, the firewall security device <b>200</b> attached to each of user terminals <b>535</b>-<b>1</b> through <b>535</b>-<b>4</b> monitors and maintains control over communications from and to the terminals. More particularly, the client-based firewall of the invention first determines if the requested connection between a user terminal in the private network and the public network is authorized. The client-based firewall serves as an intermediary between the user terminal in the private network and the public network and, if the connection is authorized, facilitates the requisite connection between the two networks. Alternatively, if the connection is unauthorized, the client-based firewall blocks the transmission and prevents any connection between the networks from occurring as described previously.

Illustratively, a user employing user terminal <b>535</b>-<b>3</b> may access certain web pages on the WWW using web browser <b>540</b>. Web browsers are well-known software application programs (e.g., Netscape® v. 5.0, available from Netscape Communications) which enable a user to traverse the WWW and access the vast amount of information available throughout the WWW. Thus, web browser <b>540</b> receives an input request from the user of user terminal <b>535</b>-<b>3</b> and attempts to locate the information on the WWW by establishing a connection with the appropriate resource, e.g., network resource <b>505</b>, on the WWW through public network <b>500</b>. An authorized communication between user terminal <b>535</b>-<b>3</b> and network resource <b>505</b> is established through firewall security device <b>200</b> as connected to user terminal <b>535</b>-<b>3</b>. More particularly, firewall security device <b>200</b>, acting in conjunction with and on behalf of web browser <b>540</b>, will control the establishment of a conventional TCP/IP connection between user terminal <b>535</b>-<b>3</b> and network resource <b>505</b>. In accordance with the present embodiment, the TCP/IP connection between user terminal <b>535</b>-<b>3</b> and network resource <b>505</b> is made using communications server <b>550</b> and across communication channels <b>555</b> and <b>560</b>, respectively.

As seen from FIG. 5, all communications traffic between public network <b>500</b> and user terminals <b>535</b>-<b>1</b> through <b>525</b>-<b>4</b> of private network <b>530</b> necessarily passes through the particular firewall security device <b>200</b> connected to the user terminals. In recognition of this communications traffic attribute, we have realized that firewall security device <b>200</b>, in electronic dongle device form, provides a preferred configuration for implementing the security advantages of our invention. However, as will be appreciated, the principles of the invention are also realized in other network environments and configurations.

For example, in accordance with a further embodiment of the invention, portable personal computer <b>536</b> includes firewall security device <b>200</b> connected thereto. Illustratively, a remote user, e.g., a traveling business executive, requiring access to private network <b>530</b> can gain access to communications server <b>550</b> from a public network, e.g., the Internet, in a conventional manner. Upon establishing the connection with communications server <b>550</b>, the user of portable personal computer <b>536</b> can, as described above, access public network <b>500</b> for the downloading of information from, e.g., the Internet. As will be apparent, such remote connection poses similar network security issues as raised by the network resource requests originating from any of the user terminals <b>535</b>-<b>1</b> through <b>535</b>-<b>4</b> located within the physical configuration of private network <b>530</b>. Advantageously, in accordance with the invention, the client-based firewall facilitated by the coupling of firewall security device <b>200</b> to portable personal computer <b>536</b> mitigates such network security concerns.

Our invention allows for the delivery of firewall security measures to any authorized client either inside or outside of the private network without having to be connected to a dedicated network firewall server. Therefore, the security features delivered by the present invention are realized in a variety of network, hardware, and software configurations including, but not limited to, the system configuration of FIG. <b>5</b>. For example, the firewall security device configured in accordance with invention can be used to provide firewall capabilities to routers which are well-known apparatus used for the exchange of messages between local area networks and a backbone, e.g. a wide area network.

The foregoing merely illustrates the principles of the present invention. Therefore, the invention in its broader aspects is not limited to the specific details shown and described herein. Those skilled in the art will be able to devise numerous arrangements which, although not explicitly shown or described herein, embody those principles and are within their spirit and scope.