US6098172A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Methods and apparatus for a computer network firewall with proxy reflection
Assignee: Nokia of America Corp
•
Filing: 1997-09-12
•
Granted: 2000-08-01
•
Expires: 2017-09-12
Abstract
Abstract Computer network firewalls which include one or more features for increased processing efficiency are provided. A firewall in accordance with the invention can support multiple security policies, multiple users or both, by applying any one of several distinct sets of access rules. The firewall can also be configured to utilize "stateful" packet filtering which involves caching rule processing results for one or more packets, and then utilizing the cached results to bypass rule processing for subsequent similar packets. To facilitate passage to a user, by a firewall, of a separate later transmission which is properly in response to an original transmission, a dependency mask can be set based on session data items such as source host address, destination host address, and type of service. The mask can be used to query a cache of active sessions being processed by the firewall, such that a rule can be selected based on the number of sessions that satisfy the query. Dynamic rules may be used in addition to pre-loaded access rules in order to simplify rule processing. To unburden the firewall of application proxies, the firewall can be enabled to redirect a network session to a separate server for processing.
Inventors
- 👤 Michael John Coss
- 👤 David L. Majette
- 👤 Ronald L. Sharp
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 21:17
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0254
Claims Analysis
Total Claims: 49
Claim 1
Independent Claim
81 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be fulfilled by a remote server; and when granting the request by the firewall requires a service which can be fulfilled by a remote server, redirecting one or more packets associated with said request to said remote server.
Claim 2
Independent Claim
81 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be fulfilled by a remote server; and when granting the request by the firewall requires a service which can be fulfilled by a remote server, redirecting one or more packets associated with said request to said remote server.
Claim 3
Dependent Claim
17 words
The method of claim 1 wherein the ascertaining step comprises the step of using session key data.
Claim 4
Dependent Claim
21 words
The method of claim 1 wherein the ascertaining step comprises the step of using session key data in a table look-up.
Claim 5
Dependent Claim
27 words
The method of claim 1 wherein the fulfilling step includes having the service, when the service is performed, appear to the destination as coming from the source.
Claim 6
Independent Claim
92 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be provided by a remote server; and when granting the request by the firewall requires a service which can be provided by a remote server, redirecting one or more packets associated with said request to said remote server so that the service can be provided by said remote server.
Claim 7
Independent Claim
92 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be provided by a remote server; and when granting the request by the firewall requires a service which can be provided by a remote server, redirecting one or more packets associated with said request to said remote server so that the service can be provided by said remote server.
Claim 8
Dependent Claim
17 words
The method of claim 5 wherein the ascertaining step comprises the step of using session key data.
Claim 9
Dependent Claim
21 words
The method of claim 5 wherein the ascertaining step comprises the step of using session key data in a table look-up.
Claim 10
Dependent Claim
33 words
The method of claim 5 further including the step of having one or more packets associated with the service, when the service is performed, appear to the destination as coming from the source.
Claim 11
Independent Claim
81 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be fulfilled by a remote proxy; and when granting the request by the firewall requires a service which can be fulfilled by a remote proxy, redirecting one or more packets associated with said request to said remote proxy.
Claim 12
Independent Claim
81 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be fulfilled by a remote proxy; and when granting the request by the firewall requires a service which can be fulfilled by a remote proxy, redirecting one or more packets associated with said request to said remote proxy.
Claim 13
Dependent Claim
17 words
The method of claim 9 wherein the ascertaining step comprises the step of using session key data.
Claim 14
Dependent Claim
21 words
The method of claim 9 wherein the ascertaining step comprises the step of using session key data in a table look-up.
Claim 15
Dependent Claim
27 words
The method of claim 9 wherein the fulfilling step includes having the service, when the service is performed, appear to the destination as coming from the source.
Claim 16
Independent Claim
92 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be provided by a remote proxy and; when granting the request by the firewall requires a service which can be provided by a remote proxy, redirecting one or more packets associated with said request to said remote proxy so that the service can be provided by said remote proxy.
Claim 17
Independent Claim
92 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be provided by a remote proxy and; when granting the request by the firewall requires a service which can be provided by a remote proxy, redirecting one or more packets associated with said request to said remote proxy so that the service can be provided by said remote proxy.
Claim 18
Dependent Claim
17 words
The method of claim 13 wherein the ascertaining step comprises the step of using session key data.
Claim 19
Dependent Claim
21 words
The method of claim 13 wherein the ascertaining step comprises the step of using session key data in a table look-up.
Claim 20
Dependent Claim
33 words
The method of claim 13 further including the step of having one or more packets associated with the service, when the service is performed, appear to the destination as coming from the source.
Claim 21
Independent Claim
87 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be performed by a remote proxy; and when granting the request by the firewall requires a service which can be performed by a remote proxy, setting up a dynamic rule to enable an appearance of a direct connection from the source to the destination.
Claim 22
Independent Claim
87 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be performed by a remote proxy; and when granting the request by the firewall requires a service which can be performed by a remote proxy, setting up a dynamic rule to enable an appearance of a direct connection from the source to the destination.
Claim 23
Dependent Claim
17 words
The method of claim 17 wherein the ascertaining step comprises the step of using session key data.
Claim 24
Dependent Claim
21 words
The method of claim 17 wherein the ascertaining step comprises the step of using session key data in a table look-up.
Claim 25
Dependent Claim
33 words
The method of claim 17 further including the step of having one or more packets associated with the service, when the service is performed, appear to the destination as coming from the source.
Claim 26
Dependent Claim
71 words
A computer system for providing a firewall service in a computer network, comprising: means for obtaining a request for a session from a source to a destination; means for ascertaining whether the request requires a service which can be performed by a remote server; and means for redirecting one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 27
Dependent Claim
71 words
A computer system for providing a firewall service in a computer network, comprising: means for obtaining a request for a session from a source to a destination; means for ascertaining whether the request requires a service which can be performed by a remote server; and means for redirecting one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 28
Dependent Claim
38 words
The computer system of claim 21 further including: means for informing the remote server of the destination; and means for having one or more packets associated with the performed service go from the remote server to the destination.
Claim 29
Dependent Claim
33 words
The computer system of claim 22 wherein the means for having the one or more packets associated with the performed service go to the destination comprises means for referring to a dynamic rule.
Claim 30
Dependent Claim
47 words
The computer system of claim 22 wherein the means for having the one or more packets associated with the performed service go to the destination comprises means for making one or more packets associated with the performed service appear to the destination as coming from the source.
Claim 31
Dependent Claim
18 words
The computer system of claim 21 wherein the means for ascertaining comprises means for using session key data.
Claim 32
Dependent Claim
22 words
The computer system of claim 21 wherein the means for ascertaining comprises means for using session key data in a table look-up.
Claim 33
Dependent Claim
85 words
A computer system for providing a firewall service in a computer network, comprising a processor which is operable to: obtain a request for a session from a source to a destination; ascertain whether the request requires a service which can be performed by a remote server; and when the request requires a service which can be performed by a remote server, redirect one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 34
Dependent Claim
85 words
A computer system for providing a firewall service in a computer network, comprising a processor which is operable to: obtain a request for a session from a source to a destination; ascertain whether the request requires a service which can be performed by a remote server; and when the request requires a service which can be performed by a remote server, redirect one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 35
Dependent Claim
39 words
The computer system of claim 27 wherein the processor is further operable to inform the remote server of the destination, and have one or more packets associated with the performed service go from the remote server to the destination.
Claim 36
Dependent Claim
32 words
The computer system of claim 28 wherein, for having one or more packets associated with the performed service go to the destination, the processor is operable to refer to a dynamic rule.
Claim 37
Dependent Claim
47 words
The computer system of claim 28 wherein, in having one or more packets associated with the performed service go to the destination, the processor is operable to make the one or more packets associated with the performed service appear to the destination as coming from the source.
Claim 38
Dependent Claim
20 words
The computer system of claim 27 wherein, for the ascertaining operation, the processor is operable to use session key data.
Claim 39
Dependent Claim
24 words
The computer system of claim 27 wherein, for the ascertaining operation, the processor is operable to use session key data in a table look-up.
Claim 40
Independent Claim
92 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be provided by a remote proxy; and when granting the request by the firewall requires a service which can be provided by a remote proxy, reflecting one or more packets associated with said request to said remote proxy so that the service can be performed by the remote proxy.
Claim 41
Independent Claim
92 words
A method for providing a firewall service in a computer network, comprising the steps of: receiving a request, at a firewall, for a session from a source to a destination; ascertaining whether granting the request by the firewall requires a service which can be provided by a remote proxy; and when granting the request by the firewall requires a service which can be provided by a remote proxy, reflecting one or more packets associated with said request to said remote proxy so that the service can be performed by the remote proxy.
Claim 42
Dependent Claim
36 words
The method of claim 33 further including the steps of: informing the remote proxy of the destination; and having one or more packets associated with the performed service go from the remote proxy to the destination.
Claim 43
Independent Claim
67 words
A method for providing a firewall service in a computer network, comprising the steps of: obtaining a request for a session from a source to a destination; ascertaining whether the request requires a service which can be met by a remote server; and reflecting one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 44
Independent Claim
67 words
A method for providing a firewall service in a computer network, comprising the steps of: obtaining a request for a session from a source to a destination; ascertaining whether the request requires a service which can be met by a remote server; and reflecting one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 45
Dependent Claim
98 words
Apparatus for providing a firewall service in a computer network, the apparatus comprising: at least one processor operable to receive a request, at a firewall, for a session from a source to a destination, to ascertain whether granting the request by the firewall requires a service which can be provided by a remote proxy and, when granting the request by the firewall requires a service which can be provided by a remote proxy, to reflect one or more packets associated with said request to said remote proxy so that the service can be performed by the remote proxy.
Claim 46
Dependent Claim
98 words
Apparatus for providing a firewall service in a computer network, the apparatus comprising: at least one processor operable to receive a request, at a firewall, for a session from a source to a destination, to ascertain whether granting the request by the firewall requires a service which can be provided by a remote proxy and, when granting the request by the firewall requires a service which can be provided by a remote proxy, to reflect one or more packets associated with said request to said remote proxy so that the service can be performed by the remote proxy.
Claim 47
Dependent Claim
38 words
The apparatus of claim 36 wherein the processor is further operable to inform the remote proxy of the destination so that one or more packets associated with the performed service go from the remote proxy to the destination.
Claim 48
Dependent Claim
73 words
Apparatus for providing a firewall service in a computer network, the apparatus comprising: at least one processor operable to obtain a request for a session from a source to a destination, to ascertain whether the request requires a service which can be met by a remote server, and to reflect one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
Claim 49
Dependent Claim
73 words
Apparatus for providing a firewall service in a computer network, the apparatus comprising: at least one processor operable to obtain a request for a session from a source to a destination, to ascertain whether the request requires a service which can be met by a remote server, and to reflect one or more packets associated with the request to the remote server so that the service can be performed by the remote server.
References Cited (Backward Citations)
US5835726A
Cited
WO1997000471A2
Cited
US5623601A
Cited
US5884025A
Cited
EP0743777A2
Cited
WO1997002734A2
Cited
US5689566A
Cited
US5793763A
Cited
US5781550A
Cited
US5673322A
Cited
WO1997049038A1
Cited
US5828833A
Cited
US6003084A
Cited
US5898830A
Cited
US5848233A
Cited
US5845068A
Cited
EP0856974A2
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-08-01 | 2004-01-31 | 2004-08-01 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-08-01 | 2008-01-31 | 2008-08-01 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-08-01 | 2012-01-31 | 2012-08-01 | $7700.00 | Window Closed / Lapsed |