Patent US6154775A successfully refreshed from Google Patents.
US6154775A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Methods and apparatus for a computer network firewall with dynamic rule processing with the ability to dynamically alter the operations of rules
Assignee: Palo Alto Networks Inc
•
Filing: 1997-09-12
•
Granted: 2000-11-28
•
Expires: 2017-09-12
Abstract
Abstract The invention provides improved computer network firewalls which include one or more features for increased processing efficiency. A firewall in accordance with the invention can support multiple security policies, multiple users or both, by applying any one of several distinct sets of access rules. The firewall can also be configured to utilize "stateful" packet filtering which involves caching rule processing results for one or more packets, and then utilizing the cached results to bypass rule processing for subsequent similar packets. To facilitate passage to a user, by a firewall, of a separate later transmission which is properly in response to an original transmission, a dependency mask can be set based on session data items such as source host address, destination host address, and type of service. The mask can be used to query a cache of active sessions being processed by the firewall, such that a rule can be selected based on the number of sessions that satisfy the query. Dynamic rules may be used in addition to pre-loaded access rules in order to simplify rule processing. To unburden the firewall of application proxies, the firewall can be enabled to redirect a network session to a separate server for processing.
Inventors
- 👤 Michael John Coss
- 👤 David L. Majette
- 👤 Ronald L. Sharp
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 20:32
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; H04L9/00; H04L9/40
Claims Analysis
Total Claims: 43
Claim 1
Independent Claim
131 words
A method for providing a firewall service in a computer network comprising the steps of: forming an augmented set of rules by including in a currently-loaded initial set of access rules at least one rule which acts to alter the operation of the currently-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the currently-loaded set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 2
Independent Claim
131 words
A method for providing a firewall service in a computer network comprising the steps of: forming an augmented set of rules by including in a currently-loaded initial set of access rules at least one rule which acts to alter the operation of the currently-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the currently-loaded set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 3
Dependent Claim
40 words
The method of claim 1 wherein said firewall service is provided by a firewall and wherein alteration of the operation of the set of rules is performed without losing any connections existing through said firewall when the alteration is executed.
Claim 4
Dependent Claim
42 words
The method of claim 1 wherein said firewall service is provided by a firewall and wherein alteration of the operation of the set of rules is performed without losing a majority of connections existing through said firewall when the alteration is executed.
Claim 5
Dependent Claim
44 words
The method of claim 1 wherein said firewall service is provided by a firewall and said firewall employs a cache to process packets through said firewall, and wherein contents of said cache remain unchanged by alteration of the operation of the set of rules.
Claim 6
Dependent Claim
63 words
The method of claim 1 wherein said firewall service is provided by a firewall servicing multiple domains, wherein alteration of the operation of the set of rules is performed with respect to a set of rules associated with one of the multiple domains, and the other domains continue to operate without losing any connections existing through said firewall when the alteration is executed.
Claim 7
Dependent Claim
65 words
The method of claim 1 wherein said firewall service is provided by a firewall servicing multiple domains, wherein alteration of the operation of the set of rules is performed with respect to a set of rules associated with one of the multiple domains, and the other domains continue to operate without losing a majority of connections existing through said firewall when the alteration is executed.
Claim 8
Dependent Claim
20 words
The method of claim 1 wherein the dynamic rule comprises a time condition which the packet must satisfy for transmission.
Claim 9
Dependent Claim
23 words
The method of claim 1 wherein the dynamic rule is deleted at the end of its lifetime if it has a specified lifetime.
Claim 10
Dependent Claim
16 words
The method of claim 1 wherein the dynamic rule is operative for a single network session.
Claim 11
Dependent Claim
23 words
The method of claim 1 wherein the dynamic rule comprises information which relates to a connection from a remote proxy to a destination.
Claim 12
Dependent Claim
37 words
The method of claim 1 wherein the dynamic rule is applied by a proxy in an file transfer protocol (FTP) application to determine whether an FTP data channel should be established in response to a data request.
Claim 13
Dependent Claim
27 words
The method of claim 1 wherein the dynamic rule specifies a threshold condition such that the dynamic rule is used only when the threshold condition is satisfied.
Claim 14
Dependent Claim
37 words
The method of claim 1 wherein the set of data defines a host group, such that the host group can be modified to add or drop different hosts without altering other aspects of the access rule set.
Claim 15
Dependent Claim
155 words
A computer system for providing a firewall service in a computer network, comprising: a memory for loading therein an initial set of access rules; and a processor coupled to the memory and operative (i) to form an augmented set of rules by including in the loaded initial set of access rules at least one rule which acts to alter the operation of the loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the loaded initial set of access rules and (ii) to use the augmented set of access rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 16
Dependent Claim
155 words
A computer system for providing a firewall service in a computer network, comprising: a memory for loading therein an initial set of access rules; and a processor coupled to the memory and operative (i) to form an augmented set of rules by including in the loaded initial set of access rules at least one rule which acts to alter the operation of the loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the loaded initial set of access rules and (ii) to use the augmented set of access rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 17
Dependent Claim
21 words
The computer system of claim 14 wherein the dynamic rule comprises a time condition which the packet must satisfy for transmission.
Claim 18
Dependent Claim
24 words
The computer system of claim 14 wherein the dynamic rule is deleted at the end of its lifetime if it has a specified lifetime.
Claim 19
Dependent Claim
17 words
The computer system of claim 14 wherein the dynamic rule is operative for a single network session.
Claim 20
Dependent Claim
24 words
The computer system of claim 14 wherein the dynamic rule comprises information which relates to a connection from a remote proxy to a destination.
Claim 21
Dependent Claim
38 words
The computer system of claim 14 wherein the dynamic rule is applied by a proxy in an file transfer protocol (FTP) application to determine whether an FTP data channel should be established in response to a data request.
Claim 22
Dependent Claim
28 words
The computer system of claim 14 wherein the dynamic rule specifies a threshold condition such that the dynamic rule is used only when the threshold condition is satisfied.
Claim 23
Dependent Claim
41 words
The computer system of claim 14 wherein the set of data defines a host group, such that the host group can be modified to add or drop different hosts without altering other aspects of the loaded initial set of access rules.
Claim 24
Dependent Claim
86 words
A dynamic rule for inclusion with access rules in a computer system for packet validation in a computer network, the dynamic rule being formatted like the access rules; and the dynamic rule staying in force for a lesser duration than the access rules; wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 25
Dependent Claim
86 words
A dynamic rule for inclusion with access rules in a computer system for packet validation in a computer network, the dynamic rule being formatted like the access rules; and the dynamic rule staying in force for a lesser duration than the access rules; wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 26
Dependent Claim
21 words
The dynamic rule of claim 22 wherein the dynamic rule comprises a time condition which the packet must satisfy for transmission.
Claim 27
Dependent Claim
24 words
The dynamic rule of claim 22 wherein the dynamic rule is deleted at the end of its lifetime if it has a specified lifetime.
Claim 28
Dependent Claim
17 words
The dynamic rule of claim 22 wherein the dynamic rule is operative for a single network session.
Claim 29
Dependent Claim
24 words
The dynamic rule of claim 22 wherein the dynamic rule comprises information which relates to a connection from a remote proxy to a destination.
Claim 30
Dependent Claim
38 words
The dynamic rule of claim 22 wherein the dynamic rule is applied by a proxy in an file transfer protocol (FTP) application to determine whether an FTP data channel should be established in response to a data request.
Claim 31
Dependent Claim
28 words
The dynamic rule of claim 22 wherein the dynamic rule specifies a threshold condition such that the dynamic rule is used only when the threshold condition is satisfied.
Claim 32
Dependent Claim
38 words
The dynamic rule of claim 22 wherein the set of data defines a host group, such that the host group can be modified to add or drop different hosts without altering other aspects of the access rule set.
Claim 33
Dependent Claim
133 words
A computer system for providing a firewall service in a computer network, comprising: means for forming an augmented set of rules by including in a currently-loaded initial set of access rules at least one rule which acts to alter the operation of the currently-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the currently-loaded set of access rules; and means for using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 34
Dependent Claim
133 words
A computer system for providing a firewall service in a computer network, comprising: means for forming an augmented set of rules by including in a currently-loaded initial set of access rules at least one rule which acts to alter the operation of the currently-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the currently-loaded set of access rules; and means for using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 35
Independent Claim
179 words
A method for providing a firewall service in a computer network comprising the steps of: forming an augmented set of rules by including in a currently-loaded initial set of access rules at least one rule which acts to alter the operation of the currently-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the currently-loaded set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself; further wherein at least one non-dynamic rule of the initial rules has associated therewith at least one set of data which is pointed to by the rule, such that the data within the set can be changed to alter operation of the rule without changing the rule itself.
Claim 36
Independent Claim
179 words
A method for providing a firewall service in a computer network comprising the steps of: forming an augmented set of rules by including in a currently-loaded initial set of access rules at least one rule which acts to alter the operation of the currently-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the currently-loaded set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself; further wherein at least one non-dynamic rule of the initial rules has associated therewith at least one set of data which is pointed to by the rule, such that the data within the set can be changed to alter operation of the rule without changing the rule itself.
Claim 37
Dependent Claim
39 words
The method of claim 31 wherein the set of data defines a host group, such that the host group can be modified to add or drop different hosts without altering other aspects of the initial set of access rules.
Claim 38
Independent Claim
95 words
A method for providing a firewall service in a computer network, comprising the steps of: loading an initial set of rules; and modifying the set of rules without reloading at least one unmodified rule of the loaded initial set of rules; wherein at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 39
Independent Claim
95 words
A method for providing a firewall service in a computer network, comprising the steps of: loading an initial set of rules; and modifying the set of rules without reloading at least one unmodified rule of the loaded initial set of rules; wherein at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 40
Independent Claim
132 words
A method for providing a firewall service in a computer network, comprising the steps of: forming an augmented set of rules by including in a previously-loaded initial set of access rules at least one rule which acts to alter the operation of the previously-loaded initial set of rules under specified conditions without expunging at least one unaltered rule of the previously-loaded initial set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 41
Independent Claim
132 words
A method for providing a firewall service in a computer network, comprising the steps of: forming an augmented set of rules by including in a previously-loaded initial set of access rules at least one rule which acts to alter the operation of the previously-loaded initial set of rules under specified conditions without expunging at least one unaltered rule of the previously-loaded initial set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 42
Independent Claim
132 words
A method for providing a firewall service in a computer network, comprising the steps of: forming an augmented set of rules by including, in an already-loaded initial set of access rules, at least one dynamic rule which acts to alter the operation of the already-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the already-loaded set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
Claim 43
Independent Claim
132 words
A method for providing a firewall service in a computer network, comprising the steps of: forming an augmented set of rules by including, in an already-loaded initial set of access rules, at least one dynamic rule which acts to alter the operation of the already-loaded initial set of rules under specified conditions without reloading at least one unaltered rule of the already-loaded set of access rules; and using the augmented set of rules in validating a packet; wherein the at least one rule is a dynamic rule and further wherein the dynamic rule has associated therewith at least one set of data which is pointed to by the dynamic rule, such that the data within the set can be changed to alter the operation of the rule without changing the rule itself.
References Cited (Backward Citations)
US5006985A
Cited
US5822303A
Cited
US5481647A
Cited
US5720006A
Cited
WO1997000471A2
Cited
US5835726A
Cited
US5696702A
Cited
EP0743777A2
Cited
WO1997002734A2
Cited
US5774670A
Cited
US5826014A
Cited
US5761683A
Cited
WO1997049038A1
Cited
US5898830A
Cited
US5848233A
Cited
EP0856974A2
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-11-28 | 2004-05-29 | 2004-11-28 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-11-28 | 2008-05-29 | 2008-11-28 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-11-28 | 2012-05-29 | 2012-11-28 | $7700.00 | Window Closed / Lapsed |