ES2556252B1 - Firewall method with dynamic rules using SQL - Google Patents

Abstract

Method of a firewall with dynamic rules using SQL, constituted from a firewall device located between two networks: on the one hand the users and on the other side the equipment or networks to be protected, having connectivity to a server where the database base is located equipment inventory data, being in this relational database server where by means of indexed tables and relating by common data the set of IP addresses is obtained, thanks to a structured query language known as SQL, associating one or more SQL statements to the profile of a user and executing these orders when the user logs into the firewall, obtaining and dumping on a file the result with the set of IP addresses or IP networks, which, to that particular user, is allowed or denied Access by applying the filtering rules.

Description

METHOD OF A FIRE FIGHTER WITH DYNAMIC RULES THROUGH SQL

The firewall method with dynamic rules using SQL, structured query language, of the present invention refers to a computer network security server for remote or internal users, with IP traffic firewall capabilities of level 1,2 and 3 of the TCP / IP model, transmission control protocol and Internet protocol, which is integrated as a security complement and allows or blocks a user or host, computer connected to a network, access to other equipment or networks, based on the Identity of the user and in consulting on a relational database server, the equipment allowed. To do this, the method associates each user registered in the firewall with SQL commands, with which a set of addresses is extracted in real time Host IP or network IP addresses. With this set, plus the user's IP address or their Socket, the connection identifier between the user and the firewall, the dynamic access rules that will filter the IP traffic are created. This invention solves the problem, giving a network firewall the flexibility and power of the SQL language.

20 A network firewall in Informatica or Firewall is a

system or group of systems that imposes a security policy between some users and the network of an organization and determines which of the network services or equipment can be used within it, that is a

Employees may or may not use certain resources within their organization or have access to certain information. For a firewall to be effective, all traffic must pass through it where the site that may or may not be accessed is selected. Being this same 5 immune to penetration. Currently, firewalls applied to networks that use rules that intercept or not the entry of users or hosts to areas or equipment within the same network are known. The high-level SQL language is the standard for managing relational databases and achieves through simple operators such as SELECT, WHERE, 10 FROM, WHERE, GROUP BY, ORDER BY, extracting or modifying groups of records.

When in a company or organization the number of equipment to be protected exceeds a certain value or changes its number frequently, it is difficult for the administrators of that network to apply policies and rules 15 so that some employees are allowed connectivity to certain equipment or services already others not. If we want to group the teams by having some common feature that a user wants to make use of, such as all the equipment of an apartment, or of the printer type or of the first floor of a building, it ends up having two types of profiles: the 20 users that can connect to all computers and those that cannot. With the consequent security problems. These types of groupings are easily achieved through the SQL query language applied to

an inventory database, where each device has assigned characteristics and a network address known as IP.

It is part of the computer industry and, within this, in 5 of the firewall.

BACKGROUND OF THE INVENTION Document WO03040923 describes a security system that is applied to a database that is structured within the system and not on the network server. Document US2011231926 proposes an apparatus connected to an internal and / or external network so that the barrier that is imposed prevents the connection of an internet user to the internal network. Document ES2292737 describes a wireless communication to produce a user access key to the network by configuring an input biometrics that a processor compares with the signature certificate stored in the memory allowing the user to access if both data coincide.

This is known to have the drawbacks indicated below:

- Conventional firewalls are aimed at protecting 20 a network from other networks or protecting a small group of equipment from other equipment, but cannot protect a large set of teams from internal attacks or negligent users due to the impossibility of maintaining long lists of access applying individual rules.

5

10

fifteen

- They do not solve the problem of updating the access rules every time new equipment is included in the users profile and others are removed.

- Document WO03040923 is concerned with protecting information stored within a relational database but does not prevent IP connectivity to computers in an information network.

- Document US2011231926 has the disadvantage that it only protects the computer where it is installed and not the equipment and networks of an organization.

-The document ES2292737 has the disadvantage that is limited to protecting the access point to the network and not the individual equipment of that network.

Faced with these drawbacks, the proposed invention has the following advantages:

- The firewall method does not depend on knowing previously the IP addresses that the user's computer equipment may have because these IP addresses are automatically extracted in the mandatory authorization session that the user has to establish with the firewall.

- You do not need to know the equipment to be protected beforehand, with the consequent problem if your number changes, because these equipment obtains them automatically and in real time in the mandatory authorization session, when executing the query that the user has assigned in your profile, about The inventory database.

5

10

fifteen

- It is a protection oriented to users with the advantage of having personalized rules by user or by groups of users.

- When connecting to relational databases, the query statements that an administrator must create in a user's profile are very simple and flexible.

-You can create profiles with the same search pattern.

- Allows the mobility of users, because when validating the user validates the IP addresses of their connection device.

-Save administration work because you do not need to change the rules when the equipment inventory changes.

-You can assign a user a rule that allows you to connect

with millions of computers with a simple SQL query.

-When using SQL is compatible and adaptable to the majority of databases existing relationships in the market.

-It is safe because the connection from the firewalls to the database, you only need read permissions.

- It allows a great separation of tasks to the administrators when separating the inventory, typical of residing in a database server, of the traffic rules, more in accordance with a firewall.

- It allows to protect equipment that does not support RADIUS, authentication and authorization protocol for network access applications. And it is a first line of defense for those who support it, since it interposes between these end devices and the users,

avoiding direct IP connectivity between them if it is not authorized by the network firewall.

Thus the present invention is constituted from a firewall 5 located between two networks or network segments, being located as follows: on one side the users of an organization and on the other the equipment or networks to be protected, having connectivity to a server where the equipment inventory database is hosted and this server can be the firewall itself being in this database server 10 where through indexed tables and related to each other by common data, a company or organization manages its computer equipment, It registers high, low, modifications, and classifies them according to their criteria, such as geographical location, situation, whether it is in oats or not, group or user that has access to it, contract in force, type. and by

15 of course the network or IP address of these devices, data, the latter

, essential to obtain the set of IP addresses or networks thanks to a structured query language known as SQL that must support this database server and an interface, or client program for executing these instructions, which is hosted on the firewall 20 associating one or more SQL statements to a user's profile and

executing these orders when the user logs into the

firewall, obtaining and dumping on a file the result with the set of IP addresses or IP networks, to which, to that user in

specifically, access is allowed or denied by applying the filtering rules.

The operation of the method consists of the following stages; In a first stage, the user, with a process called login, connects to the firewall through an SSH session, interprets commands and secure protocol for access to remote machines. In a second stage, the firewall validates the user with a local key or queries the key in other external servers such as a corporate LDPA, lightweight directory access protocol. In the third stage and if the login process is correct, the firewall obtains the IP address of the user's host, its Socket. In a fourth stage you get the SQL statements from the user's profile, execute the SQL commands against the inventory database, store the response of the set of IP addresses in a person file. In a fifth stage apply the rules extracted from the profile of the user on these two extremes: The IP addresses of the user or his Socket and the file of IP addresses or IP networks. In the sixth stage the firewall informs the user that it can already carry traffic to the allowed IP addresses. The user at that time can work normally as if the firewall did not exist and establish another 20 independent sessions with the allowed equipment.

When the user closes the SSH session with the firewall, all the custom rules about their IP addresses or their Socket disappear.

In a different embodiment, the SQL command files and the custom rule files located in the firewall are also extracted by means of SQL from the inventory database.

In another different embodiment it is feasible for the device to be virtualized within another server.

In another different embodiment, it is feasible that the mandatory login session uses another program other than SSH such as HTTPS, a secure hypertext transfer protocol.

For a better understanding of how much is expressed in this description, a drawing is attached below, which by way of non-limiting example represents a preferred embodiment and its operation

fifteen

Figure 1.- Scheme of the operation of the method

1) Firewall

2) Users

3) Equipment or networks

4) Inventory database server

5) Indexed tables

6) Set of IP addresses

7) Interface

8) SQL statements

9) File

10) Filtering rules

11) Lightweight directory access protocol.

12) User host

DESCRIPTION OF A PREFERRED EMBODIMENT 5 Thus ^ the present invention is constituted from a firewall (1)

located between two networks or network segments, located as follows: on one side the users (2) of an organization and on the other the equipment or networks to be protected (3), having connectivity to a server (4) where The inventory database of 10 computers is hosted and this server (4) can be the firewall itself (1) being in this database server (4) where through indexed tables (5) and you relate to each other by common data, a company or organization manages its computer equipment, registers high, low, modifications, and classifies them according to its criteria, such as geographical location, situation, whether it is in oats or not, group or user that has access to it, contract in force, kind. and of course the network or IP address (12) of these devices, data, the latter, essential to obtain the set of IP addresses or networks (6) thanks to a structured query language known as SQL that this server must support (4 ) of database and an interface (7), or client program of execution of these instructions, that lodges in the firewall associating one or several SQL sentences (8) to the profile of a user (8) and executing these orders when the user (2) log in to the firewall (1), obtaining and turning over a

file (9) the result with the set of IP addresses or IP networks (6), which, in that particular user, is allowed or denied access by applying the filtering rules (10).

The operation of the method consists of the following stages; In 5 a first stage, the user (2), with a process called login, connects to the firewall (1) through an SSH session, interpreter of commands and secure protocol of access to remote machines. In a second stage, the firewall validates the user with a local key or queries the key in other external servers such as a corporate LDPA (11) 10, lightweight directory access protocol. In the third stage and if the login process is correct, the firewall obtains the IP address of the user's host (12), its Socket. In a fourth stage, the SQL statements (8) of the user profile are obtained, execute the SQL commands against the inventory database, store the response of the set of 15 IP addresses in a personal file (9). In a fifth stage, the rules extracted from the user's profile (8) apply to these two extremes: the user's IP addresses or their Socket and the IP address file or IP networks (6). In the sixth stage the firewall informs the user that it can already carry traffic to the allowed IP addresses. The user at that time can work normally as if the firewall did not exist and establish other independent sessions with the allowed equipment (6).

When the user closes the SSH session with the firewall (1) all the custom rules on their IP addresses or on their Socket (12) disappear.

5

10

fifteen

Claims (4)

1. Method of a firewall with dynamic rules by means of SQL constituted from an IP traffic firewall of levels 2 and 3 of the TCP / IP model (1) located between two networks or network segments, focusing as follows: a on the one hand the 5 users (2) of an organization and on the other the equipment or networks to be protected (3), having connectivity to a server (4) where the equipment inventory database is housed, this server can be ( 4) the firewall itself (1) being in this database server (4) where through indexed tables (5) and you relate to each other for 10 common data, a company or organization manages its computer equipment, registers high, low, modifications , and classifies them according to their criteria, such as geographic location, situation, whether it is in oats or not, group or user that has access to it, contract in force, type. and of course the network or IP address (12) of these devices, data, the latter 15, essential to obtain the set of IP addresses or networks (6) thanks to a structured query language known as SQL that this server must support ( 4) database and an interface (7), or client execution program of these instructions, which is hosted in the firewall associating one or more SQL statements (8) to the profile of a user (8) and executing these orders when the user (2) logs into the firewall (1), obtaining and dumping on a file (9) the result with the set of IP addresses or IP networks (6), to which, a that particular user is allowed or denied access by applying the filtering rules (10). The operation of the method consists of the following stages; In a first stage, the user (2), with a process called login, connects to the firewall (1) through an SSH session, interpreter of commands and secure protocol for access to remote machines. In a second stage, the firewall validates the user with a local key or queries the key in other external servers such as a corporate LDPA (11), lightweight directory access protocol. In the third stage and 10 if the login process is correct, the firewall obtains the IP address of the user's host (12), its Socket. In a fourth stage, the SQL statements (8) of the user profile are obtained, execute the SQL commands against the inventory database, store the response of the set of IP addresses in a personal file (9). In a fifth stage apply the 15 rules extracted from the user's profile (8) on these two extremes: the user's IP addresses or their Socket and the IP address file or IP networks (6). In the sixth stage the firewall informs the user that it can already carry traffic to the allowed IP addresses. The user at that time can work normally as if there is no firewall 20 and establish other independent sessions with the allowed equipment (6). 2.- Method of a firewall with dynamic rules using SQL, according to claim 1, characterized in that when the user closes the SSH session with the firewall (1) all custom rules about your IP addresses or your Socket (12) disappear. 3. - Method of a firewall with dynamic rules using SQL, according to claim 1, characterized in that the command files 5 SQL and the custom rules files located in the firewall are also extracted using SQL from the inventory database. 4. - Method of a firewall with dynamic rules using SQL, according to claim 1, characterized in that the device is virtualized within another server. 10 5.- Method of a firewall with dynamic rules using SQL, according to claim 1, characterized in that in the mandatory login session another program other than SSH is used as HTTPS, a secure hypertext transfer protocol. fifteen