US20130074154A1 - Public network access server having a user-configurable firewall - Google Patents
Public network access server having a user-configurable firewall Download PDFInfo
- Publication number
- US20130074154A1 US20130074154A1 US13/621,017 US201213621017A US2013074154A1 US 20130074154 A1 US20130074154 A1 US 20130074154A1 US 201213621017 A US201213621017 A US 201213621017A US 2013074154 A1 US2013074154 A1 US 2013074154A1
- Authority
- US
- United States
- Prior art keywords
- user
- computer
- access
- server
- client computer
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0241—Advertisements
- G06Q30/0251—Targeted advertisements
- G06Q30/0269—Targeted advertisements based on user profile or attribute
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Definitions
- This application relates to a public network access server having a user-configurable firewall.
- the computer system 100 illustrated in FIG. 1 represents a typical hardware setup for executing software that allows a user to perform tasks such as communicating with other computer users, accessing various computer resources, and viewing, creating, or otherwise manipulating electronic content—that is, any combination of text, images, movies, music or other sounds, animations, 3D virtual worlds, and links to other objects.
- the system includes various input/output (I/O) devices (mouse 103 , keyboard 105 , display 107 ) and a general purpose computer 100 having a central processor unit (CPU) 121 , an I/O unit 117 and a memory 109 that stores data and various programs such as an operating system 111 , and one or more application programs 113 .
- the computer system 100 also typically includes some sort of communications card or device 123 (e.g., a modem or network adapter) for exchanging data with a network 127 via a communications link 125 (e.g., a telephone line).
- communications card or device 123 e.g.,
- a user of a computer system 129 can access a public network 131 (e.g., the Internet) via an access server 133 (such as an Internet service provider or “ISP”).
- ISP Internet service provider
- this enables computer system 129 to send and receive data from other computers (not shown in FIG. 2 ) that are connected to the public network 131 (referred to as “outside” computers).
- one of the outside computers can act as a host of a web site from which the computer system 129 can view web pages using a “browser” program (e.g., an Internet browser such as Netscape Communicator version 4.7, which is commercially available from Netscape Communications Corporation of Mountain View, Calif.) running on the computer system 129 .
- a “browser” program e.g., an Internet browser such as Netscape Communicator version 4.7, which is commercially available from Netscape Communications Corporation of Mountain View, Calif.
- the computer system 129 can become vulnerable to attacks from outsiders (sometimes referred to as “hackers” or “crackers”) who use the public network 131 to attempt to gain unauthorized access to computers connected thereto. After gaining unauthorized access to a computer system 129 , such outsiders often view, copy, alter, delete, and/or redistribute data and programs that reside on the computer system 129 .
- outsiders sometimes referred to as “hackers” or “crackers”
- outsiders often view, copy, alter, delete, and/or redistribute data and programs that reside on the computer system 129 .
- dial-up connections The threat to users who access the Internet using dial-up modem connections (referred to as “dial-up connections”) over conventional plain old telephone service (POTS) lines typically has been relatively low.
- a user employing such a dial-up connection typically is assigned a temporary “IP address.”
- IP Internet Protocol
- An IP (Internet Protocol) address is a worldwide unique identifier that identifies a particular computer or other network device on the Internet. For example, as shown in FIG. 3 , a user can access the Internet 141 via a modem 143 connected to a computer 145 by dialing into an access server 147 using a POTS line.
- the access server 147 includes a terminal server 149 having multiple “ports.”
- the terminal server 149 is connected to a dial-up host computer 151 (e.g., a computer workstation running a variant of the UNIX operating system).
- the dial-up host computer 151 is connected to the Internet 141 , typically via a high-speed connection 153 (e.g., a T1 connection).
- the access server 147 and the high-speed connection 153 typically are maintained by an ISP.
- a different temporary IP address is typically assigned to the user's computer 145 each time the user dials into the access server 147 .
- the IP address that is assigned to the user's computer 145 is temporary since the user typically disconnects the computer 145 from the access server 147 when the user is not accessing the Internet. This allows the ISP to re-use the IP address previously assigned to the user's computer 145 as the temporary IP address of another computer that subsequently dials into the access server 147 .
- IP address of the user's computer 145 may change each time the user dials into the access server 147 , it is difficult for an outsider successfully to use hacking techniques that require knowledge of the IP address of the user's computer. For example, one cannot telnet into a user's computer 145 without knowing the computer's IP address.
- a firewall is a system for controlling access to the enterprise's network and/or computers (referred to as the “internal” network and computers) by other computers (referred to as “outside” computers) that attempt to access the internal networks and computers through a public network.
- the purpose of a firewall is to allow network elements to be attached to, and thereby access, a public network without rendering the network elements susceptible to unauthorized access from the public network.
- a successful firewall allows the network elements (e.g., routers, computers, servers, etc.) to communicate with the public network elements without rendering the network elements susceptible to attack or unauthorized inquiry over the public network.
- Such firewalls use known techniques such as “packet filtering” and “application gateways” for determining which data packets to forward to the inside networks and computers.
- Firewalls that are employed to'protect networks and computers used in business and educational settings typically implement a security policy that determines how each internal user of the firewall-protected network can access the public network.
- these security policies implement a “one-size-fits-all” approach in which all users of a certain type are assigned the same access rights to the public network.
- a one-size-fits-all approach often is desirable in such institutional settings since such an approach is generally simpler to implement, maintain, and audit and such institutions are generally in a position to impose such an approach on users of their networks and computers.
- firewalls Most Internet service providers, however, traditionally have not employed firewalls to protect their users' computers from attacks originating from the Internet. Users who access the Internet via dial-up connections typically do not need such security measures due to the security advantages associated with the use of temporary IP addresses. Moreover, most ISPs do not wish to, and/or are not in a position to, impose on their users a one-size-fits-all security policy of the type conventionally associated with the use of firewalls. Instead, ISPs have typically left it up to their users to implement some type of firewall on their computers if they wish (referred to as “client-based firewalls”).
- Client-based firewalls typically require a certain amount of technical sophistication on the part of the user. For example, users requiring additional protection from attacks may be unaware either of the threat or the potential protection that can be provided by client-based firewalls. Even if the user is aware of the threat and the potential protection that can be provided by client-based firewalls, the user may be unable or unwilling to install a client-based firewall properly, e.g., because the user does not have the required technical expertise. Also, the user may fail to maintain the client-based firewall. For example, the user may fail to install updated software that addresses a newly discovered potential security weakness in the client-based firewall in a timely manner. Indeed, another shortcoming of client-based firewalls is that each user of a client-based firewall must separately update that user's firewall.
- the present inventors recognized the need for a server-based firewall solution that does not impose a one-size-fits-all solution on the users of an access server.
- Implementations may include one or more of the following features.
- a method of controlling access to a client computer connected to a network (e.g., a public network) by a server may include maintaining at the server a user-changeable security setting for the client computer. Also, the method may include selectively granting access to the client computer from the network if allowed by the user-changeable security setting.
- Selectively granting access to the client computer may include receiving at the server a request to establish a connection (e.g., an inbound connection) between an outside computer and the client computer and, if allowed by the user-changeable security setting, establishing the connection between the outside computer and the client computer.
- selectively granting access to the client computer may include receiving at the server an inbound packet from an outside computer and, if allowed by the user-changeable security setting, forwarding the inbound packet to the client computer.
- the inbound packet may be formatted according to a first protocol, which may be used by the network.
- the inbound packet may be encapsulated according to another protocol (e.g., a protocol used by a value-added network connected to the server) before being forwarded to the client computer.
- the method . . . also may include de-encapsulating the encapsulated inbound packet at the client computer.
- the method further may include receiving a change to the user-changeable security setting from a user of the client computer, and providing the change to the server.
- the user-changeable security setting may prohibit inbound connections from being established or may allow inbound connections to be established (e.g., if an outbound connection was previously established by the client computer with the outside computer).
- a system for controlling access to a client computer connected to a network may include a server (e.g., an access server) connected to the client computer and the network (e.g., a public network).
- the system also may include server software in a computer-readable medium comprising instructions for causing the server to maintain a user-changeable security setting and selectively grant access to the client computer from the network if allowed by the user-changeable security setting.
- the system may include client software in a computer-readable medium comprising instructions for causing the client computer to receive a change to the user-changeable security setting from a user of the client computer and provide the change to the server computer.
- the server software may include instructions to receive at the server a request to establish a connection (e.g., an inbound connection) between an outside computer and the client computer and, if allowed by the user-changeable security setting, establish the connection between the outside computer and the client computer.
- a connection e.g., an inbound connection
- the server software also may include instructions to receive at the server an inbound packet from an outside computer and, if allowed by the user-changeable security setting, forward the inbound packet to the client computer.
- the inbound packet may be formatted according to a first protocol, which may be used by the network.
- the system may also encapsulate the inbound packet according to another protocol (e.g., a protocol used by a value-added network connected to the server) before forwarding the inbound packet to the client computer.
- the server software may also include instructions to de-encapsulate the encapsulated inbound packet.
- a server for controlling access to a client computer connected to a network may include a first port for connecting the server to the client computer and another port for connecting the server to the network.
- the server also may include software in a computer-readable medium comprising instructions for causing the server to maintain a user-changeable security setting and selectively grant access to the client computer from the network if allowed by the user-changeable security setting.
- client computer software in a computer-readable medium residing on a client computer that is connected by a server to a network may include instructions for causing the client computer to receive a change to a user-changeable security setting from a user of the client computer and provide the change to the server.
- the user-changeable security setting may be used by the server to selectively grant access to the client computer from the network if allowed by the user-changeable security setting.
- the user-changeable security setting may be used by the server to establish a connection (e.g., an inbound connection) between an outside computer and the client computer if allowed by the user-changeable security setting.
- the user-changeable security setting may be used by the server to forward an inbound packet to the client computer if allowed by the user-changeable security setting.
- the inbound packet is formatted according to a first protocol, which may be used by the network.
- the inbound packet may be encapsulated according to another protocol (e.g., a protocol used by a value-added network connected to the server) before being forwarded to the client computer.
- the software may also include instructions to de-encapsulate the encapsulated inbound packet.
- a public network access server having a user-configurable firewall provides a server-based firewall solution that need not impose a one-size-fits-all solution on the users of the access server.
- the server-based firewall may be centrally managed by an ISP who presumably has the requisite expertise to properly manage such a server-based firewall.
- the ISP may respond to new threats to, and/or vulnerabilities in, the server-based firewall by implementing a response at a centrally managed location of the sever-based firewall, as opposed to having each user of the access server separately implement such a response on each client computer.
- such an access server provides a degree of protection for those users who are unaware of the potential threats to their computers and/or the potential benefits of employing a firewall.
- FIG. 1 is a block diagram of a computer system.
- FIG. 2 shows a typical network computing environment.
- FIG. 3 shows a typical dial-up connection to the Internet.
- FIG. 4 is a flowchart of a process of, providing access to a public network in which a user can configure a firewall.
- FIG. 5 is a block diagram of an access server connecting client computers to a value-added network and a public network.
- FIG. 6 is a schematic diagram of a window by which a user of a client computer can change security settings.
- FIG. 7 is a flowchart of a process executed by the access server of FIG. 5 .
- FIG. 8 is a schematic diagram of a data structure maintained by the access server of FIG. 5 .
- FIG. 9 is a flowchart of a process executed by the client computer of a FIG. 5 .
- a process 10 of controlling access to a public network in which a user can configure a firewall is shown in FIG. 4 .
- a user-changeable security setting is maintained by an access server through which the user accesses the public network.
- the user-changeable security setting can be used to specify which outside computers or network devices (i.e., those computers and network devices that are accessible to a user's computer only via the public network) may access the user's computer and what type of access to the user's computer is allowed.
- the term “access” as used herein includes, by way of example, attempts to establish connections (e.g., TCP connections) with the user's computer or attempts to send packets (e.g., IP packets) to the user's computer.
- step 14 If an attempt to access the client computer is made (which is checked in step 14 ), the user-configurable security setting is checked in step 16 to determine if the attempted access is allowed by the current security setting. If the attempted access is not allowed by the current security setting, access is not allowed to the user's computer (as shown in step 18 ). If the attempted access is allowed by the current security setting, access is allowed to the user's computer (as shown in step 20 ).
- step 22 If the user changes the user-configurable security setting (which is checked in step 22 ), the changes to the user-configurable security setting are provided to the access server in step 24 .
- the process 10 then loops back to step 12 , where the access server maintains the user-configurable security setting by updating it with the changes made by the user.
- the access server 30 can include a terminal server 32 and a terminal information handler 34 .
- the terminal server 32 is configured to connect the access server 30 to a plurality of client computers 36 .
- the terminal-server 32 typically has a plurality of ports (not shown in FIG. 5 ) through which a client computer 36 can establish a connection with the access server 30 .
- the terminal server 32 can be configured to establish the desired number and type of connections between the access server 30 and the client computers 36 using any type of communication link, including by way of example a dial-up connection established between a client dial-up modem 38 connected to a client computer 36 and a server modem (not shown) connected to the terminal server 32 , a DSL connection established between a client DSL modem 40 connected to a client computer 36 and a server DSL modem (not shown) connected to the terminal server 32 , and a cable modem connection established between a cable modem 42 connected to a client computer 36 and a receiver port card within a headend controller (not shown) connected to the terminal server 32 .
- terminal server 32 is shown in FIG.
- the terminal server 32 can be implemented as a plurality of terminal servers that are logically, physically, and/or geographically separated from one another and/or from the terminal information handler 34 . Moreover, in some implementations, the terminal server 32 may be owned and/or managed by an entity that is separate from the entity that owns and/or manages the terminal information handler 34 .
- the terminal information handler 34 is connected to the terminal server 32 so as to connect the client computers 36 to a value-added network 44 (e.g., America Online or other online service provider) and/or a public network 46 (e.g., the Internet).
- the connection between the terminal information handler 34 and the terminal server 32 preferably is a high-speed connection (e.g., a high-speed network connection) that is capable of handling the traffic from all of the client computers 36 .
- a high-speed connection e.g., a high-speed network connection
- FIG. 5 it is to be understood that a plurality of connections between the terminal information handler 34 and the terminal server 32 can be used, e.g., to increase bandwidth and/or reliability.
- terminal information handler 34 is shown in FIG. 5 as a single entity, it should be noted that the terminal information handler 34 can be implemented as a plurality of terminal information handlers that are logically, physically, and/or geographically separated from one another and/or from the terminal server 32 .
- the client computers 36 communicate with computers connected to the value-added network 44 and the public network 46 by sending and receiving packets of information.
- the value-added network 44 is configured to forward packets formatted according to a first protocol (such as a proprietary protocol used by the America Online value-added network), while the public network 46 is configured to forward packets formatted according to a second protocol (such as the TCP/IP protocol).
- the client computers 36 execute client software (such as the America Online version 4.0 or 5.0 client program) that is capable of creating and receiving packets formatted according to the proprietary protocol (referred to as “proprietary packets”) so that the client, computers 36 can exchange information via the value-added network 44 .
- the client software also is capable of creating and receiving packets formatted according to the TCP/IP protocol (referred to as “IP packets”) so that the client computers 36 can exchange information via the public network 46 .
- IP packets formatted according to the TCP/IP protocol
- the header portion of the IP packet (which includes source and destination address information) contains a local IP address that is assigned to the client computer 36 .
- the local IP address can be either a temporary IP address or a permanent IP address.
- the access server 30 is configured to forward packets formatted according to the proprietary protocol. Therefore, before IP packets can be properly forwarded by the access server 30 on to the public network 46 , the IP packets must be reformatted so as to comply with the proprietary protocol used by the access server 30 . IP packets can be reformatted so as to comply with the proprietary protocol by using a process referred to as “tunnelling.” Tunnelling involves first “encapsulating” the IP packets in a proprietary packet. An IP packet can be encapsulated by “stripping” away the header portion of the IP packet and placing the payload (i.e., data) portion of the IP packet in the payload portion of a proprietary packet (referred to as the “encapsulated packet”).
- tunnelling involves first “encapsulating” the IP packets in a proprietary packet. An IP packet can be encapsulated by “stripping” away the header portion of the IP packet and placing the payload (i.e., data) portion of the IP packet in the payload portion of a proprietary packet (referred to
- the IP packet can be encapsulated by “wrapping” the entire unaltered IP packet in a proprietary packet.
- the entire IP packet can be placed in the payload portion of the proprietary packet.
- the header portion of the proprietary packet is formatted using the header information from the original header portion of the IP packet. Encapsulation of the IP packet can be performed, by the client software running on the client computers 36 or by software, running on the terminal server 32 (e.g., a tunnel 48 shown in FIG. 5 ). The encapsulated packet is then forwarded by the access server 30 according to the proprietary protocol.
- the terminal information handler 34 When the terminal information handler 34 identifies a proprietary packet that is to be forwarded to the public network 46 (e.g., by inspecting the destination address field of the proprietary packet), the proprietary packet must be reformatted to comply with the IP protocol before it is ultimately forwarded to the public network 46 .
- the proprietary packet is reformatted by the tunnel 48 that “de-encapsulates” the encapsulated packet prior to forwarding the packet to the public network 46 .
- the encapsulated packet is de-encapsulated by stripping away the header portion of the encapsulated packet and placing the payload portion of the encapsulated packet in the payload portion of an IP packet.
- the destination address from the proprietary packet is used as the destination address of the outgoing IP packet.
- the local IP address of the client computer 36 can be used as the source address of the outgoing IP packet, or a dynamically assigned IP address (referred to as a “dynamically assigned host address” or “DAHA” IP address) can be used, e.g., in order to avoid exposing to the public network the local IP address of the client computer 36 that created the original IP packet. If the encapsulated packet was encapsulated by wrapping the original IP packet in a proprietary packet, the payload portion of the encapsulated packet contains the original IP packet.
- DAHA dynamically assigned host address
- the original IP packet can be forwarded to the public network 46 as originally created by the client computer 36 (i.e., with the local IP address of the client computer 36 in the source address of the IP packet), or the original IP packet can be modified by placing a DAHA IP address in the source address field of the IP packet in order to avoid exposing the local IP address of the client computer 36 that created the original IP packet to the public network 46 .
- inbound IP packets that are forwarded to the access server 30 are encapsulated in a proprietary packet by the tunnel 48 to create a corresponding inbound proprietary packet, which is forwarded by the access server 30 to the appropriate client computer 36 .
- the client software running on the client computer 36 de-encapsulates the encapsulated inbound proprietary packet in order to recover the original IP packet that was received from the public network 46 .
- the access server 30 shown in FIG. 5 can be used to implement the process 10 .
- the access server 30 can maintain a user-configurable security setting for each, client computer 36 (or each user of a client computer 36 ) that specifies those addresses from which inbound connections may be established.
- a user of a client computer 36 can set the user-configurable setting by using the client software running on the client computer 36 .
- client software running on the user's client computer 36 can present a “Firewall Options” dialog box in which the user can specify one of three predefined security settings by clicking on radio buttons.
- FIG. 6 client software running on the user's client computer 36 can present a “Firewall Options” dialog box in which the user can specify one of three predefined security settings by clicking on radio buttons.
- the predefined security settings include a setting in which all inbound connections are blocked, a setting in which inbound connections from unknown addresses are blocked, and a setting in which all inbound connections are allowed.
- the user can create a customized security setting by selecting an “Advanced” button. If the user elects to specify a customized security setting, the user can specify particular addresses from which connections should be blocked or allowed, specify certain types of connections to block or allow, and/or specify any other conditions under which connections are to be blocked or allowed.
- the client software can be configured to allow the user to select whether the user wishes to have the local IP address of the client computer 36 be exposed to the public network 46 or whether the user wishes to have a DANA IP address used instead.
- a default security setting is automatically selected in the event that the user does not explicitly select a security setting.
- the security setting options shown in FIG. 6 relate to the blocking and allowing of connections from specified addresses, it is to be understood that the client software could be modified so that the user can specify that packets (as opposed to connections) from specified addresses are to be blocked and/or allowed.
- the user-configurable security setting can specify conditions for blocking and/or allowing any type of communication or access with outside computers and devices.
- a process 50 which can be executed by the access server 30 (for example, by the tunnel 48 of the terminal information handler 34 ) in order to implement the process 10 , is shown in FIG. 7 .
- the process 50 checks if a request (i.e., a proprietary packet) has been received from the client computer 36 requesting that an outbound connection be established between the client computer 36 and an outside computer or other device using the public network 46 . If such a request is received by the access server 30 , the destination address of the outside computer is added to a list of destination addresses with which the client computer 36 has established outbound connections (referred to as the “previous connections list”) in step 54 .
- a request i.e., a proprietary packet
- step 56 outbound proprietary packets that are intended for the outside computer as a part of the outbound connection (which are encapsulated by the client software running on the client computer 36 , as is explained below) are de-encapsulated to create corresponding IP packets to be forwarded to the public network 46 .
- step 58 inbound IP packets received by the access server 30 that are sent by the outside computer to the client computer 36 as a part of the outbound connection are encapsulated in order to create corresponding proprietary packets. The corresponding proprietary packets are forwarded to the client computer 36 by the access server 30 .
- the user-configurable security setting is not checked to determine if the user-configurable security setting allows each outbound connection to be established, it is to be understood that the process 50 could be modified to perform such a check before establishing each outbound connection.
- step 60 the process 50 checks if a request (i.e., an IP packet) has been received from the outside computer requesting that an inbound connection be established between the outside computer and the client computer 36 . If such a request is received by the access server 30 , the source address of the IP packet (which corresponds to the outside computer) is checked in step 62 to determine if the user-configurable security setting allows such an inbound connection to be established between the outside computer and the client computer 36 .
- a request i.e., an IP packet
- a data structure 200 (shown in FIG. 8 ) having an identification field 202 , a security level field. 204 , a list 206 of allowed addresses (referred to as the “allowed list”), and/or a list 208 of blocked addresses (referred to as the “blocked list) can be maintained by the access server 30 (e.g., by the tunnel 48 ).
- the identification field 202 contains an indication of which computer and/or user the data structure 200 is associated with.
- the security level field 204 contains data indicating whether the allowed list 206 and/or the blocked list 208 should be consulted to determine if the user-configurable security setting allows an inbound connection to be established.
- the allowed list 206 contains the addresses (e.g., IP addresses) of outside computers or other network, devices with which inbound connections to the client computer 36 (or user) are allowed to be established.
- the previous connections list that is updated in step 54 can be incorporated into the allowed list 206 .
- the blocked list 208 contains the addresses of outside computers or other network devices with which inbound connections to the client computer 36 are not allowed to be established.
- the client software can be configured to allow users to specify that inbound connections with particular users are to be blocked.
- the process 50 can determine whether the user-configurable security setting allows a requested inbound connection to be established by searching the allowed list 206 for the source address of the IP packet making the request. If the source address is not found in the allowed list 206 , the requested inbound connection is not allowed to be established. If the security level field 204 indicates that the blocked list 208 should be consulted, the process 50 can determine whether the user-configurable security setting allows the requested inbound connection to be established by searching the blocked list 208 for the source address. If the source-address is not found in the blocked list 208 , then the requested inbound connection is allowed to be established.
- the security level field 204 can also contain data indicating that all inbound connections may be established or that no inbound connections may be established. Moreover, the security level field 204 can include other data indicating that some other condition is to be used for determining whether to allow and/or block requested inbound connections.
- step 64 inbound IP packets sent by the outside computer to the client computer 36 as a part of the inbound connection are encapsulated in order to create corresponding proprietary packets that can be forwarded to the client computer 36 .
- step 66 outbound proprietary packets intended for the outside computer as a part of the inbound connection (which are encapsulated by the client software running on the client computer 36 , as is explained below) are de-encapsulated to create corresponding IP packets that can be forwarded to the outside computer via the public network 34 .
- step 68 the process 50 checks if a change to the user-configurable security setting has been received from the client computer 36 . If such a change has been received, the access server 30 updates the user-configurable security setting maintained for that client computer (or user) by the access server 30 in step 70 .
- a process 80 which can be executed by the client computer 36 (e.g., as a part of client software running on the client computer 36 ) in order to implement process 10 , is shown in FIG. 9 .
- process 80 checks if an outbound IP packet is being sent by the client, computer 36 . If an outbound IP packet is being sent, in step 84 the outbound IP packet is encapsulated to create a corresponding proprietary packet, which is forwarded to the access server 30 in step 86 .
- step 88 the process 80 checks if an inbound proprietary packet from the public network 46 (which is determined by checking the source address field of the inbound proprietary packet) has been forwarded to the client computer 36 via the access server 30 . If such an inbound proprietary packet has been forwarded to the client computer 36 , in step 90 the inbound proprietary packet is de-encapsulated to recover the original IP packet received by the access server 30 , which is processed in a conventional manner in step 92 by the client software.
- step 94 the process 80 checks if the user has changed the user-configurable security setting. If the user has changed the user-configurable security setting, then the client software receives the change from the user (e.g., via a dialogue box of the type shown in FIG. 6 ) in step 96 and forwards the change to the access server 30 in step 98 .
- a system or other apparatus that uses one or more of the techniques and methods described here may be implemented as a computer-readable storage medium, configured with a computer program, where the storage medium so configured causes a computer system to operate on input and/or generate output in a specific and predefined manner.
- a computer system may include one or more programmable processors that receive data and instructions from, and transmit data and instructions to, a data storage system, and suitable input and output devices.
- Each computer program may be implemented in a high-level procedural or object-oriented programming language, or in assembly or machine language if desired; and in any case, the language may be compiled or interpreted language.
- Suitable processors include, by way of example, both general and special purpose microprocessors.
- a processor will receive instructions and data from a read-only memory and/or a random access memory.
- Storage devices suitable for tangibly-embodying computer program instructions and data include all forms of non-volatile memory, including semiconductor memory devices; such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM disks.
- ASICs application-specific integrated circuits
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Business, Economics & Management (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Marketing (AREA)
- Game Theory and Decision Science (AREA)
- Entrepreneurship & Innovation (AREA)
- Economics (AREA)
- General Business, Economics & Management (AREA)
- Software Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
A user-configurable firewall and method in which a user-changeable security setting for a client computer is maintained by an access server through which a user accesses the public network. The user-changeable security setting can be used to specify which outside computers or network devices may access the client computer and what type of access to the client computer is allowed. If an attempt to access the client computer is made, the user-configurable security setting is checked to determine if the attempted access is allowed by the current security setting. If the attempted access is allowed by the current security setting, access is allowed to the client computer; otherwise, access is not allowed. If the user changes the user-configurable security setting, the changes to the user-configurable security setting are provided to the access server.
Description
- This application is a continuation of U.S. application Ser. No. 13/169,451 filed on Jun. 27, 2011, which is a continuation of U.S. application Ser. No. 11/009,150 filed on Dec. 13, 2004, which is a continuation of U.S. application Ser. No. 09/432,344 filed on Nov. 2, 1999, each of which are hereby incorporated by reference in their entirety.
- This application relates to a public network access server having a user-configurable firewall.
- The
computer system 100 illustrated inFIG. 1 represents a typical hardware setup for executing software that allows a user to perform tasks such as communicating with other computer users, accessing various computer resources, and viewing, creating, or otherwise manipulating electronic content—that is, any combination of text, images, movies, music or other sounds, animations, 3D virtual worlds, and links to other objects. The system includes various input/output (I/O) devices (mouse 103,keyboard 105, display 107) and ageneral purpose computer 100 having a central processor unit (CPU) 121, an I/O unit 117 and amemory 109 that stores data and various programs such as anoperating system 111, and one ormore application programs 113. Thecomputer system 100 also typically includes some sort of communications card or device 123 (e.g., a modem or network adapter) for exchanging data with anetwork 127 via a communications link 125 (e.g., a telephone line). - As shown in
FIG. 2 , a user of acomputer system 129 can access a public network 131 (e.g., the Internet) via an access server 133 (such as an Internet service provider or “ISP”). Among other things, this enablescomputer system 129 to send and receive data from other computers (not shown inFIG. 2 ) that are connected to the public network 131 (referred to as “outside” computers). For example, one of the outside computers can act as a host of a web site from which thecomputer system 129 can view web pages using a “browser” program (e.g., an Internet browser such as Netscape Communicator version 4.7, which is commercially available from Netscape Communications Corporation of Mountain View, Calif.) running on thecomputer system 129. - By connecting to a
public network 131 such as the Internet, however, thecomputer system 129 can become vulnerable to attacks from outsiders (sometimes referred to as “hackers” or “crackers”) who use thepublic network 131 to attempt to gain unauthorized access to computers connected thereto. After gaining unauthorized access to acomputer system 129, such outsiders often view, copy, alter, delete, and/or redistribute data and programs that reside on thecomputer system 129. - The threat to users who access the Internet using dial-up modem connections (referred to as “dial-up connections”) over conventional plain old telephone service (POTS) lines typically has been relatively low. A user employing such a dial-up connection typically is assigned a temporary “IP address.” An IP (Internet Protocol) address is a worldwide unique identifier that identifies a particular computer or other network device on the Internet. For example, as shown in
FIG. 3 , a user can access the Internet 141 via amodem 143 connected to acomputer 145 by dialing into anaccess server 147 using a POTS line. Theaccess server 147 includes aterminal server 149 having multiple “ports.” Several dial-up modems (not shown inFIG. 3 ) are connected to the ports of theterminal server 149 in order to receive data transmitted by the user'smodem 143. Theterminal server 149 is connected to a dial-up host computer 151 (e.g., a computer workstation running a variant of the UNIX operating system). The dial-uphost computer 151 is connected to the Internet 141, typically via a high-speed connection 153 (e.g., a T1 connection). Theaccess server 147 and the high-speed connection 153 typically are maintained by an ISP. - A different temporary IP address is typically assigned to the user's
computer 145 each time the user dials into theaccess server 147. The IP address that is assigned to the user'scomputer 145 is temporary since the user typically disconnects thecomputer 145 from theaccess server 147 when the user is not accessing the Internet. This allows the ISP to re-use the IP address previously assigned to the user'scomputer 145 as the temporary IP address of another computer that subsequently dials into theaccess server 147. - Because the IP address of the user's
computer 145 may change each time the user dials into theaccess server 147, it is difficult for an outsider successfully to use hacking techniques that require knowledge of the IP address of the user's computer. For example, one cannot telnet into a user'scomputer 145 without knowing the computer's IP address. - Recently, high-speed alternatives to conventional dial-up Internet connections have become increasingly popular. These high-speed alternatives include digital subscriber lines (“DSL”) and cable modem connections, which typically allow users to use their telephone lines for voice transmissions simultaneously with data connections. As a result, many users of these new high-speed connections do not disconnect their computers from the Internet when they are not actively accessing the Internet. Remaining persistently connected in this manner enables users to avoid the overhead (delay and effort) associated with reconnecting to the Internet that they otherwise would encounter each time they accessed the Internet. As a result, many Internet service providers are assigning fixed (i.e., non-temporary) IP addresses to computers that make use of such high-speed “always connected” Internet connections. However, because the use of permanent IP addresses facilitates certain hacking techniques, the security advantages associated with the use of temporary IP addresses are lost when fixed IP addresses are used.
- One way in which enterprises such as businesses and educational institutions have protected their networks and computers (which typically are assigned fixed IP addresses) is to employ a “firewall.” A firewall is a system for controlling access to the enterprise's network and/or computers (referred to as the “internal” network and computers) by other computers (referred to as “outside” computers) that attempt to access the internal networks and computers through a public network. The purpose of a firewall is to allow network elements to be attached to, and thereby access, a public network without rendering the network elements susceptible to unauthorized access from the public network. A successful firewall allows the network elements (e.g., routers, computers, servers, etc.) to communicate with the public network elements without rendering the network elements susceptible to attack or unauthorized inquiry over the public network. Such firewalls use known techniques such as “packet filtering” and “application gateways” for determining which data packets to forward to the inside networks and computers.
- Firewalls that are employed to'protect networks and computers used in business and educational settings typically implement a security policy that determines how each internal user of the firewall-protected network can access the public network. Typically, these security policies implement a “one-size-fits-all” approach in which all users of a certain type are assigned the same access rights to the public network. A one-size-fits-all approach often is desirable in such institutional settings since such an approach is generally simpler to implement, maintain, and audit and such institutions are generally in a position to impose such an approach on users of their networks and computers.
- Most Internet service providers, however, traditionally have not employed firewalls to protect their users' computers from attacks originating from the Internet. Users who access the Internet via dial-up connections typically do not need such security measures due to the security advantages associated with the use of temporary IP addresses. Moreover, most ISPs do not wish to, and/or are not in a position to, impose on their users a one-size-fits-all security policy of the type conventionally associated with the use of firewalls. Instead, ISPs have typically left it up to their users to implement some type of firewall on their computers if they wish (referred to as “client-based firewalls”).
- Client-based firewalls typically require a certain amount of technical sophistication on the part of the user. For example, users requiring additional protection from attacks may be unaware either of the threat or the potential protection that can be provided by client-based firewalls. Even if the user is aware of the threat and the potential protection that can be provided by client-based firewalls, the user may be unable or unwilling to install a client-based firewall properly, e.g., because the user does not have the required technical expertise. Also, the user may fail to maintain the client-based firewall. For example, the user may fail to install updated software that addresses a newly discovered potential security weakness in the client-based firewall in a timely manner. Indeed, another shortcoming of client-based firewalls is that each user of a client-based firewall must separately update that user's firewall.
- The present inventors recognized the need for a server-based firewall solution that does not impose a one-size-fits-all solution on the users of an access server.
- Implementations may include one or more of the following features. In one aspect, a method of controlling access to a client computer connected to a network (e.g., a public network) by a server (e.g., an access server) may include maintaining at the server a user-changeable security setting for the client computer. Also, the method may include selectively granting access to the client computer from the network if allowed by the user-changeable security setting.
- Selectively granting access to the client computer may include receiving at the server a request to establish a connection (e.g., an inbound connection) between an outside computer and the client computer and, if allowed by the user-changeable security setting, establishing the connection between the outside computer and the client computer. Moreover, selectively granting access to the client computer may include receiving at the server an inbound packet from an outside computer and, if allowed by the user-changeable security setting, forwarding the inbound packet to the client computer. The inbound packet may be formatted according to a first protocol, which may be used by the network. Also, the inbound packet may be encapsulated according to another protocol (e.g., a protocol used by a value-added network connected to the server) before being forwarded to the client computer. The method . . . also may include de-encapsulating the encapsulated inbound packet at the client computer.
- The method further may include receiving a change to the user-changeable security setting from a user of the client computer, and providing the change to the server. The user-changeable security setting may prohibit inbound connections from being established or may allow inbound connections to be established (e.g., if an outbound connection was previously established by the client computer with the outside computer).
- In another aspect, a system for controlling access to a client computer connected to a network may include a server (e.g., an access server) connected to the client computer and the network (e.g., a public network). The system also may include server software in a computer-readable medium comprising instructions for causing the server to maintain a user-changeable security setting and selectively grant access to the client computer from the network if allowed by the user-changeable security setting. In addition, the system may include client software in a computer-readable medium comprising instructions for causing the client computer to receive a change to the user-changeable security setting from a user of the client computer and provide the change to the server computer.
- The server software may include instructions to receive at the server a request to establish a connection (e.g., an inbound connection) between an outside computer and the client computer and, if allowed by the user-changeable security setting, establish the connection between the outside computer and the client computer.
- The server software also may include instructions to receive at the server an inbound packet from an outside computer and, if allowed by the user-changeable security setting, forward the inbound packet to the client computer. The inbound packet may be formatted according to a first protocol, which may be used by the network. The system may also encapsulate the inbound packet according to another protocol (e.g., a protocol used by a value-added network connected to the server) before forwarding the inbound packet to the client computer. The server software may also include instructions to de-encapsulate the encapsulated inbound packet.
- In another aspect, a server for controlling access to a client computer connected to a network may include a first port for connecting the server to the client computer and another port for connecting the server to the network. The server also may include software in a computer-readable medium comprising instructions for causing the server to maintain a user-changeable security setting and selectively grant access to the client computer from the network if allowed by the user-changeable security setting.
- In another aspect, client computer software in a computer-readable medium residing on a client computer that is connected by a server to a network may include instructions for causing the client computer to receive a change to a user-changeable security setting from a user of the client computer and provide the change to the server. The user-changeable security setting may be used by the server to selectively grant access to the client computer from the network if allowed by the user-changeable security setting. For example, the user-changeable security setting may be used by the server to establish a connection (e.g., an inbound connection) between an outside computer and the client computer if allowed by the user-changeable security setting. Also, the user-changeable security setting may be used by the server to forward an inbound packet to the client computer if allowed by the user-changeable security setting. The inbound packet is formatted according to a first protocol, which may be used by the network. Furthermore, the inbound packet may be encapsulated according to another protocol (e.g., a protocol used by a value-added network connected to the server) before being forwarded to the client computer. The software may also include instructions to de-encapsulate the encapsulated inbound packet.
- One or more of the following advantages may be realized. A public network access server having a user-configurable firewall provides a server-based firewall solution that need not impose a one-size-fits-all solution on the users of the access server. The server-based firewall may be centrally managed by an ISP who presumably has the requisite expertise to properly manage such a server-based firewall. Also, the ISP may respond to new threats to, and/or vulnerabilities in, the server-based firewall by implementing a response at a centrally managed location of the sever-based firewall, as opposed to having each user of the access server separately implement such a response on each client computer. In addition by employing a default security setting, such an access server provides a degree of protection for those users who are unaware of the potential threats to their computers and/or the potential benefits of employing a firewall.
- Further advantages and features will be apparent from the following description, including the drawings and the claims.
-
FIG. 1 is a block diagram of a computer system. -
FIG. 2 shows a typical network computing environment. -
FIG. 3 shows a typical dial-up connection to the Internet. -
FIG. 4 is a flowchart of a process of, providing access to a public network in which a user can configure a firewall. -
FIG. 5 is a block diagram of an access server connecting client computers to a value-added network and a public network. -
FIG. 6 is a schematic diagram of a window by which a user of a client computer can change security settings. -
FIG. 7 is a flowchart of a process executed by the access server ofFIG. 5 . -
FIG. 8 is a schematic diagram of a data structure maintained by the access server ofFIG. 5 . -
FIG. 9 is a flowchart of a process executed by the client computer of aFIG. 5 . - Like reference numbers and designations in the various drawings indicate like elements.
- A
process 10 of controlling access to a public network in which a user can configure a firewall is shown inFIG. 4 . Instep 12, a user-changeable security setting is maintained by an access server through which the user accesses the public network. The user-changeable security setting can be used to specify which outside computers or network devices (i.e., those computers and network devices that are accessible to a user's computer only via the public network) may access the user's computer and what type of access to the user's computer is allowed. The term “access” as used herein includes, by way of example, attempts to establish connections (e.g., TCP connections) with the user's computer or attempts to send packets (e.g., IP packets) to the user's computer. - If an attempt to access the client computer is made (which is checked in step 14), the user-configurable security setting is checked in
step 16 to determine if the attempted access is allowed by the current security setting. If the attempted access is not allowed by the current security setting, access is not allowed to the user's computer (as shown in step 18). If the attempted access is allowed by the current security setting, access is allowed to the user's computer (as shown in step 20). - If the user changes the user-configurable security setting (which is checked in step 22), the changes to the user-configurable security setting are provided to the access server in
step 24. Theprocess 10 then loops back to step 12, where the access server maintains the user-configurable security setting by updating it with the changes made by the user. - An
access server 30 that can implement theprocess 10 is shown inFIG. 5 . Theaccess server 30 can include aterminal server 32 and aterminal information handler 34. Theterminal server 32 is configured to connect theaccess server 30 to a plurality ofclient computers 36. The terminal-server 32 typically has a plurality of ports (not shown inFIG. 5 ) through which aclient computer 36 can establish a connection with theaccess server 30. Theterminal server 32 can be configured to establish the desired number and type of connections between theaccess server 30 and theclient computers 36 using any type of communication link, including by way of example a dial-up connection established between a client dial-upmodem 38 connected to aclient computer 36 and a server modem (not shown) connected to theterminal server 32, a DSL connection established between aclient DSL modem 40 connected to aclient computer 36 and a server DSL modem (not shown) connected to theterminal server 32, and a cable modem connection established between a cable modem 42 connected to aclient computer 36 and a receiver port card within a headend controller (not shown) connected to theterminal server 32. Althoughterminal server 32 is shown inFIG. 5 as a single entity, it is to be understood that theterminal server 32 can be implemented as a plurality of terminal servers that are logically, physically, and/or geographically separated from one another and/or from theterminal information handler 34. Moreover, in some implementations, theterminal server 32 may be owned and/or managed by an entity that is separate from the entity that owns and/or manages theterminal information handler 34. - The
terminal information handler 34 is connected to theterminal server 32 so as to connect theclient computers 36 to a value-added network 44 (e.g., America Online or other online service provider) and/or a public network 46 (e.g., the Internet). The connection between theterminal information handler 34 and theterminal server 32 preferably is a high-speed connection (e.g., a high-speed network connection) that is capable of handling the traffic from all of theclient computers 36. Although there is only one connection between theterminal information handler 34 and theterminal server 32 shown inFIG. 5 , it is to be understood that a plurality of connections between theterminal information handler 34 and theterminal server 32 can be used, e.g., to increase bandwidth and/or reliability. Moreover, although theterminal information handler 34 is shown inFIG. 5 as a single entity, it should be noted that theterminal information handler 34 can be implemented as a plurality of terminal information handlers that are logically, physically, and/or geographically separated from one another and/or from theterminal server 32. - The
client computers 36 communicate with computers connected to the value-addednetwork 44 and thepublic network 46 by sending and receiving packets of information. In one implementation, the value-addednetwork 44 is configured to forward packets formatted according to a first protocol (such as a proprietary protocol used by the America Online value-added network), while thepublic network 46 is configured to forward packets formatted according to a second protocol (such as the TCP/IP protocol). Theclient computers 36 execute client software (such as the America Online version 4.0 or 5.0 client program) that is capable of creating and receiving packets formatted according to the proprietary protocol (referred to as “proprietary packets”) so that the client,computers 36 can exchange information via the value-addednetwork 44. The client software also is capable of creating and receiving packets formatted according to the TCP/IP protocol (referred to as “IP packets”) so that theclient computers 36 can exchange information via thepublic network 46. When aclient computer 36 creates an IP packet, the header portion of the IP packet (which includes source and destination address information) contains a local IP address that is assigned to theclient computer 36. The local IP address can be either a temporary IP address or a permanent IP address. - In the implementation shown in
FIG. 5 , however, theaccess server 30 is configured to forward packets formatted according to the proprietary protocol. Therefore, before IP packets can be properly forwarded by theaccess server 30 on to thepublic network 46, the IP packets must be reformatted so as to comply with the proprietary protocol used by theaccess server 30. IP packets can be reformatted so as to comply with the proprietary protocol by using a process referred to as “tunnelling.” Tunnelling involves first “encapsulating” the IP packets in a proprietary packet. An IP packet can be encapsulated by “stripping” away the header portion of the IP packet and placing the payload (i.e., data) portion of the IP packet in the payload portion of a proprietary packet (referred to as the “encapsulated packet”). Alternatively, the IP packet can be encapsulated by “wrapping” the entire unaltered IP packet in a proprietary packet. In other words, the entire IP packet can be placed in the payload portion of the proprietary packet. In both cases, the header portion of the proprietary packet is formatted using the header information from the original header portion of the IP packet. Encapsulation of the IP packet can be performed, by the client software running on theclient computers 36 or by software, running on the terminal server 32 (e.g., atunnel 48 shown inFIG. 5 ). The encapsulated packet is then forwarded by theaccess server 30 according to the proprietary protocol. - When the
terminal information handler 34 identifies a proprietary packet that is to be forwarded to the public network 46 (e.g., by inspecting the destination address field of the proprietary packet), the proprietary packet must be reformatted to comply with the IP protocol before it is ultimately forwarded to thepublic network 46. The proprietary packet is reformatted by thetunnel 48 that “de-encapsulates” the encapsulated packet prior to forwarding the packet to thepublic network 46. The encapsulated packet is de-encapsulated by stripping away the header portion of the encapsulated packet and placing the payload portion of the encapsulated packet in the payload portion of an IP packet. The destination address from the proprietary packet is used as the destination address of the outgoing IP packet. The local IP address of theclient computer 36 can be used as the source address of the outgoing IP packet, or a dynamically assigned IP address (referred to as a “dynamically assigned host address” or “DAHA” IP address) can be used, e.g., in order to avoid exposing to the public network the local IP address of theclient computer 36 that created the original IP packet. If the encapsulated packet was encapsulated by wrapping the original IP packet in a proprietary packet, the payload portion of the encapsulated packet contains the original IP packet. The original IP packet can be forwarded to thepublic network 46 as originally created by the client computer 36 (i.e., with the local IP address of theclient computer 36 in the source address of the IP packet), or the original IP packet can be modified by placing a DAHA IP address in the source address field of the IP packet in order to avoid exposing the local IP address of theclient computer 36 that created the original IP packet to thepublic network 46. - Similarly, inbound IP packets that are forwarded to the
access server 30 are encapsulated in a proprietary packet by thetunnel 48 to create a corresponding inbound proprietary packet, which is forwarded by theaccess server 30 to theappropriate client computer 36. The client software running on theclient computer 36 de-encapsulates the encapsulated inbound proprietary packet in order to recover the original IP packet that was received from thepublic network 46. - The
access server 30 shown inFIG. 5 can be used to implement theprocess 10. For example, theaccess server 30 can maintain a user-configurable security setting for each, client computer 36 (or each user of a client computer 36) that specifies those addresses from which inbound connections may be established. A user of aclient computer 36 can set the user-configurable setting by using the client software running on theclient computer 36. For example, as shown inFIG. 6 , client software running on the user'sclient computer 36 can present a “Firewall Options” dialog box in which the user can specify one of three predefined security settings by clicking on radio buttons. As shown inFIG. 6 , the predefined security settings include a setting in which all inbound connections are blocked, a setting in which inbound connections from unknown addresses are blocked, and a setting in which all inbound connections are allowed. Alternatively, the user can create a customized security setting by selecting an “Advanced” button. If the user elects to specify a customized security setting, the user can specify particular addresses from which connections should be blocked or allowed, specify certain types of connections to block or allow, and/or specify any other conditions under which connections are to be blocked or allowed. Also, the client software can be configured to allow the user to select whether the user wishes to have the local IP address of theclient computer 36 be exposed to thepublic network 46 or whether the user wishes to have a DANA IP address used instead. Preferably, a default security setting is automatically selected in the event that the user does not explicitly select a security setting. - Although the security setting options shown in
FIG. 6 relate to the blocking and allowing of connections from specified addresses, it is to be understood that the client software could be modified so that the user can specify that packets (as opposed to connections) from specified addresses are to be blocked and/or allowed. Indeed, the user-configurable security setting can specify conditions for blocking and/or allowing any type of communication or access with outside computers and devices. - A
process 50, which can be executed by the access server 30 (for example, by thetunnel 48 of the terminal information handler 34) in order to implement theprocess 10, is shown inFIG. 7 . Instep 52, theprocess 50 checks if a request (i.e., a proprietary packet) has been received from theclient computer 36 requesting that an outbound connection be established between theclient computer 36 and an outside computer or other device using thepublic network 46. If such a request is received by theaccess server 30, the destination address of the outside computer is added to a list of destination addresses with which theclient computer 36 has established outbound connections (referred to as the “previous connections list”) instep 54. Instep 56, outbound proprietary packets that are intended for the outside computer as a part of the outbound connection (which are encapsulated by the client software running on theclient computer 36, as is explained below) are de-encapsulated to create corresponding IP packets to be forwarded to thepublic network 46. Instep 58, inbound IP packets received by theaccess server 30 that are sent by the outside computer to theclient computer 36 as a part of the outbound connection are encapsulated in order to create corresponding proprietary packets. The corresponding proprietary packets are forwarded to theclient computer 36 by theaccess server 30. Although in this example the user-configurable security setting is not checked to determine if the user-configurable security setting allows each outbound connection to be established, it is to be understood that theprocess 50 could be modified to perform such a check before establishing each outbound connection. - In
step 60, theprocess 50 checks if a request (i.e., an IP packet) has been received from the outside computer requesting that an inbound connection be established between the outside computer and theclient computer 36. If such a request is received by theaccess server 30, the source address of the IP packet (which corresponds to the outside computer) is checked instep 62 to determine if the user-configurable security setting allows such an inbound connection to be established between the outside computer and theclient computer 36. - For example, a data structure 200 (shown in
FIG. 8 ) having anidentification field 202, a security level field. 204, alist 206 of allowed addresses (referred to as the “allowed list”), and/or alist 208 of blocked addresses (referred to as the “blocked list) can be maintained by the access server 30 (e.g., by the tunnel 48). Theidentification field 202 contains an indication of which computer and/or user thedata structure 200 is associated with. Thesecurity level field 204 contains data indicating whether the allowedlist 206 and/or the blockedlist 208 should be consulted to determine if the user-configurable security setting allows an inbound connection to be established. The allowedlist 206 contains the addresses (e.g., IP addresses) of outside computers or other network, devices with which inbound connections to the client computer 36 (or user) are allowed to be established. For example, the previous connections list that is updated instep 54 can be incorporated into the allowedlist 206. The blockedlist 208 contains the addresses of outside computers or other network devices with which inbound connections to theclient computer 36 are not allowed to be established. For example, the client software can be configured to allow users to specify that inbound connections with particular users are to be blocked. - If the
security level field 204 indicates that the allowedlist 206 should be consulted, theprocess 50 can determine whether the user-configurable security setting allows a requested inbound connection to be established by searching the allowedlist 206 for the source address of the IP packet making the request. If the source address is not found in the allowedlist 206, the requested inbound connection is not allowed to be established. If thesecurity level field 204 indicates that the blockedlist 208 should be consulted, theprocess 50 can determine whether the user-configurable security setting allows the requested inbound connection to be established by searching the blockedlist 208 for the source address. If the source-address is not found in the blockedlist 208, then the requested inbound connection is allowed to be established. Thesecurity level field 204 can also contain data indicating that all inbound connections may be established or that no inbound connections may be established. Moreover, thesecurity level field 204 can include other data indicating that some other condition is to be used for determining whether to allow and/or block requested inbound connections. - Referring again to
FIG. 7 , if the user-configurable security setting allows a requested inbound connection to be established, then instep 64 inbound IP packets sent by the outside computer to theclient computer 36 as a part of the inbound connection are encapsulated in order to create corresponding proprietary packets that can be forwarded to theclient computer 36. Also, if the user-configurable security setting allows such an inbound connection to be established, instep 66 outbound proprietary packets intended for the outside computer as a part of the inbound connection (which are encapsulated by the client software running on theclient computer 36, as is explained below) are de-encapsulated to create corresponding IP packets that can be forwarded to the outside computer via thepublic network 34. - In
step 68, theprocess 50 checks if a change to the user-configurable security setting has been received from theclient computer 36. If such a change has been received, theaccess server 30 updates the user-configurable security setting maintained for that client computer (or user) by theaccess server 30 instep 70. - A
process 80, which can be executed by the client computer 36 (e.g., as a part of client software running on the client computer 36) in order to implementprocess 10, is shown inFIG. 9 . Instep 82,process 80 checks if an outbound IP packet is being sent by the client,computer 36. If an outbound IP packet is being sent, instep 84 the outbound IP packet is encapsulated to create a corresponding proprietary packet, which is forwarded to theaccess server 30 instep 86. - In
step 88, theprocess 80 checks if an inbound proprietary packet from the public network 46 (which is determined by checking the source address field of the inbound proprietary packet) has been forwarded to theclient computer 36 via theaccess server 30. If such an inbound proprietary packet has been forwarded to theclient computer 36, instep 90 the inbound proprietary packet is de-encapsulated to recover the original IP packet received by theaccess server 30, which is processed in a conventional manner instep 92 by the client software. - In
step 94, theprocess 80 checks if the user has changed the user-configurable security setting. If the user has changed the user-configurable security setting, then the client software receives the change from the user (e.g., via a dialogue box of the type shown inFIG. 6 ) instep 96 and forwards the change to theaccess server 30 instep 98. - Various implementations of the systems and techniques described here may be realized in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations thereof. A system or other apparatus that uses one or more of the techniques and methods described here may be implemented as a computer-readable storage medium, configured with a computer program, where the storage medium so configured causes a computer system to operate on input and/or generate output in a specific and predefined manner. Such a computer system may include one or more programmable processors that receive data and instructions from, and transmit data and instructions to, a data storage system, and suitable input and output devices.
- Each computer program may be implemented in a high-level procedural or object-oriented programming language, or in assembly or machine language if desired; and in any case, the language may be compiled or interpreted language. Suitable processors include, by way of example, both general and special purpose microprocessors.
- Generally, a processor will receive instructions and data from a read-only memory and/or a random access memory. Storage devices suitable for tangibly-embodying computer program instructions and data include all forms of non-volatile memory, including semiconductor memory devices; such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM disks.
- Any of the foregoing may be supplemented by, or implemented in, specially-designed ASICs (application-specific integrated circuits).
- A number of embodiments of the present invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. Accordingly, other embodiments are within the scope of the following claims.
Claims (2)
1. A method of controlling access to a client computer connected to a network by a server, the method comprising:
maintaining at the server a user-changeable security setting for the client computer; and
selectively granting access to the client computer from the network if allowed by the user-changeable security setting.
2-45. (canceled)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/621,017 US20130074154A1 (en) | 1999-11-02 | 2012-09-15 | Public network access server having a user-configurable firewall |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/432,344 US6832321B1 (en) | 1999-11-02 | 1999-11-02 | Public network access server having a user-configurable firewall |
US11/009,150 US8011000B2 (en) | 1999-11-02 | 2004-12-13 | Public network access server having a user-configurable firewall |
US13/169,451 US20110258695A1 (en) | 1999-11-02 | 2011-06-27 | Public network access server having a user-configurable firewall |
US13/621,017 US20130074154A1 (en) | 1999-11-02 | 2012-09-15 | Public network access server having a user-configurable firewall |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/169,451 Continuation US20110258695A1 (en) | 1999-11-02 | 2011-06-27 | Public network access server having a user-configurable firewall |
Publications (1)
Publication Number | Publication Date |
---|---|
US20130074154A1 true US20130074154A1 (en) | 2013-03-21 |
Family
ID=23715748
Family Applications (5)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/432,344 Expired - Lifetime US6832321B1 (en) | 1999-11-02 | 1999-11-02 | Public network access server having a user-configurable firewall |
US11/009,150 Active 2025-05-18 US8011000B2 (en) | 1999-11-02 | 2004-12-13 | Public network access server having a user-configurable firewall |
US13/169,451 Abandoned US20110258695A1 (en) | 1999-11-02 | 2011-06-27 | Public network access server having a user-configurable firewall |
US13/621,014 Abandoned US20130074153A1 (en) | 1999-11-02 | 2012-09-15 | Public network access server having a user-configurable firewall |
US13/621,017 Abandoned US20130074154A1 (en) | 1999-11-02 | 2012-09-15 | Public network access server having a user-configurable firewall |
Family Applications Before (4)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US09/432,344 Expired - Lifetime US6832321B1 (en) | 1999-11-02 | 1999-11-02 | Public network access server having a user-configurable firewall |
US11/009,150 Active 2025-05-18 US8011000B2 (en) | 1999-11-02 | 2004-12-13 | Public network access server having a user-configurable firewall |
US13/169,451 Abandoned US20110258695A1 (en) | 1999-11-02 | 2011-06-27 | Public network access server having a user-configurable firewall |
US13/621,014 Abandoned US20130074153A1 (en) | 1999-11-02 | 2012-09-15 | Public network access server having a user-configurable firewall |
Country Status (6)
Country | Link |
---|---|
US (5) | US6832321B1 (en) |
EP (1) | EP1226693A2 (en) |
JP (1) | JP3819295B2 (en) |
AU (1) | AU1246501A (en) |
CA (1) | CA2390184C (en) |
WO (1) | WO2001033320A2 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10662663B2 (en) | 2016-09-27 | 2020-05-26 | American Waves Machines, Inc. | Wave generator with wave damping |
Families Citing this family (42)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6832321B1 (en) * | 1999-11-02 | 2004-12-14 | America Online, Inc. | Public network access server having a user-configurable firewall |
KR100402981B1 (en) * | 2000-09-29 | 2003-10-22 | 엘지전자 주식회사 | Apparatus and Method of Managing IP Address in the Exchange |
US7003798B2 (en) * | 2000-10-20 | 2006-02-21 | Canon Kabushiki Kaisha | System for operating device from remote location and apparatus for use in the system |
JP2003018178A (en) * | 2001-07-04 | 2003-01-17 | Allied Tereshisu Kk | Method for preventing unautherized access to intelligent relay unit and program thereof and recording medium with its program recorded and intelligent relay unit and lan system |
US20040107360A1 (en) * | 2002-12-02 | 2004-06-03 | Zone Labs, Inc. | System and Methodology for Policy Enforcement |
US7546629B2 (en) * | 2002-03-06 | 2009-06-09 | Check Point Software Technologies, Inc. | System and methodology for security policy arbitration |
US7316029B1 (en) * | 2001-10-25 | 2008-01-01 | Sprint Communications Company L.P. | Network security services architecture |
US7937439B2 (en) | 2001-12-27 | 2011-05-03 | Utbk, Inc. | Apparatus and method for scheduling live advice communication with a selected service provider |
US20030200313A1 (en) * | 2002-04-17 | 2003-10-23 | General Instrument Corporation | Digital rights management system for clients with low level security |
JP2004048175A (en) * | 2002-07-09 | 2004-02-12 | Toshiba Corp | Communication apparatus, communication system, and communication method |
US7305432B2 (en) * | 2002-10-23 | 2007-12-04 | Aol Llc | Privacy preferences roaming and enforcement |
US7251328B2 (en) | 2003-01-14 | 2007-07-31 | General Instrument Corporation | System for secure decryption of streaming media using selective decryption of header information and decryption of reassembled content |
JP3800198B2 (en) * | 2003-05-16 | 2006-07-26 | ソニー株式会社 | Information processing apparatus, access control processing method, and computer program |
US7299503B2 (en) * | 2003-06-26 | 2007-11-20 | International Business Machines Corporation | Apparatus and method for location specific authentication using powerline networking |
US7886009B2 (en) * | 2003-08-22 | 2011-02-08 | Utbk, Inc. | Gate keeper |
US7565430B2 (en) * | 2003-10-01 | 2009-07-21 | At&T Intellectual Property I, L.P. | Firewall switching system for communication system applications |
US7814543B2 (en) * | 2004-02-13 | 2010-10-12 | Microsoft Corporation | System and method for securing a computer system connected to a network from attacks |
US7716726B2 (en) * | 2004-02-13 | 2010-05-11 | Microsoft Corporation | System and method for protecting a computing device from computer exploits delivered over a networked environment in a secured communication |
US7841005B2 (en) * | 2004-05-21 | 2010-11-23 | Computer Assoicates Think, Inc. | Method and apparatus for providing security to web services |
WO2005114956A1 (en) * | 2004-05-21 | 2005-12-01 | Computer Associates Think, Inc. | Method and apparatus for processing web service messages |
KR20070053663A (en) * | 2004-05-25 | 2007-05-25 | 리플렉션 네트워크 솔루션즈, 인코포레이티드 | A system and method for controlling access to an electronic message recipient |
US7716727B2 (en) * | 2004-10-29 | 2010-05-11 | Microsoft Corporation | Network security device and method for protecting a computing device in a networked environment |
JP2006229410A (en) * | 2005-02-16 | 2006-08-31 | Matsushita Electric Ind Co Ltd | Communication method, communication system, communication device and communication program |
US7903672B1 (en) * | 2005-08-30 | 2011-03-08 | Juniper Networks, Inc. | Signaling protocol registration load reduction |
US8281385B2 (en) * | 2005-09-29 | 2012-10-02 | Rockwell Automation Technologies, Inc. | Internet friendly proxy server extending legacy software connectivity |
US8266696B2 (en) * | 2005-11-14 | 2012-09-11 | Cisco Technology, Inc. | Techniques for network protection based on subscriber-aware application proxies |
US8301767B1 (en) | 2005-12-21 | 2012-10-30 | Mcafee, Inc. | System, method and computer program product for controlling network communications based on policy compliance |
US8077849B2 (en) * | 2006-01-10 | 2011-12-13 | Utbk, Inc. | Systems and methods to block communication calls |
JP4537326B2 (en) * | 2006-01-25 | 2010-09-01 | キヤノン株式会社 | Image processing apparatus and image processing apparatus control method |
US7603333B2 (en) * | 2006-06-14 | 2009-10-13 | Microsoft Corporation | Delayed policy evaluation |
US8451825B2 (en) | 2007-02-22 | 2013-05-28 | Utbk, Llc | Systems and methods to confirm initiation of a callback |
US8019837B2 (en) * | 2009-01-14 | 2011-09-13 | International Business Machines Corporation | Providing network identity for virtual machines |
US8024482B2 (en) * | 2009-02-16 | 2011-09-20 | Microsoft Corporation | Dynamic firewall configuration |
US8458769B2 (en) | 2009-12-12 | 2013-06-04 | Akamai Technologies, Inc. | Cloud based firewall system and service |
US9154462B2 (en) * | 2009-12-22 | 2015-10-06 | At&T Intellectual Property I, L.P. | Methods, systems, and computer program products for managing firewall change requests in a communication network |
US20110219443A1 (en) | 2010-03-05 | 2011-09-08 | Alcatel-Lucent Usa, Inc. | Secure connection initiation with hosts behind firewalls |
US8583913B1 (en) | 2011-09-14 | 2013-11-12 | Amazon Technologies, Inc. | Securely determining internet connectivity between networks |
TW201519617A (en) * | 2013-11-12 | 2015-05-16 | Service & Quality Technology | Network connection method and system thereof |
US10135792B2 (en) * | 2015-08-25 | 2018-11-20 | Anchorfree Inc. | Secure communications with internet-enabled devices |
US9961107B2 (en) * | 2016-02-19 | 2018-05-01 | Secureworks Corp. | System and method for detecting and monitoring persistent events |
US10594731B2 (en) * | 2016-03-24 | 2020-03-17 | Snowflake Inc. | Systems, methods, and devices for securely managing network connections |
US10467551B2 (en) | 2017-06-12 | 2019-11-05 | Ford Motor Company | Portable privacy management |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5764899A (en) * | 1995-11-13 | 1998-06-09 | Motorola, Inc. | Method and apparatus for communicating an optimized reply |
US6832321B1 (en) * | 1999-11-02 | 2004-12-14 | America Online, Inc. | Public network access server having a user-configurable firewall |
Family Cites Families (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5251205A (en) * | 1990-09-04 | 1993-10-05 | Digital Equipment Corporation | Multiple protocol routing |
US5835726A (en) * | 1993-12-15 | 1998-11-10 | Check Point Software Technologies Ltd. | System for securing the flow of and selectively modifying packets in a computer network |
US5598536A (en) * | 1994-08-09 | 1997-01-28 | Shiva Corporation | Apparatus and method for providing remote users with the same unique IP address upon each network access |
US5689638A (en) * | 1994-12-13 | 1997-11-18 | Microsoft Corporation | Method for providing access to independent network resources by establishing connection using an application programming interface function call without prompting the user for authentication data |
US5872847A (en) * | 1996-07-30 | 1999-02-16 | Itt Industries, Inc. | Using trusted associations to establish trust in a computer network |
US6233686B1 (en) | 1997-01-17 | 2001-05-15 | At & T Corp. | System and method for providing peer level access control on a network |
JP3591753B2 (en) | 1997-01-30 | 2004-11-24 | 富士通株式会社 | Firewall method and method |
US5987606A (en) | 1997-03-19 | 1999-11-16 | Bascom Global Internet Services, Inc. | Method and system for content filtering information retrieved from an internet computer network |
US6212558B1 (en) * | 1997-04-25 | 2001-04-03 | Anand K. Antur | Method and apparatus for configuring and managing firewalls and security devices |
US5968176A (en) * | 1997-05-29 | 1999-10-19 | 3Com Corporation | Multilayer firewall system |
US5958016A (en) * | 1997-07-13 | 1999-09-28 | Bell Atlantic Network Services, Inc. | Internet-web link for access to intelligent network service control |
US6249805B1 (en) * | 1997-08-12 | 2001-06-19 | Micron Electronics, Inc. | Method and system for filtering unauthorized electronic mail messages |
US6199102B1 (en) * | 1997-08-26 | 2001-03-06 | Christopher Alan Cobb | Method and system for filtering electronic messages |
JPH11175422A (en) * | 1997-12-11 | 1999-07-02 | Sharp Corp | Electronic mail device and computer readable record medium for recording electronic mail program |
US6484261B1 (en) * | 1998-02-17 | 2002-11-19 | Cisco Technology, Inc. | Graphical network security policy management |
US6141755A (en) * | 1998-04-13 | 2000-10-31 | The United States Of America As Represented By The Director Of The National Security Agency | Firewall security apparatus for high-speed circuit switched networks |
US6219694B1 (en) * | 1998-05-29 | 2001-04-17 | Research In Motion Limited | System and method for pushing information from a host system to a mobile data communication device having a shared electronic address |
US6321334B1 (en) * | 1998-07-15 | 2001-11-20 | Microsoft Corporation | Administering permissions associated with a security zone in a computer system security model |
US6088796A (en) * | 1998-08-06 | 2000-07-11 | Cianfrocca; Francis | Secure middleware and server control system for querying through a network firewall |
-
1999
- 1999-11-02 US US09/432,344 patent/US6832321B1/en not_active Expired - Lifetime
-
2000
- 2000-10-31 AU AU12465/01A patent/AU1246501A/en not_active Abandoned
- 2000-10-31 EP EP00974032A patent/EP1226693A2/en not_active Ceased
- 2000-10-31 JP JP2001535145A patent/JP3819295B2/en not_active Expired - Lifetime
- 2000-10-31 CA CA002390184A patent/CA2390184C/en not_active Expired - Lifetime
- 2000-10-31 WO PCT/US2000/029922 patent/WO2001033320A2/en not_active Application Discontinuation
-
2004
- 2004-12-13 US US11/009,150 patent/US8011000B2/en active Active
-
2011
- 2011-06-27 US US13/169,451 patent/US20110258695A1/en not_active Abandoned
-
2012
- 2012-09-15 US US13/621,014 patent/US20130074153A1/en not_active Abandoned
- 2012-09-15 US US13/621,017 patent/US20130074154A1/en not_active Abandoned
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5764899A (en) * | 1995-11-13 | 1998-06-09 | Motorola, Inc. | Method and apparatus for communicating an optimized reply |
US6832321B1 (en) * | 1999-11-02 | 2004-12-14 | America Online, Inc. | Public network access server having a user-configurable firewall |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10662663B2 (en) | 2016-09-27 | 2020-05-26 | American Waves Machines, Inc. | Wave generator with wave damping |
Also Published As
Publication number | Publication date |
---|---|
US8011000B2 (en) | 2011-08-30 |
WO2001033320A3 (en) | 2002-01-10 |
CA2390184C (en) | 2007-05-15 |
CA2390184A1 (en) | 2001-05-10 |
US20050120247A1 (en) | 2005-06-02 |
US20110258695A1 (en) | 2011-10-20 |
US6832321B1 (en) | 2004-12-14 |
JP3819295B2 (en) | 2006-09-06 |
AU1246501A (en) | 2001-05-14 |
WO2001033320A2 (en) | 2001-05-10 |
US20130074153A1 (en) | 2013-03-21 |
EP1226693A2 (en) | 2002-07-31 |
JP2003513579A (en) | 2003-04-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6832321B1 (en) | Public network access server having a user-configurable firewall | |
US10284603B2 (en) | System and method for providing network and computer firewall protection with dynamic address isolation to a device | |
JP3009737B2 (en) | Security equipment for interconnected computer networks | |
US8006296B2 (en) | Method and system for transmitting information across a firewall | |
US8332464B2 (en) | System and method for remote network access | |
US5623601A (en) | Apparatus and method for providing a secure gateway for communication and data exchanges between networks | |
US6182226B1 (en) | System and method for controlling interactions between networks | |
EP1771979B1 (en) | A method and systems for securing remote access to private networks | |
EP1859354B1 (en) | System for protecting identity in a network environment | |
JP2016530814A (en) | Gateway device to block a large number of VPN connections | |
JPH11353258A (en) | Method and device for fire wall security | |
US10516652B1 (en) | Security association management | |
US20020103878A1 (en) | System for automated configuration of access to the internet | |
CA2136150C (en) | Apparatus and method for providing a secure gateway for communication and data exchanges between networks | |
CN105959345A (en) | Enterprise network service accelerating method, enterprise network service accelerating device and proxy server using same | |
Mahmud | Improving Internet access in the UMMC-A Nadi it innovation | |
Srinivasan | Internet security agent for Windows NT using a layered service provider | |
MXPA96002964A (en) | Security system for interconnected computer networks |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: META PLATFORMS, INC., CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:FACEBOOK, INC.;REEL/FRAME:058961/0436 Effective date: 20211028 |