WO2003030004A1 - Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device - Google Patents

Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device Download PDF

Info

Publication number
WO2003030004A1
WO2003030004A1 PCT/US2002/030835 US0230835W WO03030004A1 WO 2003030004 A1 WO2003030004 A1 WO 2003030004A1 US 0230835 W US0230835 W US 0230835W WO 03030004 A1 WO03030004 A1 WO 03030004A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
layer
zone
packets
firewall
Prior art date
Application number
PCT/US2002/030835
Other languages
French (fr)
Inventor
Yu Ming Mao
Roger Jia-Jyi Lian
Guangsong Huang
Lee Chik Cheung
Original Assignee
Netscreen Technologies, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
First worldwide family litigation filed litigation Critical https://patents.darts-ip.com/?family=25513451&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=WO2003030004(A1) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by Netscreen Technologies, Inc. filed Critical Netscreen Technologies, Inc.
Priority to JP2003533141A priority Critical patent/JP4332033B2/en
Priority to CA002461866A priority patent/CA2461866A1/en
Priority to IL16111202A priority patent/IL161112A0/en
Priority to AU2002327757A priority patent/AU2002327757B2/en
Priority to EP02763764.4A priority patent/EP1438670B1/en
Priority to EP13155632.6A priority patent/EP2595357B1/en
Publication of WO2003030004A1 publication Critical patent/WO2003030004A1/en
Priority to IL161112A priority patent/IL161112A/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227Filtering policies
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/16Implementing security features at a particular protocol layer
    • H04L63/162Implementing security features at a particular protocol layer at the data link layer
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102Entity profiles

Definitions

  • the present invention relates generally to data routing systems, and more particularly to methods and apparatus for providing secure communications on a network.
  • a packet switch communication system includes a network of one or more switches or routers connecting a plurality of users.
  • a packet is the fundamental unit of transfer in the packet switch communication system.
  • a user can be an individual user terminal or another network.
  • a layer 2 (L2) switch is a switching device which receives packets containing data or control information on one port, and based on a media access connection (MAC) address contained within the packet, switches the packet out another port.
  • Conventional L2 switches perform this switching function by evaluating layer 2 (L2) header information contained within the packet in order to determine the proper output port for a particular packet.
  • the L2 switch includes a table that maps MAC addresses with output ports. If a MAC address is unknown (i.e., there is no corresponding entry in the table), then the corresponding packet is broadcast to all output ports with the hope that another component in the packet switched communication system will recognize the MAC address (and pass back information to the forwarding L2 switch to update its table).
  • Other types of L2 devices include bridges.
  • a router is a switching device which receives packets containing data or control information on one port, and based on destination information contained within the packet, routes the packet to a next hop to/toward the destination.
  • Conventional routers perform this switching function by evaluating layer 3 (L3) header information contained within the packet in order to determine a next hop for a particular packet.
  • the layer 3 information includes an IP address associated with the intended destination (as well as source address) for the packet.
  • the network coupling the users can be an intranet, that is, a network connecting one or more private servers such as a local area network (LAN).
  • the network can be a public network, such as the Internet, in which data packets are passed over untrusted communication links.
  • the network configuration can include a combination of public and private networks.
  • two or more LAN's with individual terminals can be coupled together using a public network such as the Internet.
  • a public network such as the Internet.
  • Data security issues can arise when public and private networks are linked or when distinct networks are coupled.
  • conventional packet switched communication systems that include links between public and private networks typically include security measures for assuring network access control and data integrity.
  • packet switched communication systems can include encryption/decryption services.
  • a trusted network or portion of a network
  • individual packets Prior to leaving a trusted network (or portion of a network), individual packets can be encrypted to minimize the possibility of data loss while the packet is transferred over an untrusted (e.g., public) network (or portion thereof).
  • an untrusted network e.g., public
  • the packet Upon receipt at a destination or another trusted portion of the communication system (e.g., at a firewall just before the destination), the packet can be decrypted and subsequently delivered to its intended destination.
  • the use of encryption and decryption allows for the creation of a virtual private network (VPN) between users separated by untrusted communication links.
  • VPN virtual private network
  • a firewall is a device that can be coupled in-line between a public network and private network for screening packets received from the public network.
  • a firewall is a particular type of L3/L4 device that can be used to enforce policy and filtering functions.
  • a firewall can include one or more engines for inspecting, filtering, authenticating, encrypting, decrypting and otherwise manipulating received packets.
  • Conventional firewalls use L3 and L4 header information including IP addresses associated with the source and destination of a given packet being processed. Received packets are inspected and thereafter forwarded or dropped in accordance with the policies associated with the given domain.
  • the invention provides an L2 device in a packet switched communication system.
  • the packet switched communication system has plural zones and each zone represents a distinct security domain and has an associated policy for use in inspecting packets entering/exiting an associated zone.
  • the L2 device includes at least one port coupled to a terminal unit included in a first security zone, at least one port coupled to a terminal unit included in a second security zone, a controller determining for each packet received whether the received packet is destined for another zone, a firewall engine operable to inspect and filter inter-zone packets using a zone specific policy and an L2 switching engine.
  • the L2 switching engine is operable to immediately route to a port all intra-zone packets passing through the L2 device using a table of MAC addresses and corresponding ports, and only route to a port inter-zone packets that are retained after the inspection by the firewall engine.
  • the invention provides an L2 device in a packet switched communication system.
  • the L2 device includes a controller determining for each packet received whether the received packet is to be transferred intra-zone or inter- zone, a firewall engine operable to inspect and filter inter-zone packets using a zone specific policy and an L2 switching engine operable to immediately route to a port all intra-zone packets passing through the L2 device using a table of MAC addresses and corresponding ports and only route to a port inter-zone packets that are retained after the inspection by the firewall engine.
  • the invention provides an L2 device in a packet switched communication system including a controller determining for each packet received whether the received packet is to be transferred inter-zone and a firewall engine operable to inspect and filter inter-zone packets using a zone specific policy prior to routing using L2 protocols.
  • the invention provides an L2 device in a packet switched communication system including a controller determining for each packet received whether the received packet is to be transferred inter-zone and an inspection device operable to inspect and filter inter-zone packets using a zone specific policy prior to routing using L2 protocols.
  • the invention provides an L2 device in a packet switched communication system including a controller determining for each packet received whether the received packet is to be inspected, an inspection device operable to inspect and filter packets identified by the controller including using a zone specific policy and an L2 controller for transferring inspected packets in accordance with L2 header information using L2 protocols.
  • the inspection device can be a firewall including a layer 3 firewall device, a layer 4 firewall device and a layer 7 firewall device.
  • the inspection device can be a firewall that filters based on layer information other than layer 2 header information.
  • the controller can determine each packet that is to pass between security zones and the inspection device only processes inter-zone traffic.
  • the controller can determine each packet that is to remain in a single security zone and the inspection device immediately routes intra-zone packets.
  • the device can route traffic using the MAC address in the layer 2 header of a given packet to determine an egress port on the device to which the packet is to be routed.
  • the device can include a storage element for storing packets that are to be inspected and an L2 controller for transferring packets through the device including determining an egress port for transferring a given packet using a destination MAC address in the given packet and a MAC address table that includes a mapping of MAC addresses and associated egress nodes.
  • the memory element can include a first and second portion. The first portion can store packets to be transferred through the device and the second portion can store packets waiting for inspection.
  • the device can be a L2 switch or an L2 bridge.
  • the invention provides a method for transferring packets in a communication network including receiving a packet at an L2 device, determining whether the received packet is to be transferred inter-zone and inspecting and filtering inter-zone packets using a zone specific policy prior to routing using L2 protocols.
  • the invention provides a method for transferring packets in a communication network including receiving a packet at an L2 device, determining whether the received packet is to be inspected and inspecting and filtering identified packets using a zone specific policy prior to transferring the packet through the L2 device using L2 protocols.
  • the invention provides a method for switching packets in a communication network including receiving a packet at an interface of an L2 device, determining if a destination MAC address associated with the received packet is known and, if not, holding the received packet a predetermined amount of time without transferring the packet to any port of the L2 device, creating a probe packet that includes the unknown MAC address and broadcasting the probe packet to all interfaces except the receiving interface.
  • aspects of the invention can include one or more of the following features.
  • the probe packet can include a time to life (TTL) field in a IP header and the method can include setting a value of the TTL field such that a downstream node having the unknown MAC address and receiving the probe cell will return an expired message to the L2 device.
  • the method can include dropping the packet after the expiration of the predetermined amount of time.
  • the packet can be dropped if the MAC address is unknown.
  • the method can include receiving a response from on one of the broadcast interfaces and updating a table indicating a previously unknown MAC address is associated with the responding interface.
  • the invention provides method of providing secure communications between users without requiring encryption and decryption services at a respective user.
  • the method includes identifying first and second users, coupling the first and second users through two or more L2 devices over a communication network and specifying a virtual private network for communications between the first and second users.
  • the virtual private network is defined between a first and second L2 device in the network.
  • the method includes receiving a packet at either the first or the second L2 device, determining whether the received packet is associated with the virtual private network and encrypting and decrypting as appropriate identified packets using local encryption and decryption services prior to transferring the packet through the L2 device using L2 protocols.
  • Aspects of the invention can include one or more of the following features.
  • the step of determining can include using a destination MAC address associated with the packet to identify a virtual private network.
  • the invention provides a virtual private network for providing secure communications between users without requiring encryption and decryption services at a respective user.
  • the virtual private network includes first and second L2 devices coupling first and second users over a communication network where each of the first and second L2 devices includes a screening mechanism determining whether a received packet is associated with the virtual private network and encryption and decryption services operating on packets associated with the virtual private network prior to a transfer of the packet through the L2 device using L2 protocols.
  • a packet switched communication system allows for the creation of plural security zones within a single device without requiring changes to the network or terminal configuration. Between each zone, a terminal unit can communicate with other terminal units without the knowledge of, yet receiving the benefits of, L2 switching and up to layer 7 security filtering as discussed below.
  • a packet switched communication system is provided that includes L2 switch and firewall functionality.
  • the packet switched communication system acts as an IEEE 802.1Q NLAN L2 conventional switch forwarding/ filtering based on MAC-address for all intra-zone communications.
  • the packet switched communication system allows L2 switching among multiple ports inside a given security zone.
  • the L2 switch also provides up to layer 7 security firewall protections as appropriate for inter-zone or intra-zone traffic including TCP stateful inspection, syn-attack guard, policy-based control, load balancing and other functionalities on each data stream.
  • the packet switched communication system can be configured to include multiple IEEE 802.1Q VLAN based L2 transparent domains. A user can create multiple VLANs, each having its own policy for firewall control.
  • methods are provided for NPN tunnel capability to connect remote clients to the L2 domain. Methods are provided to guard against broadcasting information throughout the zones and violating one or more security constraints when a MAC address that is being processed is not recognized. The methods include the broadcast of probe packets to discover topology information for unknown MAC destinations.
  • FIG. 1 is a block diagram of a packet switched communication system including an L2 firewall enabled switch.
  • FIG. 2a is a schematic view of an L2 firewall enabled switch.
  • FIG. 2b shows an exemplary communication network including plural zones partitioned by a single security switch.
  • FIG. 3 is a flow diagram of a method for processing packets in the security switch of FIG. 2a.
  • FIG. 4 is a flow diagram for a method for processing un-recognized packets in the security switch of FIG. 2a.
  • a packet switch communication network 100 includes a plurality of terminal units 102 configured in a plurality of zones 104 and coupled by one or more switches 106.
  • each terminal unit 102 is of the form of a standalone computer (e.g., a personal computer, a laptop or workstation). Alternatively, one or more terminal units may be of the form of a personal digital assistant (PDA), Web pad, two-way pager, cellular handset, or other termination or remote device in a communication or computing environment. In one implementation, each terminal is a gateway to another network or group of terminal units (e.g., to a LAN or a pool of servers). Each zone 104 embodies a security domain in the communication system. Each security domain can include separate policy, traffic management, accounting and administrative definitions and functions. Security policies, traffic management and other filtering functions can be enforced among and within zones.
  • zones overlap.
  • policies associated with a parent zone can be a superset of the policies associated with one or more sub-zones (each including a subset of the overall policies).
  • the policies associated with the parent zone may be separate and distinct from the policies of each sub-zone.
  • a zone can include one or more sub-zones, each including a separate set of policies.
  • each zone is associated with physical boundaries or other segmentation in the communication network.
  • the assignment of particular terminal units to zones may represent groupings or combinations in a business structure (e.g., zones used to separate different functional entities in a business organization).
  • the zones have no particular relation to physical boundaries. Communication between terminal units in each zone and among terminal units within a zone are controlled in accordance with protocols described below in association with switch 106.
  • Switch 106 may be of different types.
  • each switch 106 is configured as a layer 2 (L2) device and includes a plurality of ports on which packets from the communication network are received and transferred in accordance with L2 protocols.
  • Each switch 106 includes a media access connection (MAC) table for use in determining switching of received packets. The MAC table associates
  • MAC addresses with ports of the switch 106. Packets are processed as they arrive at the ports of each switch 106 in accordance with L2 header information contained within a given packet. Depending on the MAC address, packets are switched to an appropriate output port as specified in the MAC table.
  • switches 106 are configured to enforce security domain constraints. For example, one or more of switches 106 is configured as an L2 firewall enabled security switch (hereinafter "security switch").
  • security switch 200 includes a plurality of ports 202, a switch fabric 220 and an L2 controller 230. Each port 202 is coupled to a security controller 204 by a bus 206. The security controller 204 is coupled to one or more storage elements 208.
  • each port 202 is associated with a separate security controller 204 and storage element 208.
  • the security controller functionality can be combined in a single (as shown) or lesser number of individual security controller units.
  • packets associated with all ports 202 can be stored in a single memory element 208 (as shown).
  • Security switch 200 also includes a firewall device 210 that is coupled to (each) storage element 208 by a security bus 211.
  • L2 controller 230 supports L2 switching protocols. Packets are either directly processed (e.g., intra-zone packets) or processed after a security screening (e.g., for inter-zone packets) as discussed in greater detail below.
  • MAC table 235 Associated with L2 controller 230 is a MAC table 235.
  • MAC table 235 includes plural entries each of which includes a MAC address and an indicator of a port 202 associated therewith.
  • Switch fabric 220 is used to route traffic from storage element 208 to a respective port 202 under the control of L2 controller 230 using bus 221.
  • Storage element 208 is partitioned into two portions.
  • a first portion 215 is used to store packets received from a port 202 that are not subject to security screening. For example, in one implementation, packets received from a terminal unit in a same security zone (e.g., intra-zone traffic) are not subject to security screening. Un-screened packets are processed directly by L2 controller 230 and forwarded out a designated port in accordance with L2 protocols as specified in MAC table 235.
  • Second portion 217 is used to store packets to be screened by firewall device 210.
  • Security controller 204 includes a screening engine 240.
  • Screening engine 240 examines each packet received from a respective port 202 and determines whether security screening is to be performed. In one implementation, screening engine 240 examines the L2 header for each packet, and based on the screening, either forwards the packet to the first or second portion 215 and 217, respectively, of storage element 208.
  • the L2 header includes a destination MAC address that can be mapped to an egress port on the device using the MAC table 235.
  • a security zone identifier Associated with each ingress and egress port is a security zone identifier. Security zone identifiers can be stored in a table of zone identifiers (not shown) that is indexed by port identifier (id).
  • Screening engine 240 compares the security zone identifier associated with the packet being processed (determined from the identification of the egress port from the MAC table using the destination MAC address in the header of the packet being processed) with the security zone identifier associated with the port on which the packet was received in the device. Based on the comparison, screening engine 240 can determine whether the packet is destined for another zone (i.e., constitutes intra-zone or inter- zone communication).
  • the screening of packets can be with or without the knowledge of the individual terminal units.
  • a user interface (not shown) and associated management tools (not shown) for constructing one or more security zones.
  • the security zones are determined based on the destination MAC address included in the L2 header of the packet received. More specifically, each egress port can be assigned to a security zone and have an associated security zone identifier associated therewith.
  • the security zones can be created for plural users coupled to different ports of the security switch 200.
  • security switch 200 can be configured to include three ports, where terminal units associated with a first two of the ports are assigned to a first zone, while terminal units associated with the third port are assigned to a second zone. Other configurations are possible.
  • Zone assignments and partitions are discussed in greater detail below.
  • the user interface allows an administrator or user to configure the security switch 200.
  • the security switch 200 can be configured to create plural security zones and associate one or more interfaces with each zone. Thereafter, policies can be established for inspecting or otherwise screening packets as they traverse the security switch 200.
  • Firewall device 208 includes plural engines for performing packet screening prior to routing packets through security switch 200.
  • Firewall device 208 includes a firewall engine 270 and associated policies 271, authentication engine 272, encryption engine 274, decryption engine 276 and a firewall controller 278.
  • Firewall controller 278 extracts packets from second portion 217 of storage element 208.
  • Firewall controller 278 oversees the distribution of packets within the firewall device as well as the coordination among the respective engines.
  • Each packet is evaluated and processed in accordance with policies based on one or more considerations. For example, packets can be screened based on source, destination or both.
  • One or more policies 271 are retrieved and used by firewall engine 270 to inspect the packet. Packet inspection may also require encryption, decryption and authentication services.
  • packets can be forwarded in the network or dropped as appropriate.
  • packets that are to be forwarded e.g., pass the inspection
  • packets that are to be forwarded are prepared as appropriate (e.g., encrypted) then forwarded to the first portion 215 of storage element 208.
  • the packets may be returned to the second portion 217 of storage element 208 and marked as having been screened.
  • screened packets are forwarded to a queue for processing by L2 controller 230. Screened packets are then processed by L2 controller 230 and switched to an appropriate output port in accordance with conventional L2 processing protocols.
  • Each security switch 200 can be configured to create plural security zones.
  • a communications network having a security switch 200 is shown in FIG. 2b.
  • the communications network is a NLAN structure that includes 3 zones.
  • Security switch 200 includes a user interface and administrative control mechanisms for creating each of the security zones, specifying policies and other criteria for defining and managing each zone.
  • the security zones enforced by the security switch 200 can be transparent to the end users. That is, the security zones can be established at the security switch 200 including the specification of all operating parameters associated with the security domain. Users in each zone may be unaware of the zone structure and may communicate with other users in a conventional manner.
  • a virtual private network can be created between users including encryption and decryption services without requiring the actual encryption and decryption support in the respective end users (e.g., encryption and decryption services can be provided in secure switches disposed between the two users).
  • a system administrator can create a virtual private network between a remote user in one security zone and another user in a second security zone where the individual users are unaware of the VPN services and are not required to include encryption or decryption services locally.
  • the administrator provisioned VPN services are specified for remote users in a same zone.
  • security switch 200 shown in FIG. 2b embodies a VLAN that includes vl -trust, vl-untrust and vl-dmz zones.
  • VI -trust defines a zone that includes two users including user 291 and user 292.
  • Vl-untrust defines a zone that includes a single user 293.
  • Vl-dmz defines a zone that includes three users, users 291, 292 and user 294. Separate policies can be enforced for communications between the three zones.
  • communications that are intra-zone between user 291 and user 292 will not require inspection, and as such are handled by security switch 200 in accordance with conventional L2 protocols.
  • Communications from user 291 to user 293 will invoke an inspection process as defined by the security system architect (e.g., user 291 or 292 or an administrator for such) for communications between VI- trust and Vl-untrust.
  • communications between user 294 and user 291 will invoke an inspection process (e.g., a potentially lesser screen) for communications between VI- dmz and VI -trust.
  • Multiple interfaces are allowed inside each zone.
  • security switch 200 behaves like a tradition L2 bridge forwarding a given packet based on the destination MAC-address. In one implementation, no firewall protection mechanisms are applied for the intra-zone traffic.
  • firewall inspections including policy inspection, TCP stateful inspection, etc. as described above are performed for each incoming packet.
  • the egress interface is determined by the learned destination MAC address on the interface.
  • a method 300 is shown, as invoked by the security switch 200, for processing packets.
  • the method described is made with no particular reference to the specific hardware elements performing the steps.
  • An exemplary hardware configuration is given above.
  • the method can however be implemented in L2 switches having other configurations.
  • the method begins with the receipt of a packet (302).
  • the packet is evaluated to determine whether the packet is to be inspected (304). If so, the packet is pre-processed as appropriate (305) and one or more policies are retrieved (306).
  • the pre-processing of the packet can include decryption and authentication services.
  • the retrieval of a policy includes the identification of the zone to which the packet is being transferred. Packets traveling between zones can be inspected using a security policy. Intra-zone communications may not be inspected.
  • policies can be enforced on intra-zone communications.
  • the retrieval of a policy includes a MAC look-up for the MAC destination address in a received packet in the MAC table to determine an egress port associated with the MAC address and necessarily a security zone.
  • the security zones associated with the packet's ingress and egress ports are compared to determine if the packet is passing to another zone. Assuming that an inspection is to occur, an appropriate policy is retrieved (i.e., based on the ingress port and egress port identifiers and their respective security zones). Thereafter, the packet is inspected (308). Packet inspection can include screening and dropping the packet as required.
  • post-processing operations are invoked as appropriate (310).
  • the packet is dropped (311).
  • the post processing operations can include session set-up, encryption and other functions. Thereafter the packet is processed in accordance with conventional L2 protocols starting at step 312.
  • step 312 either a packet has passed inspection or did not require inspection. In either case, L2 header information is extracted to determine a MAC address associated with the packet. A look-up of the MAC address is performed (314) and the packet is then routed to an appropriate output port (316). Thereafter the process ends.
  • Packets are received at a port 202. Each packet is transferred on bus 205 to, and routed through, security controller 204 and stored in storage element 208 via a storage bus 209. Security controller 204 evaluates each packet to determine if inspection is required and forwards the packets to an appropriate portion of storage device 208. Packets that are not to be inspected (i.e., packets stored in first portion 215 of storage device 208) are processed by L2 controller 230. When L2 controller 230 is available, packets are fetched and processed to determine a port to which the packet should be forwarded.
  • L2 controller 230 evaluates the MAC address associated with the packet, and using MAC table 235, determines a port for routing. After processing by the L2 controller 230, the packet is forwarded to an appropriate link into switch fabric 220 for routing to a determined output port 202.
  • Packets that are to be inspected are transfe ⁇ ed by security controller 204 into second portion 217 of storage element 208.
  • firewall engine 210 When firewall engine 210 is available, a packet is fetched and processed to determine a security policy to be used in inspecting the packet.
  • Firewall engine 270 evaluates IP address(es) associated with the packet and implements traffic control and management functions as appropriate. Packets that are to be forwarded (i.e., pass inspection) are returned to storage element 208. Thereafter, the packet can be forwarded to an appropriate link into switch fabric 220 for routing to a determined output port 202. Other packets are dropped or otherwise handled in accordance with the policies defined for the given security zones. As discussed above, all packets that pass the inspection in the firewall device
  • L2 controller 230 as well as all packets that are not required to be inspected, are processed by L2 controller 230 in accordance with conventional L2 protocols.
  • the processing of packets by L2 controller is modified to maintain security zones. More specifically, as discussed above, conventional L2 switches broadcast on all ports a packet that has a MAC address that is not recognized. This type of broadcast may well violate one or more security policies in place for given zones in the communication network. Accordingly, in one implementation a test packet is broadcast to each port. The broadcasting of test packets is described in more detail in association with FIG. 4.
  • a method 400 is shown for handling packets by the L2 controller and includes receiving a packet to be processed (402).
  • the MAC address for the packet is extracted (404).
  • a check is made to locate an entry in a MAC address table that corresponds to the extracted MAC address (406). If a match is located (407), the packet is routed to an output port associated with the matching entry (408). If no match is located, the packet is dropped (410). In one implementation, the packet is merely held for a predetermined amount of time in hope of receiving information regarding the non-matching MAC address. If no match is located, a probe packet is created (412). The probe packet includes the MAC address associated with the packet being processed (i.e., the original ingress packet).
  • the probe packet is an "ICMP PING" packet with an IP TTL field set to 1.
  • Each packet includes the same MAC addresses (L2) and source /destination IPs (L3) as the ingress packet whose MAC address could not be located.
  • the probe packet is then broadcast to all ports (414). A check is made to determine if a response is received on any of the security device's ports (416).
  • the ICMP PING packet will cause the right gateway, which was to receive and forward the original ingress packet, to respond to the L2 controller in the device with an "ICMP TTL expired" message packet. From the expired packet, the system can identify the proper egress port/zone associated with the received MAC address. This method guarantees that no information in the original ingress packet will be leaked out.
  • the MAC table is updated to include an entry having the MAC address and a port identifier indicating the port on which the response was received (418). Thereafter the process ends.
  • firewall device has been described in terms of screening at the L3 layer level.
  • other screening can be invoked at other levels including layers up to and including layer 7 (L7) processing. Accordingly, other embodiments are within the scope of the following claims.

Abstract

Methods and apparatus for transferring packets in a packet switched communication system. A system (100) is provided that includes an L2 device (106) including a controller (204) determining for each packet received whether the received packet is to be inspected, an inspection device (210) operable to inspect and filter packets identified by the controller (204) including using a zone specific policy and an L2 controller (230) for transferring inspected packets in accordance with L2 header information using L2 protocols.

Description

METHOD AND APPARATUS FOR IMPLEMENTING A LAYER 3/LAYER 7 FIREWALL IN AN L2 DEVICE
BACKGROUND The present invention relates generally to data routing systems, and more particularly to methods and apparatus for providing secure communications on a network.
A packet switch communication system includes a network of one or more switches or routers connecting a plurality of users. A packet is the fundamental unit of transfer in the packet switch communication system. A user can be an individual user terminal or another network.
A layer 2 (L2) switch is a switching device which receives packets containing data or control information on one port, and based on a media access connection (MAC) address contained within the packet, switches the packet out another port. Conventional L2 switches perform this switching function by evaluating layer 2 (L2) header information contained within the packet in order to determine the proper output port for a particular packet. The L2 switch includes a table that maps MAC addresses with output ports. If a MAC address is unknown (i.e., there is no corresponding entry in the table), then the corresponding packet is broadcast to all output ports with the hope that another component in the packet switched communication system will recognize the MAC address (and pass back information to the forwarding L2 switch to update its table). Other types of L2 devices include bridges.
A router is a switching device which receives packets containing data or control information on one port, and based on destination information contained within the packet, routes the packet to a next hop to/toward the destination. Conventional routers perform this switching function by evaluating layer 3 (L3) header information contained within the packet in order to determine a next hop for a particular packet. The layer 3 information includes an IP address associated with the intended destination (as well as source address) for the packet. The network coupling the users can be an intranet, that is, a network connecting one or more private servers such as a local area network (LAN). Alternatively, the network can be a public network, such as the Internet, in which data packets are passed over untrusted communication links. The network configuration can include a combination of public and private networks. For example, two or more LAN's with individual terminals can be coupled together using a public network such as the Internet. Data security issues can arise when public and private networks are linked or when distinct networks are coupled. For example, conventional packet switched communication systems that include links between public and private networks typically include security measures for assuring network access control and data integrity.
In order to assure individual packet security, packet switched communication systems can include encryption/decryption services. Prior to leaving a trusted network (or portion of a network), individual packets can be encrypted to minimize the possibility of data loss while the packet is transferred over an untrusted (e.g., public) network (or portion thereof). Upon receipt at a destination or another trusted portion of the communication system (e.g., at a firewall just before the destination), the packet can be decrypted and subsequently delivered to its intended destination. The use of encryption and decryption allows for the creation of a virtual private network (VPN) between users separated by untrusted communication links.
In addition to security concerns for the data transferred over the public portion of the communications system, the private portions of the network must safeguard against intrusions through the gateway provided at the interface of the private and the public networks. A firewall is a device that can be coupled in-line between a public network and private network for screening packets received from the public network. A firewall is a particular type of L3/L4 device that can be used to enforce policy and filtering functions. A firewall can include one or more engines for inspecting, filtering, authenticating, encrypting, decrypting and otherwise manipulating received packets. Conventional firewalls use L3 and L4 header information including IP addresses associated with the source and destination of a given packet being processed. Received packets are inspected and thereafter forwarded or dropped in accordance with the policies associated with the given domain. SUMMARY
In one aspect, the invention provides an L2 device in a packet switched communication system. The packet switched communication system has plural zones and each zone represents a distinct security domain and has an associated policy for use in inspecting packets entering/exiting an associated zone. The L2 device includes at least one port coupled to a terminal unit included in a first security zone, at least one port coupled to a terminal unit included in a second security zone, a controller determining for each packet received whether the received packet is destined for another zone, a firewall engine operable to inspect and filter inter-zone packets using a zone specific policy and an L2 switching engine. The L2 switching engine is operable to immediately route to a port all intra-zone packets passing through the L2 device using a table of MAC addresses and corresponding ports, and only route to a port inter-zone packets that are retained after the inspection by the firewall engine.
In another aspect, the invention provides an L2 device in a packet switched communication system. The L2 device includes a controller determining for each packet received whether the received packet is to be transferred intra-zone or inter- zone, a firewall engine operable to inspect and filter inter-zone packets using a zone specific policy and an L2 switching engine operable to immediately route to a port all intra-zone packets passing through the L2 device using a table of MAC addresses and corresponding ports and only route to a port inter-zone packets that are retained after the inspection by the firewall engine.
In another aspect, the invention provides an L2 device in a packet switched communication system including a controller determining for each packet received whether the received packet is to be transferred inter-zone and a firewall engine operable to inspect and filter inter-zone packets using a zone specific policy prior to routing using L2 protocols.
In another aspect, the invention provides an L2 device in a packet switched communication system including a controller determining for each packet received whether the received packet is to be transferred inter-zone and an inspection device operable to inspect and filter inter-zone packets using a zone specific policy prior to routing using L2 protocols. In another aspect, the invention provides an L2 device in a packet switched communication system including a controller determining for each packet received whether the received packet is to be inspected, an inspection device operable to inspect and filter packets identified by the controller including using a zone specific policy and an L2 controller for transferring inspected packets in accordance with L2 header information using L2 protocols.
Aspects of the invention can include one or more of the following features. The inspection device can be a firewall including a layer 3 firewall device, a layer 4 firewall device and a layer 7 firewall device. The inspection device can be a firewall that filters based on layer information other than layer 2 header information. The controller can determine each packet that is to pass between security zones and the inspection device only processes inter-zone traffic. The controller can determine each packet that is to remain in a single security zone and the inspection device immediately routes intra-zone packets. The device can route traffic using the MAC address in the layer 2 header of a given packet to determine an egress port on the device to which the packet is to be routed.
The device can include a storage element for storing packets that are to be inspected and an L2 controller for transferring packets through the device including determining an egress port for transferring a given packet using a destination MAC address in the given packet and a MAC address table that includes a mapping of MAC addresses and associated egress nodes. The memory element can include a first and second portion. The first portion can store packets to be transferred through the device and the second portion can store packets waiting for inspection. The device can be a L2 switch or an L2 bridge. In another aspect, the invention provides a method for transferring packets in a communication network including receiving a packet at an L2 device, determining whether the received packet is to be transferred inter-zone and inspecting and filtering inter-zone packets using a zone specific policy prior to routing using L2 protocols.
In another aspect, the invention provides a method for transferring packets in a communication network including receiving a packet at an L2 device, determining whether the received packet is to be inspected and inspecting and filtering identified packets using a zone specific policy prior to transferring the packet through the L2 device using L2 protocols.
In another aspect, the invention provides a method for switching packets in a communication network including receiving a packet at an interface of an L2 device, determining if a destination MAC address associated with the received packet is known and, if not, holding the received packet a predetermined amount of time without transferring the packet to any port of the L2 device, creating a probe packet that includes the unknown MAC address and broadcasting the probe packet to all interfaces except the receiving interface. Aspects of the invention can include one or more of the following features.
The probe packet can include a time to life (TTL) field in a IP header and the method can include setting a value of the TTL field such that a downstream node having the unknown MAC address and receiving the probe cell will return an expired message to the L2 device. The method can include dropping the packet after the expiration of the predetermined amount of time. The packet can be dropped if the MAC address is unknown. The method can include receiving a response from on one of the broadcast interfaces and updating a table indicating a previously unknown MAC address is associated with the responding interface.
In another aspect, the invention provides method of providing secure communications between users without requiring encryption and decryption services at a respective user. The method includes identifying first and second users, coupling the first and second users through two or more L2 devices over a communication network and specifying a virtual private network for communications between the first and second users. The virtual private network is defined between a first and second L2 device in the network. The method includes receiving a packet at either the first or the second L2 device, determining whether the received packet is associated with the virtual private network and encrypting and decrypting as appropriate identified packets using local encryption and decryption services prior to transferring the packet through the L2 device using L2 protocols. Aspects of the invention can include one or more of the following features. The step of determining can include using a destination MAC address associated with the packet to identify a virtual private network.
In another aspect, the invention provides a virtual private network for providing secure communications between users without requiring encryption and decryption services at a respective user. The virtual private network includes first and second L2 devices coupling first and second users over a communication network where each of the first and second L2 devices includes a screening mechanism determining whether a received packet is associated with the virtual private network and encryption and decryption services operating on packets associated with the virtual private network prior to a transfer of the packet through the L2 device using L2 protocols.
Aspects of the invention can include one or more of the following advantages. A packet switched communication system is provided that allows for the creation of plural security zones within a single device without requiring changes to the network or terminal configuration. Between each zone, a terminal unit can communicate with other terminal units without the knowledge of, yet receiving the benefits of, L2 switching and up to layer 7 security filtering as discussed below. A packet switched communication system is provided that includes L2 switch and firewall functionality. The packet switched communication system acts as an IEEE 802.1Q NLAN L2 conventional switch forwarding/ filtering based on MAC-address for all intra-zone communications. The packet switched communication system allows L2 switching among multiple ports inside a given security zone. The L2 switch also provides up to layer 7 security firewall protections as appropriate for inter-zone or intra-zone traffic including TCP stateful inspection, syn-attack guard, policy-based control, load balancing and other functionalities on each data stream. In one implementation, the packet switched communication system can be configured to include multiple IEEE 802.1Q VLAN based L2 transparent domains. A user can create multiple VLANs, each having its own policy for firewall control. In addition, methods are provided for NPN tunnel capability to connect remote clients to the L2 domain. Methods are provided to guard against broadcasting information throughout the zones and violating one or more security constraints when a MAC address that is being processed is not recognized. The methods include the broadcast of probe packets to discover topology information for unknown MAC destinations.
The details of one or more embodiments of the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.
DESCRIPTION OF DRAWINGS
FIG. 1 is a block diagram of a packet switched communication system including an L2 firewall enabled switch. FIG. 2a is a schematic view of an L2 firewall enabled switch.
FIG. 2b shows an exemplary communication network including plural zones partitioned by a single security switch.
FIG. 3 is a flow diagram of a method for processing packets in the security switch of FIG. 2a. FIG. 4 is a flow diagram for a method for processing un-recognized packets in the security switch of FIG. 2a.
Like reference symbols in the various drawings indicate like elements.
DETAILED DESCRIPTION
Referring now to FIG. 1, a packet switch communication network 100 includes a plurality of terminal units 102 configured in a plurality of zones 104 and coupled by one or more switches 106.
In one implementation, each terminal unit 102 is of the form of a standalone computer (e.g., a personal computer, a laptop or workstation). Alternatively, one or more terminal units may be of the form of a personal digital assistant (PDA), Web pad, two-way pager, cellular handset, or other termination or remote device in a communication or computing environment. In one implementation, each terminal is a gateway to another network or group of terminal units (e.g., to a LAN or a pool of servers). Each zone 104 embodies a security domain in the communication system. Each security domain can include separate policy, traffic management, accounting and administrative definitions and functions. Security policies, traffic management and other filtering functions can be enforced among and within zones. In one implementation, security policies are enforced between zones, while intra-zone communications are not subject to the security constraints. In one implementation, zones overlap. When zones overlap, policies associated with a parent zone can be a superset of the policies associated with one or more sub-zones (each including a subset of the overall policies). Alternatively, the policies associated with the parent zone may be separate and distinct from the policies of each sub-zone. For example, in one implementation, a zone can include one or more sub-zones, each including a separate set of policies.
In one implementation, each zone is associated with physical boundaries or other segmentation in the communication network. Alternatively, the assignment of particular terminal units to zones may represent groupings or combinations in a business structure (e.g., zones used to separate different functional entities in a business organization). Alternatively, the zones have no particular relation to physical boundaries. Communication between terminal units in each zone and among terminal units within a zone are controlled in accordance with protocols described below in association with switch 106.
Switch 106 may be of different types. In one implementation, each switch 106 is configured as a layer 2 (L2) device and includes a plurality of ports on which packets from the communication network are received and transferred in accordance with L2 protocols. Each switch 106 includes a media access connection (MAC) table for use in determining switching of received packets. The MAC table associates
MAC addresses with ports of the switch 106. Packets are processed as they arrive at the ports of each switch 106 in accordance with L2 header information contained within a given packet. Depending on the MAC address, packets are switched to an appropriate output port as specified in the MAC table. One or more of switches 106 are configured to enforce security domain constraints. For example, one or more of switches 106 is configured as an L2 firewall enabled security switch (hereinafter "security switch"). Referring now to FIG. 2, a security switch 200 includes a plurality of ports 202, a switch fabric 220 and an L2 controller 230. Each port 202 is coupled to a security controller 204 by a bus 206. The security controller 204 is coupled to one or more storage elements 208. In one implementation (not shown), each port 202 is associated with a separate security controller 204 and storage element 208. Alternatively, the security controller functionality can be combined in a single (as shown) or lesser number of individual security controller units. In addition, packets associated with all ports 202 can be stored in a single memory element 208 (as shown). Security switch 200 also includes a firewall device 210 that is coupled to (each) storage element 208 by a security bus 211.
L2 controller 230 supports L2 switching protocols. Packets are either directly processed (e.g., intra-zone packets) or processed after a security screening (e.g., for inter-zone packets) as discussed in greater detail below. Associated with L2 controller 230 is a MAC table 235. MAC table 235 includes plural entries each of which includes a MAC address and an indicator of a port 202 associated therewith. Switch fabric 220 is used to route traffic from storage element 208 to a respective port 202 under the control of L2 controller 230 using bus 221.
Storage element 208 is partitioned into two portions. A first portion 215 is used to store packets received from a port 202 that are not subject to security screening. For example, in one implementation, packets received from a terminal unit in a same security zone (e.g., intra-zone traffic) are not subject to security screening. Un-screened packets are processed directly by L2 controller 230 and forwarded out a designated port in accordance with L2 protocols as specified in MAC table 235. Second portion 217 is used to store packets to be screened by firewall device 210.
Security controller 204 includes a screening engine 240. Screening engine 240 examines each packet received from a respective port 202 and determines whether security screening is to be performed. In one implementation, screening engine 240 examines the L2 header for each packet, and based on the screening, either forwards the packet to the first or second portion 215 and 217, respectively, of storage element 208. The L2 header includes a destination MAC address that can be mapped to an egress port on the device using the MAC table 235. Associated with each ingress and egress port is a security zone identifier. Security zone identifiers can be stored in a table of zone identifiers (not shown) that is indexed by port identifier (id). Screening engine 240 compares the security zone identifier associated with the packet being processed (determined from the identification of the egress port from the MAC table using the destination MAC address in the header of the packet being processed) with the security zone identifier associated with the port on which the packet was received in the device. Based on the comparison, screening engine 240 can determine whether the packet is destined for another zone (i.e., constitutes intra-zone or inter- zone communication).
The screening of packets can be with or without the knowledge of the individual terminal units. Associated with security switch 200 is a user interface (not shown) and associated management tools (not shown) for constructing one or more security zones. In one implementation, the security zones are determined based on the destination MAC address included in the L2 header of the packet received. More specifically, each egress port can be assigned to a security zone and have an associated security zone identifier associated therewith. Alternatively, the security zones can be created for plural users coupled to different ports of the security switch 200. For example, security switch 200 can be configured to include three ports, where terminal units associated with a first two of the ports are assigned to a first zone, while terminal units associated with the third port are assigned to a second zone. Other configurations are possible. Zone assignments and partitions are discussed in greater detail below. The user interface allows an administrator or user to configure the security switch 200. The security switch 200 can be configured to create plural security zones and associate one or more interfaces with each zone. Thereafter, policies can be established for inspecting or otherwise screening packets as they traverse the security switch 200.
Firewall device 208 includes plural engines for performing packet screening prior to routing packets through security switch 200. Firewall device 208 includes a firewall engine 270 and associated policies 271, authentication engine 272, encryption engine 274, decryption engine 276 and a firewall controller 278. Firewall controller 278 extracts packets from second portion 217 of storage element 208. Firewall controller 278 oversees the distribution of packets within the firewall device as well as the coordination among the respective engines. Each packet is evaluated and processed in accordance with policies based on one or more considerations. For example, packets can be screened based on source, destination or both. One or more policies 271 are retrieved and used by firewall engine 270 to inspect the packet. Packet inspection may also require encryption, decryption and authentication services. One or more of the encryption 272, decryption 274 and authentication 276 engines can be invoked by the firewall controller 278 as part of the inspection processes. In addition, other services can be provided including virtual private network termination services, session set-up and various other traffic management and security related functions. Examples of screening services are discussed in greater detail below. After the inspection, packets can be forwarded in the network or dropped as appropriate. In one implementation, packets that are to be forwarded (e.g., pass the inspection) are prepared as appropriate (e.g., encrypted) then forwarded to the first portion 215 of storage element 208. Alternatively, the packets may be returned to the second portion 217 of storage element 208 and marked as having been screened. In one implementation, screened packets are forwarded to a queue for processing by L2 controller 230. Screened packets are then processed by L2 controller 230 and switched to an appropriate output port in accordance with conventional L2 processing protocols.
Each security switch 200 can be configured to create plural security zones. For example, a communications network having a security switch 200 is shown in FIG. 2b. The communications network is a NLAN structure that includes 3 zones. Security switch 200 includes a user interface and administrative control mechanisms for creating each of the security zones, specifying policies and other criteria for defining and managing each zone. The security zones enforced by the security switch 200 can be transparent to the end users. That is, the security zones can be established at the security switch 200 including the specification of all operating parameters associated with the security domain. Users in each zone may be unaware of the zone structure and may communicate with other users in a conventional manner. For example, a virtual private network can be created between users including encryption and decryption services without requiring the actual encryption and decryption support in the respective end users (e.g., encryption and decryption services can be provided in secure switches disposed between the two users). Accordingly, a system administrator can create a virtual private network between a remote user in one security zone and another user in a second security zone where the individual users are unaware of the VPN services and are not required to include encryption or decryption services locally. In one implementation, the administrator provisioned VPN services are specified for remote users in a same zone.
Alternatively, the users may be aware of the security structure and include indicators (e.g., zone identifiers) in packets transferred to other users. Each user may define their own custom L2 zone and an inter-zone policy for their network security requirements. For example, security switch 200 shown in FIG. 2b embodies a VLAN that includes vl -trust, vl-untrust and vl-dmz zones. VI -trust defines a zone that includes two users including user 291 and user 292. Vl-untrust defines a zone that includes a single user 293. Vl-dmz defines a zone that includes three users, users 291, 292 and user 294. Separate policies can be enforced for communications between the three zones. For example, communications that are intra-zone between user 291 and user 292 will not require inspection, and as such are handled by security switch 200 in accordance with conventional L2 protocols. Communications from user 291 to user 293 will invoke an inspection process as defined by the security system architect (e.g., user 291 or 292 or an administrator for such) for communications between VI- trust and Vl-untrust. Similarly, communications between user 294 and user 291 will invoke an inspection process (e.g., a potentially lesser screen) for communications between VI- dmz and VI -trust. Multiple interfaces are allowed inside each zone. For intra-zone traffic, security switch 200 behaves like a tradition L2 bridge forwarding a given packet based on the destination MAC-address. In one implementation, no firewall protection mechanisms are applied for the intra-zone traffic.
For inter-zone traffic, standard firewall inspections (including policy inspection, TCP stateful inspection, etc. as described above) are performed for each incoming packet. In all cases, the egress interface is determined by the learned destination MAC address on the interface.
Packet Flow
Referring now to FIG. 3, a method 300 is shown, as invoked by the security switch 200, for processing packets. The method described is made with no particular reference to the specific hardware elements performing the steps. An exemplary hardware configuration is given above. The method can however be implemented in L2 switches having other configurations. The method begins with the receipt of a packet (302). The packet is evaluated to determine whether the packet is to be inspected (304). If so, the packet is pre-processed as appropriate (305) and one or more policies are retrieved (306). The pre-processing of the packet can include decryption and authentication services. The retrieval of a policy includes the identification of the zone to which the packet is being transferred. Packets traveling between zones can be inspected using a security policy. Intra-zone communications may not be inspected. In one implementation, policies can be enforced on intra-zone communications. The retrieval of a policy includes a MAC look-up for the MAC destination address in a received packet in the MAC table to determine an egress port associated with the MAC address and necessarily a security zone. The security zones associated with the packet's ingress and egress ports are compared to determine if the packet is passing to another zone. Assuming that an inspection is to occur, an appropriate policy is retrieved (i.e., based on the ingress port and egress port identifiers and their respective security zones). Thereafter, the packet is inspected (308). Packet inspection can include screening and dropping the packet as required. If the packet is to be forwarded on the network (309), post-processing operations are invoked as appropriate (310). Alternatively, the packet is dropped (311). The post processing operations can include session set-up, encryption and other functions. Thereafter the packet is processed in accordance with conventional L2 protocols starting at step 312.
At step 312, either a packet has passed inspection or did not require inspection. In either case, L2 header information is extracted to determine a MAC address associated with the packet. A look-up of the MAC address is performed (314) and the packet is then routed to an appropriate output port (316). Thereafter the process ends.
Referring again to FIG. 2, the process steps are described with reference to one hardware implementation of the invention. Packets are received at a port 202. Each packet is transferred on bus 205 to, and routed through, security controller 204 and stored in storage element 208 via a storage bus 209. Security controller 204 evaluates each packet to determine if inspection is required and forwards the packets to an appropriate portion of storage device 208. Packets that are not to be inspected (i.e., packets stored in first portion 215 of storage device 208) are processed by L2 controller 230. When L2 controller 230 is available, packets are fetched and processed to determine a port to which the packet should be forwarded. L2 controller 230 evaluates the MAC address associated with the packet, and using MAC table 235, determines a port for routing. After processing by the L2 controller 230, the packet is forwarded to an appropriate link into switch fabric 220 for routing to a determined output port 202.
Packets that are to be inspected are transfeπed by security controller 204 into second portion 217 of storage element 208. When firewall engine 210 is available, a packet is fetched and processed to determine a security policy to be used in inspecting the packet. Firewall engine 270 evaluates IP address(es) associated with the packet and implements traffic control and management functions as appropriate. Packets that are to be forwarded (i.e., pass inspection) are returned to storage element 208. Thereafter, the packet can be forwarded to an appropriate link into switch fabric 220 for routing to a determined output port 202. Other packets are dropped or otherwise handled in accordance with the policies defined for the given security zones. As discussed above, all packets that pass the inspection in the firewall device
210 as well as all packets that are not required to be inspected, are processed by L2 controller 230 in accordance with conventional L2 protocols. In one implementation, the processing of packets by L2 controller is modified to maintain security zones. More specifically, as discussed above, conventional L2 switches broadcast on all ports a packet that has a MAC address that is not recognized. This type of broadcast may well violate one or more security policies in place for given zones in the communication network. Accordingly, in one implementation a test packet is broadcast to each port. The broadcasting of test packets is described in more detail in association with FIG. 4.
Referring now to FIG. 4, a method 400 is shown for handling packets by the L2 controller and includes receiving a packet to be processed (402). The MAC address for the packet is extracted (404). A check is made to locate an entry in a MAC address table that corresponds to the extracted MAC address (406). If a match is located (407), the packet is routed to an output port associated with the matching entry (408). If no match is located, the packet is dropped (410). In one implementation, the packet is merely held for a predetermined amount of time in hope of receiving information regarding the non-matching MAC address. If no match is located, a probe packet is created (412). The probe packet includes the MAC address associated with the packet being processed (i.e., the original ingress packet). In one implementation, the probe packet is an "ICMP PING" packet with an IP TTL field set to 1. Each packet includes the same MAC addresses (L2) and source /destination IPs (L3) as the ingress packet whose MAC address could not be located. The probe packet is then broadcast to all ports (414). A check is made to determine if a response is received on any of the security device's ports (416). The ICMP PING packet will cause the right gateway, which was to receive and forward the original ingress packet, to respond to the L2 controller in the device with an "ICMP TTL expired" message packet. From the expired packet, the system can identify the proper egress port/zone associated with the received MAC address. This method guarantees that no information in the original ingress packet will be leaked out. If a response is received (indicating that a device coupled to the receiving port is configured to process packets having the identified MAC address), then the MAC table is updated to include an entry having the MAC address and a port identifier indicating the port on which the response was received (418). Thereafter the process ends.
A number of embodiments of the invention have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. For example, the firewall device has been described in terms of screening at the L3 layer level. Alternatively, other screening can be invoked at other levels including layers up to and including layer 7 (L7) processing. Accordingly, other embodiments are within the scope of the following claims.

Claims

1. A layer 2 device in a packet switched communication system, the packet switched communication system having plural zones, each zone representing a distinct security domain and having an associated policy for use in inspecting packets entering/exiting an associated zone, the a layer 2 device comprising: at least one port coupled to a terminal unit included in a first security zone; at least one port coupled to a terminal unit included in a second security zone; a controller determining for each packet received whether the received packet is destined for another zone; a firewall engine inspecting and filtering inter-zone packets using a zone specific policy; and a layer 2 switching engine immediately transferring to a port all intra-zone packets passing through the layer 2 device using a table of MAC addresses and corresponding ports, and only transferring to a port inter-zone packets that are retained after the inspection by the firewall engine.
2. A layer 2 device in a packet switched communication system, the packet switched communication system having plural zones, each zone representing a distinct security domain and having an associated policy for use in inspecting packets entering/exiting an associated zone, the layer 2 device comprising: a controller determining for each packet received whether the received packet is to be transferred intra-zone or inter-zone; a firewall engine inspecting and filtering inter-zone packets using a zone specific policy; and a layer 2 switching engine operable to immediately route to a port all intra-zone packets passing through the layer 2 device using a table of MAC addresses and corresponding ports, and only route to a port inter-zone packets that are retained after the inspection by the firewall engine.
3. A layer 2 device in a packet switched communication system, the packet switched communication system having plural zones, each zone representing a distinct security domain, the layer 2 device comprising: a controller determining for each packet received whether the received packet is to be transferred inter-zone; and a firewall engine inspecting and filtering inter-zone packets using a zone specific policy prior to routing using layer 2 protocols.
4. A layer 2 device in a packet switched communication system, the packet switched communication system having plural zones, each zone representing a distinct security domain, the layer 2 device comprising: a controller determining for each packet received whether the received packet is to be transfeπed inter-zone; and an inspection device inspecting and filtering inter-zone packets using a zone specific policy prior to routing using layer 2 protocols.
5. A layer 2 device in a packet switched communication system, the packet switched communication system having plural zones, each zone representing a distinct security domain, the layer 2 device comprising: a controller determining for each packet received whether the received packet is to be inspected; an inspection device inspecting and filtering packets identified by the controller including using a zone specific policy; and a layer 2 controller transferring inspected packets in accordance with layer 2 header information using layer 2 protocols.
6. The device of claim 5 wherein the inspection device is a firewall.
7. The device of claim 5 wherein the inspection device is a layer 3 firewall device.
8. The device of claim 5 wherein the inspection device is a layer 4 firewall device.
9. The device of claim 5 wherein the inspection device is a layer 7 firewall device.
10. The device of claim 5 wherein the inspection device is a firewall that filters based on layer information other than layer 2 header information.
11. The device of claim 5 wherein the controller determines each packet that is to pass between security zones and the inspection device only processes inter-zone traffic.
12. The device of claim 5 wherein the controller determines each packet that is to remain in a single security zone and the inspection device immediately transfers intra-zone packets.
13. The device of claim 12 wherein the device uses a MAC address in the layer 2 header of a given packet to determine an egress port on the device to which the packet is to be transfeπed.
14. The device of claim 5 further comprising a storage element for storing packets that are to be inspected and a layer 2 controller transferring packets through the device including determining an egress port for transferring a given packet using a destination MAC address in the given packet and a MAC address table that includes a mapping of MAC addresses and associated egress nodes.
15. The device of claim 14 wherein the memory element includes a first and second portion, the first portion storing packets to be transfeπed through the device, and the second portion storing packets waiting for inspection.
16. The device of claim 5 wherein the device is a layer 2 switch.
17. The device of claim 5 wherein the device is a layer 2 bridge.
18. A method for transferring packets in a communication network, the communication network including plural zones, each zone representing a distinct security domain, the method comprising: receiving a packet at a layer 2 device; determining whether the received packet is to be transfeπed inter-zone; and inspecting and filtering inter-zone packets using a zone specific policy prior to routing using layer 2 protocols.
19. A method for transferring packets in a communication network, the communication network including plural zones, each zone representing a distinct security domain, the method comprising: receiving a packet at a layer 2 device; determining whether the received packet is to be inspected; and inspecting and filtering identified packets using a zone specific policy prior to transferring the packet through the layer 2 device using layer 2 protocols.
20. A method for switching packets in a communication network the communication network including plural zones, each zone representing a distinct security domain, the method comprising: receiving a packet at an interface of a layer 2 device; determining if a destination MAC address associated with the received packet is known; and if not, holding the received packet a predetermined amount of time without transferring the packet to any port of the layer 2 device, creating a probe packet that includes the unknown MAC address, and broadcasting the probe packet to all interfaces except the receiving interface.
21. The method of claim 20 wherein the probe packet includes a time to life (TTL) field in an IP header and the method includes setting a value of the TTL field such that a downstream node having the unknown MAC address and receiving the probe packet will return an expired message to the layer 2 device.
22. The method of claim 20 further comprising dropping the packet after the expiration of the predetermined amount of time.
23. The method of claim 20 wherein the packet is dropped if the MAC address is unknown.
24. The method of claim 20 further comprising receiving a response from one of the broadcast interfaces and updating a table indicating a previously unknown
MAC address is associated with the responding interface.
25. A method of providing secure communications between users without requiring encryption and decryption services at a respective user, the method comprising: identifying first and second users; coupling the first and second users through two or more layer 2 devices over a communication network; specifying a virtual private network for communications between the first and second users, the virtual private network defined between a first and second layer 2 device in the network; receiving a packet at either the first or the second layer 2 device; determining whether the received packet is associated with the virtual private network; and encrypting and decrypting as appropriate identified packets using local encryption and decryption services prior to transferring the packet through the layer 2 device using layer 2 protocols.
26. The method of claim 25 wherein the step of determining includes using a destination MAC address associated with the packet to identify a virtual private network.
27. A virtual private network for providing secure communications between users without requiring encryption and decryption services at a respective user, the virtual private network comprising: first and second layer 2 devices coupling first and second users over a communication network where each of the first and second layer 2 devices includes a screening mechanism determining whether a received packet is associated with the virtual private network, and encryption and decryption services operating on packets associated with the virtual private network prior to a transfer of the packet through the layer 2 device using layer 2 protocols.
PCT/US2002/030835 2001-09-28 2002-09-26 Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device WO2003030004A1 (en)

Priority Applications (7)

Application Number Priority Date Filing Date Title
JP2003533141A JP4332033B2 (en) 2001-09-28 2002-09-26 Layer 3 / layer 7 firewall implementation method and apparatus in L2 device
CA002461866A CA2461866A1 (en) 2001-09-28 2002-09-26 Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device
IL16111202A IL161112A0 (en) 2001-09-28 2002-09-26 Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device
AU2002327757A AU2002327757B2 (en) 2001-09-28 2002-09-26 Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device
EP02763764.4A EP1438670B1 (en) 2001-09-28 2002-09-26 Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device
EP13155632.6A EP2595357B1 (en) 2001-09-28 2002-09-26 Method performed in a network device and system for packet handling
IL161112A IL161112A (en) 2001-09-28 2004-03-25 Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09/967,878 2001-09-28
US09/967,878 US7302700B2 (en) 2001-09-28 2001-09-28 Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device

Publications (1)

Publication Number Publication Date
WO2003030004A1 true WO2003030004A1 (en) 2003-04-10

Family

ID=25513451

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2002/030835 WO2003030004A1 (en) 2001-09-28 2002-09-26 Method and apparatus for implementing a layer 3/layer 7 firewall in an l2 device

Country Status (8)

Country Link
US (5) US7302700B2 (en)
EP (2) EP2595357B1 (en)
JP (1) JP4332033B2 (en)
CN (1) CN100437543C (en)
AU (1) AU2002327757B2 (en)
CA (1) CA2461866A1 (en)
IL (2) IL161112A0 (en)
WO (1) WO2003030004A1 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7869597B2 (en) 2005-11-21 2011-01-11 International Business Machines Corporation Method and system for secure packet communication
CN102035821A (en) * 2009-09-29 2011-04-27 凹凸电子(武汉)有限公司 Firewall / virtual private network integrated system and circuit

Families Citing this family (107)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2362482A (en) * 2000-05-15 2001-11-21 Ridgeway Systems & Software Lt Direct slave addressing to indirect slave addressing
GB2365256A (en) 2000-07-28 2002-02-13 Ridgeway Systems & Software Lt Audio-video telephony with port address translation
GB2369746A (en) * 2000-11-30 2002-06-05 Ridgeway Systems & Software Lt Communications system with network address translation
WO2002071224A1 (en) * 2001-03-01 2002-09-12 Storeage Networking Technologies Storage area network (san) security
US7302700B2 (en) * 2001-09-28 2007-11-27 Juniper Networks, Inc. Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device
US7571239B2 (en) * 2002-01-08 2009-08-04 Avaya Inc. Credential management and network querying
US20030163692A1 (en) * 2002-01-31 2003-08-28 Brocade Communications Systems, Inc. Network security and applications to the fabric
US8201252B2 (en) * 2002-09-03 2012-06-12 Alcatel Lucent Methods and devices for providing distributed, adaptive IP filtering against distributed denial of service attacks
WO2004047375A1 (en) * 2002-11-15 2004-06-03 Infineon Technologies Ag Reducing the memory requirements of a data switch
US7591001B2 (en) * 2004-05-14 2009-09-15 Liquidware Labs, Inc. System, apparatuses, methods and computer-readable media for determining the security status of a computer before establishing a network connection
US7386889B2 (en) * 2002-11-18 2008-06-10 Trusted Network Technologies, Inc. System and method for intrusion prevention in a communications network
US7660980B2 (en) * 2002-11-18 2010-02-09 Liquidware Labs, Inc. Establishing secure TCP/IP communications using embedded IDs
US7549159B2 (en) * 2004-05-10 2009-06-16 Liquidware Labs, Inc. System, apparatuses, methods and computer-readable media for determining the security status of a computer before establishing connection thereto
US20060098649A1 (en) * 2004-11-10 2006-05-11 Trusted Network Technologies, Inc. System, apparatuses, methods, and computer-readable media for determining security realm identity before permitting network connection
US20040123130A1 (en) * 2002-12-20 2004-06-24 Inrange Technologies Corporation Method and apparatus for distributing and activating security parameters
MY141160A (en) * 2003-01-13 2010-03-31 Multimedia Glory Sdn Bhd System and method of preventing the transmission of known and unknown electronic content to and from servers or workstations connected to a common network
US7697568B1 (en) * 2003-03-03 2010-04-13 Cisco Technology, Inc. Method and system for automatic modem bandwidth detection in a router
WO2004090675A2 (en) * 2003-04-03 2004-10-21 Commvault Systems, Inc. System and method for performing storage operations through a firewall
US20040210754A1 (en) * 2003-04-16 2004-10-21 Barron Dwight L. Shared security transform device, system and methods
US7516487B1 (en) 2003-05-21 2009-04-07 Foundry Networks, Inc. System and method for source IP anti-spoofing security
US7562390B1 (en) 2003-05-21 2009-07-14 Foundry Networks, Inc. System and method for ARP anti-spoofing security
EP1634175B1 (en) 2003-05-28 2015-06-24 Citrix Systems, Inc. Multilayer access control security system
US20040255154A1 (en) * 2003-06-11 2004-12-16 Foundry Networks, Inc. Multiple tiered network security system, method and apparatus
KR100503422B1 (en) * 2003-06-13 2005-07-22 한국전자통신연구원 Ethernet switch, apparatus for expanding the port and method therefor
US7426577B2 (en) * 2003-06-19 2008-09-16 Avaya Technology Corp. Detection of load balanced links in internet protocol netwoks
US7876772B2 (en) * 2003-08-01 2011-01-25 Foundry Networks, Llc System, method and apparatus for providing multiple access modes in a data communications network
US7735114B2 (en) * 2003-09-04 2010-06-08 Foundry Networks, Inc. Multiple tiered network security system, method and apparatus using dynamic user policy assignment
US7774833B1 (en) 2003-09-23 2010-08-10 Foundry Networks, Inc. System and method for protecting CPU against remote access attacks
US7606916B1 (en) * 2003-11-10 2009-10-20 Cisco Technology, Inc. Method and apparatus for load balancing within a computer system
US7844731B1 (en) * 2003-11-14 2010-11-30 Symantec Corporation Systems and methods for address spacing in a firewall cluster
US8146148B2 (en) * 2003-11-19 2012-03-27 Cisco Technology, Inc. Tunneled security groups
US8528071B1 (en) 2003-12-05 2013-09-03 Foundry Networks, Llc System and method for flexible authentication in a data communications network
EP1571799B1 (en) * 2004-03-02 2008-11-05 Alcatel Lucent A method to grant access to a data communication network and related device
CN1298141C (en) * 2004-05-20 2007-01-31 中国科学院软件研究所 Safety platform for network data exchange
US7636841B2 (en) 2004-07-26 2009-12-22 Intercall, Inc. Systems and methods for secure data exchange in a distributed collaborative application
US7624435B1 (en) * 2004-07-26 2009-11-24 Trend Micro Incorporated Method and apparatus for managing digital assets
GB2418110B (en) * 2004-09-14 2006-09-06 3Com Corp Method and apparatus for controlling traffic between different entities on a network
US8261337B1 (en) 2004-11-17 2012-09-04 Juniper Networks, Inc. Firewall security between network devices
US8631450B1 (en) * 2004-12-02 2014-01-14 Entropic Communications, Inc. Broadband local area network
WO2006098024A1 (en) * 2005-03-16 2006-09-21 Fujitsu Limited Multicast tree monitoring method and system in ip network
US7881325B2 (en) * 2005-04-27 2011-02-01 Cisco Technology, Inc. Load balancing technique implemented in a storage area network
US7647434B2 (en) 2005-05-19 2010-01-12 Cisco Technology, Inc. Technique for in order delivery of traffic across a storage area network
KR100719118B1 (en) * 2005-10-27 2007-05-17 삼성전자주식회사 Method and system for limitting a function of device in specific perimeters
WO2007055684A2 (en) * 2005-11-09 2007-05-18 Trusted Network Technologies, Inc. Determining security realm identity before permitting network connection
US7649875B2 (en) * 2005-12-23 2010-01-19 Beecher Phillip E Networking layer extension
US20070214502A1 (en) * 2006-03-08 2007-09-13 Mcalister Donald K Technique for processing data packets in a communication network
JP4823728B2 (en) * 2006-03-20 2011-11-24 富士通株式会社 Frame relay device and frame inspection device
US9001645B2 (en) * 2006-05-17 2015-04-07 Rajant Corporation System and method for packet delivery backtracking
JP4813970B2 (en) * 2006-05-29 2011-11-09 日本電信電話株式会社 Bridge device
US7522595B2 (en) * 2006-06-16 2009-04-21 Cisco Technology, Inc. Communicating packets between forwarding contexts using virtual interfaces
US8009566B2 (en) 2006-06-26 2011-08-30 Palo Alto Networks, Inc. Packet classification in a network security device
US8281360B2 (en) * 2006-11-21 2012-10-02 Steven Adams Flewallen Control of communication ports of computing devices using policy-based decisions
US8594085B2 (en) * 2007-04-11 2013-11-26 Palo Alto Networks, Inc. L2/L3 multi-mode switch including policy processing
US8341277B2 (en) * 2007-07-03 2012-12-25 International Business Machines Corporation System and method for connecting closed, secure production network
US8040888B1 (en) * 2007-12-17 2011-10-18 Integrated Device Technology, Inc. Packet switch with port route tables
US8640143B2 (en) * 2008-02-12 2014-01-28 International Business Machines Corporation Method and system for providing preemptive response routing
US8713627B2 (en) 2008-08-14 2014-04-29 Juniper Networks, Inc. Scalable security services for multicast in a router having integrated zone-based firewall
US8316435B1 (en) * 2008-08-14 2012-11-20 Juniper Networks, Inc. Routing device having integrated MPLS-aware firewall with virtual security system support
US8307422B2 (en) * 2008-08-14 2012-11-06 Juniper Networks, Inc. Routing device having integrated MPLS-aware firewall
US8175101B2 (en) * 2008-08-15 2012-05-08 Raytheon Company Multicasting in a network using neighbor information
US8873556B1 (en) 2008-12-24 2014-10-28 Palo Alto Networks, Inc. Application based packet forwarding
US20100265955A1 (en) * 2009-04-17 2010-10-21 Park Sung I Cross layer routing (xrp) protocol
US8127365B1 (en) 2009-11-16 2012-02-28 Trend Micro Incorporated Origination-based content protection for computer systems
US8424091B1 (en) 2010-01-12 2013-04-16 Trend Micro Incorporated Automatic local detection of computer security threats
JP5382451B2 (en) 2010-01-29 2014-01-08 日本電気株式会社 Front-end system, front-end processing method
JP5454399B2 (en) * 2010-07-15 2014-03-26 パナソニック株式会社 Large scale NAT detection device, application switching device, large scale NAT detection method and application switching method
US8687649B2 (en) * 2011-03-08 2014-04-01 International Business Machines Corporation Message forwarding toward a source end node in a converged network environment
US8695096B1 (en) 2011-05-24 2014-04-08 Palo Alto Networks, Inc. Automatic signature generation for malicious PDF files
US9047441B2 (en) 2011-05-24 2015-06-02 Palo Alto Networks, Inc. Malware analysis system
US8516241B2 (en) 2011-07-12 2013-08-20 Cisco Technology, Inc. Zone-based firewall policy model for a virtualized data center
US8640251B1 (en) 2011-12-14 2014-01-28 Trend Micro Incorporated Methods and systems for classifying computer documents into confidential levels using log information
US8826452B1 (en) 2012-01-18 2014-09-02 Trend Micro Incorporated Protecting computers against data loss involving screen captures
US9419941B2 (en) * 2012-03-22 2016-08-16 Varmour Networks, Inc. Distributed computer network zone based security architecture
EP2852107B1 (en) * 2012-06-21 2021-03-03 Huawei Technologies Co., Ltd. Packet processing method and apparatus
JP5445626B2 (en) * 2012-06-25 2014-03-19 横河電機株式会社 Network management system
US9100366B2 (en) 2012-09-13 2015-08-04 Cisco Technology, Inc. Early policy evaluation of multiphase attributes in high-performance firewalls
US11301514B2 (en) 2013-03-02 2022-04-12 Leon Guzenda System and method to identify islands of nodes within a graph database
US10789294B2 (en) * 2013-03-02 2020-09-29 Leon Guzenda Method and system for performing searches of graphs as represented within an information technology system
US9083732B2 (en) 2013-04-12 2015-07-14 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Establishing communication between entities in a shared network
US9917849B2 (en) * 2013-05-01 2018-03-13 Fortinet, Inc. Security system for physical or virtual environments
WO2015041706A1 (en) * 2013-09-23 2015-03-26 Mcafee, Inc. Providing a fast path between two entities
US9560081B1 (en) 2016-06-24 2017-01-31 Varmour Networks, Inc. Data network microsegmentation
US9973472B2 (en) 2015-04-02 2018-05-15 Varmour Networks, Inc. Methods and systems for orchestrating physical and virtual switches to enforce security boundaries
US20170006082A1 (en) * 2014-06-03 2017-01-05 Nimit Shishodia Software Defined Networking (SDN) Orchestration by Abstraction
DE102015002574B4 (en) * 2015-02-27 2018-06-21 Audi Ag Motor vehicle communication network with switch device
US9467476B1 (en) 2015-03-13 2016-10-11 Varmour Networks, Inc. Context aware microsegmentation
US9609026B2 (en) 2015-03-13 2017-03-28 Varmour Networks, Inc. Segmented networks that implement scanning
US10178070B2 (en) 2015-03-13 2019-01-08 Varmour Networks, Inc. Methods and systems for providing security to distributed microservices
US9438634B1 (en) 2015-03-13 2016-09-06 Varmour Networks, Inc. Microsegmented networks that implement vulnerability scanning
US9756015B2 (en) * 2015-03-27 2017-09-05 International Business Machines Corporation Creating network isolation between virtual machines
US9525697B2 (en) 2015-04-02 2016-12-20 Varmour Networks, Inc. Delivering security functions to distributed networks
US10171507B2 (en) * 2016-05-19 2019-01-01 Cisco Technology, Inc. Microsegmentation in heterogeneous software defined networking environments
US9892622B2 (en) 2016-05-27 2018-02-13 At&T Intellectual Property I, L.P. Emergency event virtual network function deployment and configuration
US9787639B1 (en) 2016-06-24 2017-10-10 Varmour Networks, Inc. Granular segmentation using events
US10972437B2 (en) * 2016-08-08 2021-04-06 Talari Networks Incorporated Applications and integrated firewall design in an adaptive private network (APN)
US10298491B2 (en) * 2016-08-25 2019-05-21 Cisco Technology, Inc. Efficient path detection and validation between endpoints in large datacenters
US10645123B1 (en) * 2016-12-28 2020-05-05 Juniper Networks, Inc. Network traffic switching for virtual machines
US10791091B1 (en) * 2018-02-13 2020-09-29 Architecture Technology Corporation High assurance unified network switch
DE102018216959B4 (en) * 2018-10-02 2020-11-12 Continental Automotive Gmbh Method for securing a data packet by an exchange in a network, exchange and motor vehicle
US11201854B2 (en) 2018-11-30 2021-12-14 Cisco Technology, Inc. Dynamic intent-based firewall
DE102019210224A1 (en) * 2019-07-10 2021-01-14 Robert Bosch Gmbh Device and method for attack detection in a computer network
US11336694B2 (en) * 2019-08-05 2022-05-17 Cisco Technology, Inc. Scalable security policy architecture with segregated forwarding and security plane and hierarchical classes
CN110830301B (en) * 2019-11-11 2022-04-22 国网江苏省电力有限公司检修分公司 Power secondary system station control layer topology scanning method and device based on safety encryption
US11343234B2 (en) * 2019-12-10 2022-05-24 Cisco Technology, Inc. Multi-domain extension to cloud security
US11848949B2 (en) * 2021-01-30 2023-12-19 Netskope, Inc. Dynamic distribution of unified policies in a cloud-based policy enforcement system
US11777993B2 (en) 2021-01-30 2023-10-03 Netskope, Inc. Unified system for detecting policy enforcement issues in a cloud-based environment
US11831605B2 (en) * 2021-03-29 2023-11-28 Nokia Solutions And Networks Oy Router firewall

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5968176A (en) 1997-05-29 1999-10-19 3Com Corporation Multilayer firewall system
US6115472A (en) * 1996-09-11 2000-09-05 Nippon Telegraph And Telephone Corporation Contents transmission control method with user authentication functions and recording medium with the method recorded thereon
US6131120A (en) * 1997-10-24 2000-10-10 Directory Logic, Inc. Enterprise network management directory containing network addresses of users and devices providing access lists to routers and servers
US6233688B1 (en) * 1998-06-30 2001-05-15 Sun Microsystems, Inc. Remote access firewall traversal URL
EP1164755A2 (en) 2000-06-15 2001-12-19 Avaya Technology Corp. Policy enforcement switching

Family Cites Families (61)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH06311161A (en) 1993-04-23 1994-11-04 Matsushita Electric Works Ltd Hub device for lan
US5485455A (en) * 1994-01-28 1996-01-16 Cabletron Systems, Inc. Network having secure fast packet switching and guaranteed quality of service
US5544322A (en) * 1994-05-09 1996-08-06 International Business Machines Corporation System and method for policy-based inter-realm authentication within a distributed processing system
US5617421A (en) 1994-06-17 1997-04-01 Cisco Systems, Inc. Extended domain computer network using standard links
US5608726A (en) * 1995-04-25 1997-03-04 Cabletron Systems, Inc. Network bridge with multicast forwarding table
US5889953A (en) * 1995-05-25 1999-03-30 Cabletron Systems, Inc. Policy management and conflict resolution in computer networks
US5684800A (en) * 1995-11-15 1997-11-04 Cabletron Systems, Inc. Method for establishing restricted broadcast groups in a switched network
US5781550A (en) * 1996-02-02 1998-07-14 Digital Equipment Corporation Transparent and secure network gateway
US5918018A (en) * 1996-02-09 1999-06-29 Secure Computing Corporation System and method for achieving network separation
US5768501A (en) * 1996-05-28 1998-06-16 Cabletron Systems Method and apparatus for inter-domain alarm correlation
US5842040A (en) * 1996-06-18 1998-11-24 Storage Technology Corporation Policy caching method and apparatus for use in a communication device based on contents of one data unit in a subset of related data units
US6101170A (en) * 1996-09-27 2000-08-08 Cabletron Systems, Inc. Secure fast packet switch having improved memory utilization
US5708654A (en) * 1996-11-27 1998-01-13 Arndt; Manfred R. Method for detecting proxy ARP replies from devices in a local area network
US5905859A (en) * 1997-01-09 1999-05-18 International Business Machines Corporation Managed network device security method and apparatus
US6591303B1 (en) * 1997-03-07 2003-07-08 Sun Microsystems, Inc. Method and apparatus for parallel trunking of interfaces to increase transfer bandwidth
US6301257B1 (en) * 1997-03-19 2001-10-09 Nortel Networks Limited Method and apparatus for transmitting data frames between switches in a meshed data network
US6212558B1 (en) * 1997-04-25 2001-04-03 Anand K. Antur Method and apparatus for configuring and managing firewalls and security devices
US6049528A (en) * 1997-06-30 2000-04-11 Sun Microsystems, Inc. Trunking ethernet-compatible networks
US5909686A (en) * 1997-06-30 1999-06-01 Sun Microsystems, Inc. Hardware-assisted central processing unit access to a forwarding database
US6088356A (en) * 1997-06-30 2000-07-11 Sun Microsystems, Inc. System and method for a multi-layer network element
US6775692B1 (en) * 1997-07-31 2004-08-10 Cisco Technology, Inc. Proxying and unproxying a connection using a forwarding agent
US6104700A (en) * 1997-08-29 2000-08-15 Extreme Networks Policy based quality of service
US6041058A (en) * 1997-09-11 2000-03-21 3Com Corporation Hardware filtering method and apparatus
US6154775A (en) * 1997-09-12 2000-11-28 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with dynamic rule processing with the ability to dynamically alter the operations of rules
US7143438B1 (en) * 1997-09-12 2006-11-28 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with multiple domain support
US6141749A (en) * 1997-09-12 2000-10-31 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with stateful packet filtering
US6170012B1 (en) * 1997-09-12 2001-01-02 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with cache query processing
US6098172A (en) * 1997-09-12 2000-08-01 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with proxy reflection
US6172981B1 (en) * 1997-10-30 2001-01-09 International Business Machines Corporation Method and system for distributing network routing functions to local area network stations
US6182226B1 (en) * 1998-03-18 2001-01-30 Secure Computing Corporation System and method for controlling interactions between networks
US6141755A (en) * 1998-04-13 2000-10-31 The United States Of America As Represented By The Director Of The National Security Agency Firewall security apparatus for high-speed circuit switched networks
US6456597B1 (en) * 1998-05-04 2002-09-24 Hewlett Packard Co. Discovery of unknown MAC addresses using load balancing switch protocols
JP4080599B2 (en) * 1998-06-17 2008-04-23 富士通株式会社 Communication control apparatus and communication control method applied to multicast-compatible LAN
US6430188B1 (en) * 1998-07-08 2002-08-06 Broadcom Corporation Unified table for L2, L3, L4, switching and filtering
US6304973B1 (en) * 1998-08-06 2001-10-16 Cryptek Secure Communications, Llc Multi-level security network system
US6438133B1 (en) * 1998-09-09 2002-08-20 Cisco Technology, Inc. Load balancing mechanism for a translational bridge environment
US6556541B1 (en) * 1999-01-11 2003-04-29 Hewlett-Packard Development Company, L.P. MAC address learning and propagation in load balancing switch protocols
IL128814A (en) * 1999-03-03 2004-09-27 Packet Technologies Ltd Local network security
US7197044B1 (en) * 1999-03-17 2007-03-27 Broadcom Corporation Method for managing congestion in a network switch
US7643481B2 (en) * 1999-03-17 2010-01-05 Broadcom Corporation Network switch having a programmable counter
US7051066B1 (en) * 1999-07-02 2006-05-23 Cisco Technology, Inc. Integrating service managers into a routing infrastructure using forwarding agents
US6633560B1 (en) * 1999-07-02 2003-10-14 Cisco Technology, Inc. Distribution of network services among multiple service managers without client involvement
US6970913B1 (en) * 1999-07-02 2005-11-29 Cisco Technology, Inc. Load balancing using distributed forwarding agents with application based feedback for different virtual machines
US6704278B1 (en) * 1999-07-02 2004-03-09 Cisco Technology, Inc. Stateful failover of service managers
US6549516B1 (en) * 1999-07-02 2003-04-15 Cisco Technology, Inc. Sending instructions from a service manager to forwarding agents on a need to know basis
US6650641B1 (en) * 1999-07-02 2003-11-18 Cisco Technology, Inc. Network address translation using a forwarding agent
US6742045B1 (en) * 1999-07-02 2004-05-25 Cisco Technology, Inc. Handling packet fragments in a distributed network service environment
US6606315B1 (en) * 1999-07-02 2003-08-12 Cisco Technology, Inc. Synchronizing service instructions among forwarding agents using a service manager
US6735169B1 (en) * 1999-07-02 2004-05-11 Cisco Technology, Inc. Cascading multiple services on a forwarding agent
US6684253B1 (en) * 1999-11-18 2004-01-27 Wachovia Bank, N.A., As Administrative Agent Secure segregation of data of two or more domains or trust realms transmitted through a common data channel
US6754716B1 (en) * 2000-02-11 2004-06-22 Ensim Corporation Restricting communication between network devices on a common network
US7263719B2 (en) * 2000-05-15 2007-08-28 Hewlett-Packard Development Company, L.P. System and method for implementing network security policies on a common network infrastructure
US20020053020A1 (en) * 2000-06-30 2002-05-02 Raytheon Company Secure compartmented mode knowledge management portal
US7047561B1 (en) * 2000-09-28 2006-05-16 Nortel Networks Limited Firewall for real-time internet applications
JP3474548B2 (en) * 2001-04-09 2003-12-08 アライドテレシス株式会社 Collective building
US7212534B2 (en) * 2001-07-23 2007-05-01 Broadcom Corporation Flow based congestion control
US20030033463A1 (en) * 2001-08-10 2003-02-13 Garnett Paul J. Computer system storage
US7302700B2 (en) * 2001-09-28 2007-11-27 Juniper Networks, Inc. Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device
JP2005215935A (en) * 2004-01-29 2005-08-11 Vodafone Kk Firewall
US7895431B2 (en) * 2004-09-10 2011-02-22 Cavium Networks, Inc. Packet queuing, scheduling and ordering
US7535907B2 (en) * 2005-04-08 2009-05-19 Oavium Networks, Inc. TCP engine

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6115472A (en) * 1996-09-11 2000-09-05 Nippon Telegraph And Telephone Corporation Contents transmission control method with user authentication functions and recording medium with the method recorded thereon
US5968176A (en) 1997-05-29 1999-10-19 3Com Corporation Multilayer firewall system
US6131120A (en) * 1997-10-24 2000-10-10 Directory Logic, Inc. Enterprise network management directory containing network addresses of users and devices providing access lists to routers and servers
US6233688B1 (en) * 1998-06-30 2001-05-15 Sun Microsystems, Inc. Remote access firewall traversal URL
EP1164755A2 (en) 2000-06-15 2001-12-19 Avaya Technology Corp. Policy enforcement switching

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1438670A4

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7869597B2 (en) 2005-11-21 2011-01-11 International Business Machines Corporation Method and system for secure packet communication
US8300822B2 (en) 2005-11-21 2012-10-30 International Business Machines Corporation System for secure packet communication
CN102035821A (en) * 2009-09-29 2011-04-27 凹凸电子(武汉)有限公司 Firewall / virtual private network integrated system and circuit

Also Published As

Publication number Publication date
US7302700B2 (en) 2007-11-27
CA2461866A1 (en) 2003-04-10
US20130007839A1 (en) 2013-01-03
JP2005505175A (en) 2005-02-17
EP1438670A4 (en) 2010-12-15
EP2595357A3 (en) 2014-08-20
US7779459B2 (en) 2010-08-17
US8291114B2 (en) 2012-10-16
IL161112A0 (en) 2004-08-31
CN1575462A (en) 2005-02-02
US8689316B2 (en) 2014-04-01
EP1438670A1 (en) 2004-07-21
JP4332033B2 (en) 2009-09-16
AU2002327757B2 (en) 2008-11-06
US20080034414A1 (en) 2008-02-07
US20140215600A1 (en) 2014-07-31
EP2595357B1 (en) 2018-08-29
CN100437543C (en) 2008-11-26
IL161112A (en) 2010-06-16
US20100281533A1 (en) 2010-11-04
US20030065944A1 (en) 2003-04-03
EP1438670B1 (en) 2017-06-14
EP2595357A2 (en) 2013-05-22
US9407605B2 (en) 2016-08-02

Similar Documents

Publication Publication Date Title
US7302700B2 (en) Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device
AU2002327757A1 (en) Method and apparatus for implementing a layer 3/layer 7 firewall in an L2 device
EP1593251B1 (en) Method and apparatus for enforcing security groups for vlans
US7496955B2 (en) Dual mode firewall
US7296291B2 (en) Controlled information flow between communities via a firewall
EP1817893B1 (en) Method and apparatus for ingress filtering using security group information
US20100100616A1 (en) Method and apparatus for controlling traffic between different entities on a network
US20050190758A1 (en) Security groups for VLANs
US20040030765A1 (en) Local network natification
Rietz et al. An SDN-based approach to ward off LAN attacks
JP2001249866A (en) Network with distributed fire wall function, fire wall server with fire wall distribution function and edge node with fire wall function
US7447782B2 (en) Community access control in a multi-community node
US6915351B2 (en) Community separation control in a closed multi-community node
Cisco Introduction to Cisco MPLS VPN Technology
KR20030018018A (en) Packet Control System and Method
Miroshnichenko Design and configuration of a company network: Case study AstraZeneca Russia
Ee et al. Simplifying Access Control in Enterprise Networks

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BY BZ CA CH CN CO CR CU CZ DE DM DZ EE ES FI GB GD GE GH GM HU ID IL IN IS JP KE KG KP KR KZ LK LR LS LT LU LV MA MD MG MK MW MX MZ NO NZ PL PT RO RU SD SG SI SK SL TJ TM TR TT TZ UA UG UZ VN YU ZA

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ UG ZM ZW AM AZ BY KG KZ RU TJ TM AT BE BG CH CY CZ DK EE ES FI FR GB GR IE IT LU MC PT SE SK TR BF BJ CF CG CI GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 161112

Country of ref document: IL

Ref document number: 2461866

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 632/CHENP/2004

Country of ref document: IN

WWE Wipo information: entry into national phase

Ref document number: 2003533141

Country of ref document: JP

REEP Request for entry into the european phase

Ref document number: 2002763764

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2002763764

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2002327757

Country of ref document: AU

Ref document number: 20028213874

Country of ref document: CN

WWP Wipo information: published in national office

Ref document number: 2002763764

Country of ref document: EP