US 10,834,056 B2Granted

Dynamically controlling firewall ports based on server transactions to reduce risks

AssigneeCA, Inc.

InventorsKrishna Kumar Yadav Nukala, Vikas Pullagura, Shamayel Mohammed Farooqui, Jagadishwara Chary Sriramoju, Lakshmi Priya Vennapusa, Dharanidhar Sahu, Ramana Naga Venkata Mittapalli

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Methods and devices for opening a firewall port for a specified time period are provided. A data packet having a source address and a destination address beyond a firewall transmitted from a process source is intercepted by an interceptor. Responsive to determining, based on the source address, that a firewall port is not open, buffering the data packet. A request comprising an identifier, a protocol identifier, and a time period the firewall port is to be open is transmitted to a firewall controller. The firewall controller authenticates the request based on the identifier and opens a firewall port determined based on the protocol identifier. The interceptor receives an open firewall port notification indicating that the firewall port has been opened and transmits the data packet through the firewall port to the destination address. The firewall controller closes the firewall port when the time period has expired.

Claims18

Dependent claims

A method in a firewall controller, the method comprising:

receiving, via a control channel, a request from a device to open a port of a firewall controlled by the firewall controller such that a plurality of data packets is allowed to pass there through, the request comprising information comprising an identifier, a protocol identifier, and a time period the port of the firewall is to be open;
determining that the protocol identifier identifies at least one of the plurality of data packets as a custom type;
responsive to authenticating the request based on the identifier, and responsive to the protocol identifier identifying at least one of the plurality of data packets as a custom type, selecting a firewall port among a set of firewall ports of the firewall to open based on the protocol identifier and the firewall port being specified in the at least one of the plurality of data packets;
opening the firewall port to allow the plurality of data packets to pass through the firewall port;
transmitting, via the control channel, an open firewall notification to the device indicating that the firewall port is open;
and
responsive to the time period the port of the firewall is to be open expiring:
closing the selected firewall port;
and
transmitting, via the control channel, an expired firewall port notice to the device, the expired firewall port notice comprising an indication that the selected firewall port has been closed.

7 more elements

A method in a server device, the method comprising:

intercepting a data packet transmitted from a process source, the packet having a process source identifier, a source address, and a destination address that is beyond a firewall;
determining if a firewall port of a firewall is open for the packet to be sent to the destination address from the process source responsive to authenticating the process source based on the process source identifier;
responsive to determining the firewall port is not open:
buffering the data packet;
transmitting, via a control channel, a request to a firewall controller to open the firewall port, the request comprising information comprising an identifier, a protocol identifier, and a time period the firewall port is to be open;
receiving, via the control channel, an open firewall port notification indicating that the firewall port has been opened;
and
sending the buffered data packet through the firewall port;
and
responsive to determining the firewall port is open, sending the data packet through the firewall port.

7 more elements

A server device comprising:

a plurality of process sources, each having a unique process source identifier;
an interceptor circuit configured to:
intercept a data packet having a process source identifier and transmitted from one of the plurality of processes, the data packet having a source address and a destination address that is beyond a firewall;
responsive to authenticating the one of the plurality of sources based on the process source identifier:
determine, based on the source address, if a firewall port is open for the data packet to be sent to the destination address from the source address;
responsive to a determination that the firewall port is not open:
buffer the data packet in a buffer circuit;
transmit, via a control channel, a request to a firewall controller to open the firewall port, the request comprising information comprising an identifier, a protocol identifier, and a time period the port of the firewall is to be open;
receive, via the control channel, an open firewall port notification indicating that the firewall port has been opened;
and
send the buffered data packet through the firewall port to the destination address;
responsive to a determination that the firewall port is open, send the data packet through the firewall port to the destination address;
receive an expired firewall port notice comprising an indication that the firewall port has been closed due to the time period expiring.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/050,081Filed 31 Jul 2018
Published: US 2020/0045015 A16 Feb 2020
Granted: 10 Nov 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/029
For separating internal from external traffic, e.g. firewalls: firewall traversal, e.g. tunnelling or, creating pinholes
H04L 63/108
For controlling access to devices or network resources: when the policy decisions are valid for a limited amount of time
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities