Firewall for filtering tunneled data packets
AssigneeStonesoft Corporation
InventorsRiku Salminen, Tuomo Syvanne, Mika Jalava
Life of this patent
Estimating the term…
Abstract
A method of filtering a tunneled data packet comprising an outer header and an outer payload, the outer payload comprising an inner data packet comprising an inner header and an inner payload, where the value of at least one outer header field of the tunneled data packet is matched to a first rule, and the action defined in the first rule is taken. Taking the action defined in the first rule comprises detecting the inner data packet within the tunneled data packet, matching the value of at least one field of the inner data packet to a second rule, and taking the action defined in the second rule.
Claims11
A method of filtering a data packet, comprising
- receiving a tunneled data packet comprising an outer header and an outer payload, the outer payload comprising an inner data packet comprising an inner header and an inner payload,
- matching the value of at least one outer header field of the tunneled data packet to a first rule, and
- taking the action defined in the first rule comprising
- detecting the inner data packet within the tunneled data packet,
- matching the value of at least one field of the inner data packet to a second rule, and
- taking the action defined in the second rule.
A method according to any of the preceding claims, further comprising
- creating, on the basis of the outer header, to a first connection state table, an entry for processing other data packets of the same tunnel, the entry comprising a value of at least one outer header field for identifying the other data packets of the same tunnel and instructions for filtering the inner data packet, and
- creating, on the basis of the inner header, to a second connection state table, an entry for processing other data packets of the same connection, the entry comprising a value of at least one inner header field for identifying the other data packets of the same connection and instructions for processing the inner data packet.
A method according to any one of the preceding claims, wherein taking the action defined in the second rule comprises
- modifying at least one field of the inner data packet.
A network gateway comprising
- a mechanism for receiving a tunneled data packet comprising an outer header and an outer payload, the outer payload comprising an inner data packet comprising an inner header and an inner payload,
- a mechanism for matching the value of at least one outer header field of the tunneled data packet to a first rule, and
- a mechanism for taking the action defined in the first rule comprising
- a mechanism for detecting the inner data packet within the tunneled data packet,
- a mechanism for matching the value of at least one field of the inner data packet to a second rule, and
- a mechanism for taking the action defined in the second rule.
A computer-readable medium, containing a computer software which, when executed in a computer device, causes the computer device to provide a routine of filtering a data packet comprising
- receiving a tunneled data packet comprising an outer header and an outer payload, the outer payload comprising an inner data packet comprising an inner header and an inner payload,
- matching the value of at least one outer header field of the tunneled data packet to a first rule, and
- taking the action defined in the first rule comprising
- detecting the inner data packet within the tunneled data packet,
- matching the value of at least one field of the inner data packet to a second rule, and
- taking the action defined in the second rule.
Dependencies are inferred from the claim text.