US 2005/0240993 A1Published application

Methodology, system and computer readable medium for streams-based packet filtering

OwnerWilliam Treadwell, Eric Coleinventors

Life of this patent

Estimating the term…

Loading patent…

Abstract

A packet filtering system for use with a host computer implementing a streams sub-system comprises a configuration component for maintaining a collection of configuration parameters based on user input, and a streams interface component for managing bi-directional transmission of packets according to the collection of configuration parameters. The configuration parameters may include sets of authorized port, protocol and address designations. The streams interface component preferably includes corresponding modules for port filtering, protocol filtering and address filtering whereby inbound and outbound packets which are not blocked by any of filtering modules are, respectively, passed upstream and downstream between an associated network device and the stream head. A computerized method for managing bi-directional transmission of packets, as well as a computer-readable medium having executable instructions for managing packet transmission, are also provided.

Claims30

Dependent claims

A packet filtering system for use with a host computer that is configured with a UNIX System V OS implementing a STREAMS sub-system, said packet filtering system comprising:

(a) a configuration component for maintaining a collection of configuration parameters based on user input, said configuration parameters including:
(i) a set of authorized port designations identifying trusted source ports on the host computer for originating outbound network traffic and trusted listening ports on the host computer for receiving inbound network traffic;
(ii) a set of authorized protocol designations identifying trusted communications protocols for inbound and outbound network traffic, respectively;
and
(iii) a set of authorized address designations identifying trusted source addresses for inbound network traffic and trusted destination addresses for outbound network traffic;
(b) a STREAMS interface component for managing bi-directional transmission of packets according to said collection of configuration parameters, said STREAMS interface component including:
(i) a port filtering module dynamically insertable into the stream between the stream head and the driver, said port filtering module operative to analyze inbound and outbound packets and to block transmission of packets which do not conform to said set of authorized port designations;
(ii) a protocol filtering module dynamically insertable into the stream, upstream of said port filtering module, said protocol filtering module operative to analyze inbound and outbound packets and to block transmission of packets which do not conform to said set of authorized protocol designations;
and
(iii) an address filtering module dynamically insertable into the stream, upstream of said protocol filtering module, said address filtering module operative to analyze inbound and outbound packets and to block transmission of packets which do not conform to said set of authorized address designations,
whereby inbound and outbound packets which are not blocked by any of said filtering modules are, respectively, passed upstream and downstream between an associated network device and stream head.

8 more elements

A computerized method of managing bi-directional transmission of packets within a protocol stack of a host computer, wherein said host computer is configured with a UNIX System V OS implementing a STREAMS sub-system that invokes a stream head for regulating data transfer between user processes and network drivers, said computerized method comprising:

with respect to inbound packets intended for upstream transmission, via the STREAMS sub-system, from an associated network driver to an associated user process:
passing each of said inbound packets to an upstream filter that is functionally interfaced between the associated network driver and the stream head, whereby said upstream filter permits upstream transmission to the stream head of inbound packets which conform to inbound configuration parameters, while blocking upstream transmission to the stream head of inbound packets which fail to conform to said inbound configuration parameters;
and
with respect to outbound packets intended for downstream transmission, via the STREAMS sub-system, from an associated user process to an associated network driver:
passing each of said outbound packets to a downstream filter that is functionally interfaced between the stream head and the network driver, whereby said downstream filter permits downstream transmission to the associated network driver of outbound packets which conform to outbound configuration parameters, while blocking downstream transmission to the associated network driver of outbound packets which fail to conform to said outbound configuration parameters.

2 more elements

A computer-readable medium for use with a host computer, wherein said host computer is configured with a UNIX System V OS implementing a STREAMS sub-system that invokes a stream head for regulating data transfer between user processes and network drivers, said computer-readable medium having executable instructions for managing the transmission of packets within the STREAMS sub-system according to a method comprising:

with respect to inbound packets intended for upstream transmission, via the STREAMS sub-system, from an associated network driver to an associated user process:
passing each of said inbound packets to an upstream filter that is functionally interfaced between the associated network driver and the stream head, whereby said upstream filter permits upstream transmission to the stream head of inbound packets which conform to inbound configuration parameters, while blocking upstream transmission to the stream head of inbound packets which fail to conform to said inbound configuration parameters;
and
with respect to outbound packets intended for downstream transmission, via the STREAMS sub-system, from an associated user process to an associated network driver:
passing each of said outbound packets to a downstream filter that is functionally interfaced between the stream head and the network driver, whereby said downstream filter permits downstream transmission to the associated network driver of outbound packets which conform to outbound configuration parameters, while blocking downstream transmission to the associated network driver of outbound packets which fail to conform to said outbound configuration parameters.

2 more elements

Dependencies are inferred from the claim text.