# US 2006/0190998 A1 · Determining firewall rules for reverse firewalls > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2006/0190998 A1 - Document ID: US20060190998A1 - Status: Published application - Kind: A1 - Application number: 11/290,976 - Filed: 2005-11-30 - Published: 2006-08-24 - Earliest claimed: 2005-02-17 - Assignees: AT&T Corp. - Inventors: William Aiello; Charles Kalmanek; William Leighton; Patrick McDaniel; Subhabrata Sen; Oliver Spatscheck; Jacobus Van der Merwe - Web page: https://patentgrep.com/patent/US20060190998A1 ## CPC - H04W 28/00: Network traffic management; Network resource management - H04L 43/16: Threshold monitoring - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0254: {Stateful filtering} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A reverse firewall for removing undesirable traffic from a computing network, such as a virtual private network (VPN), is disclosed. The reverse firewall uses firewall rules that may be determined and maintained within the enterprise network to control communication sent between computers in the computing network. The reverse firewall rules may be used to identify the communications between computers in the network that are undesirable and/or intrusive. For example, a computer in a network that is infected with a worm or that is surreptitiously hosting a denial-of-service attack may be identified by the reverse firewall and quarantined. The reverse firewall may be implemented in hardware and/or software. ## Claims ### Claim 1 A method for securing a network using a reverse firewall, the reverse firewall accessing a profile of a host in the network, the method comprising the steps of: at the reverse firewall, receiving a network communication from a host in the network; if parameters of the network communication from the host are in the profile of the host, allowing the network communication from the host; and if parameters of the network communication from the host are not in the profile of the host, enforcing a throttling discipline on the network communication to determine whether to allow or to block the network communication from the host. ### Claim 2 (depends on 1) The method of claim 1, the reverse firewall further comprising an out-of-profile counter for each host in the network, the method further comprising the steps of: updating the out-of-profile counter for the host, if the parameters of the network communication from the host are not in the profile of the host. ### Claim 3 (depends on 2) The method of claim 2, wherein the throttling discipline is a n-r-relaxed discipline. ### Claim 4 (depends on 2) The method of claim 2, wherein the throttling discipline is a n-r-strict discipline. ### Claim 5 (depends on 2) The method of claim 2, wherein the throttling discipline is a n-r-open discipline for controlling out-of-profile network communication from the host. ### Claim 6 (depends on 4) The method of claim 4, the value of n being zero, and all network communication from the host being blocked when an out-of-profile network communication is attempted by the host. ### Claim 7 (depends on 1) The method of claim 1, the parameters of the network communication from the host being in the profile of the host if the destination address, destination port, and protocol of the network communication are present in the profile of the host. ### Claim 8 (depends on 1) The method of claim 1, the parameters of the network communication from the host being in the profile of the host if the destination address and the destination port of the network communication are present in the profile of the host. ### Claim 9 (depends on 1) The method of claim 1, the parameters of the network communication from the host being in the profile of the host if the destination address of the network communication is present in the profile of the host. ### Claim 10 A method for determining a communications management policy for a reverse firewall in a network, the method comprising the steps of: generating a profile for a host in the network; and setting a throttling discipline for out-of-profile network communication from the host. ### Claim 11 (depends on 10) The method of claim 10, the step of generating a profile of a host including generating an initial set of rules corresponding to network communication originating from the host, and at least some of the initial set of rules are based on an analysis of network communication between a plurality of hosts in the network during a learning period. ### Claim 12 (depends on 11) The method of claim 11, the profile of the host comprising PCSPP rules. ### Claim 13 (depends on 11) The method of claim 11, the profile of the host comprising PCSP rules. ### Claim 14 (depends on 11) The method of claim 11, the profile of the host comprising PSP rules. ### Claim 15 (depends on 10) The method of claim 10, further comprising the step of: updating the profile of the host in the network, the profile being stored in the reverse firewall. ### Claim 16 (depends on 15) The method of claim 15, the step of updating the profile of the host including automatically updating the set of rules to accommodate for known undesirable network communication. ### Claim 17 (depends on 16) The method of claim 16, the known undesirable network communication comprising at least one of: tcp communication between two hosts in the network that consists of less than three packets in each direction; udp communication between two hosts in the network that consists of less than two packets in either direction; and no icmp data communication. ### Claim 18 A network device for controlling a network communication sent from a host in a network, the network device configured to enforce a profile of the host and a throttling discipline, the device comprising: a memory unit storing a set of rules corresponding to the profile of the host in the network, the network device accessing the memory unit to identify the set of rules corresponding to the profile of the host in the network; and an out-of-profile counter for use by the network device to enforce the throttling discipline. ### Claim 19 (depends on 18) The device of claim 18, the network device comprising a programmable router configured as a reverse firewall, the host in the network being connected to the network device. ### Claim 20 (depends on 18) The device of claim 18 coupled to an out-of-profile-counter, the out-of-profile counter being provided for each host in the network, the profile being stored in the memory unit, and the out-of-profile counter comprising a number and a timer.