Managing configurations of a firewall
AssigneeTrend Micro Incorporated
InventorBart Trojanowski
Life of this patent
Estimating the term…
Abstract
A method and system for managing multiple firewall configurations are disclosed. The method uses a pointer on a packet object representing a packet to reference a configuration object representing a configuration of the firewall which is assigned to the packet. By using a pointer to link each packet entering a computer system to the most recent configuration, the method can maintain multiple configurations and enable the firewall processing modules to process each packet according to its assigned configuration even if new configurations are released during the transition of the packet through the system. A reference count is also used as a variable by the configuration object to track the number of packets assigned to the configuration. A corresponding system is also provided.
Claims20
A method for managing firewall configurations at a computer, comprising the steps of:
- a) providing a first configuration object representing a configuration of the firewall, the first configuration object having a reference count;
- b) setting the first configuration object as a current configuration by initializing the reference count to a current-value reference count;
- c) generating a packet object representing a packet received at the computer;
- d) assigning said packet object to said first configuration object and, incrementing said reference count upon assigning said packet object to said first configuration object;
- and
- e) processing said packet object by a plurality of firewall processing modules according to said first configuration object.
A method for managing configurations of a firewall at a computer, comprising the steps of:
- a) providing a current configuration object representing a first firewall configuration, and a previous configuration object representing a second firewall configuration, each configuration object having a pointer to a respective configuration binary structure;
- b) representing a first packet received at the computer with a first packet object comprising assigning said first packet object to said previous configuration object;
- c) representing a second packet received at the computer with a second packet object comprising assigning said second packet object to said current configuration object;
- and
- d) processing the first packet object and the second packet object by a plurality of firewall processing modules based on their assigned respective configuration object.
A system for managing multiple firewall configurations at a computer, comprising:
- an agent application module for compiling configuration data into a binary structure configuration data and for generating configuration objects;
- a filter module comprising:
- a configuration database for hosting said configuration objects;
- a platform-specific code module for generating packets objects representing packets received in the computer and for assigning each of said packets objects to one of said configuration objects;
- and
- a plurality of firewall processing modules for processing said packets according to their respectively assigned configuration objects.
Dependencies are inferred from the claim text.