US 2012/0260331 A1 · Network Firewall Host Application Identification and Authentication

Abstract

Systems for providing information on network firewall host application identification and authentication include an identifying and transmitting agent on a host computer, configured to identify each application in use, tag the application identity with a host identity, combine these and other information into a data packet, and securely transmit the data packet to the network based firewall. The embodiment also includes an application identity listener on the network based firewall, configured to receive the information data packet, decode the data packet and provide to the network based firewall the identity of the application. The network based firewall is provided with an application-awareness via an extension of firewall filtering or security policy rules via the addition of a new application identity parameter upon which filtering can be based. Other systems and methods are also provided.

Claims20

Dependent claims

A method for providing host application identification and authentication to a network based firewall, the method comprising:

detecting data packets transmitted by a host application executing on a host computer;
in response to detecting the data packets transmitted by the host application,
assigning an active category to the host application, the active category indicating that the host application is actively transmitting the data packets, and
resetting a timer adapted to expire when the host application should be updated from the active category to a non-active category, the timer configured to expire after a length of time in which no additional data packets are transmitted from the host application, the non-active categorization indicating that the host computer is not actively transmitting the data packets;
upon resetting the timer, receiving an indication that the timer has expired after the length of time;
in response to receiving the indication that the timer has expired, updating the host application from the active category to the non-active category;
assembling a data set comprising (a) an identification of the host application and (b) a current categorization of the host application;
and
conveying the data set in a secure manner to the network based firewall.

6 more elements

A system for providing host application identification and authentication to a network based firewall, comprising:

a processor;
and
a memory coupled to the processor, the memory comprising instructions that, when executed by the processor, cause the processor to perform a method comprising:
detecting data packets transmitted by a host application executing on a host computer;
in response to detecting the data packets transmitted by the host application,
assigning an active category to the host application, the active category indicating that the host application is actively transmitting the data packets, and
resetting a timer adapted to expire when the host application should be updated from the active category to a non-active category, the timer configured to expire after a length of time in which no additional data packets are transmitted from the host application, the non-active categorization indicating that the host computer is not actively transmitting the data packets;
upon resetting the timer, receiving an indication that the timer has expired after the length of time;
in response to receiving the indication that the timer has expired, updating the host application from the active category to the non-active category;
assembling a data set comprising (a) an identification of the host application and (b) a current categorization of the host application;
and
conveying the data set in a secure manner to the network based firewall.

9 more elements

A computer-readable storage medium having instructions stored thereon for execution by a processor to perform a method for providing host application identification and authentication to a network based firewall, the method comprising:

detecting data packets transmitted by a host application executing on a host computer;
in response to detecting the data packets transmitted by the host application,
assigning an active category to the host application, the active category indicating that the host application is actively transmitting the data packets, and
resetting a timer adapted to expire when the host application should be updated from the active category to a non-active category, the timer configured to expire after a length of time in which no additional data packets are transmitted from the host application, the non-active categorization indicating that the host computer is not actively transmitting the data packets;
upon resetting the timer, receiving an indication that the timer has expired after the length of time;
in response to receiving the indication that the timer has expired, updating the host application from the active category to the non-active category;
assembling a data set comprising (a) an identification of the host application and (b) a current categorization of the host application;
and
conveying the data set in a secure manner to the network based firewall.

6 more elements

Dependencies are inferred from the claim text.

Network Firewall Host Application Identification and Authentication

Life of this patent

Network Firewall Host Application Identification and Authentication

Life of this patent

Abstract

Claims20