Flexible Network Security System and Method for Permitting Trusted Process

A computer executing a firewall controlling inbound traffic, the firewall protecting the computer against a network connection attempt by setting restrictions on information communicated between networks, the computer comprising:

• an internal permitted program storage configured to store a list of programs permitted by the firewall;
• an input interface configured to accept an indication that one or more permitted network communication programs are permitted by the firewall, thereby resulting in said one or more permitted network communication programs being added to the list of programs permitted by the firewall in the internal permitted program storage;
• a port monitoring unit configured to automatically extract, outside of the firewall, information about a protocol using a server port, wherein the server port is designated as a port of a network communication program providing one or more packets of inbound traffic for a destination port;
• and
• a flexible firewall device making the firewall flexible, the flexible firewall device configured to populate a list of server ports permitted by the firewall in an internal permitted port storage as follows:
• detect that said network communication program tries to listen to said server port;
• in response to detecting that said network communication program tries to listen to said server port, extract, outside of the firewall, using the port monitoring unit, information about the server port requesting communication with the destination port for the packets of inbound traffic;
• and
• automatically store the extracted information about the server port in the internal permitted port storage if said network communication program matches a program on said list of programs permitted by the firewall in the internal permitted program storage;
• wherein the firewall is further configured to thereafter selectively block or allow one or more packets of inbound traffic to the computer as follows:
• make a determination whether a destination port of the one or more packets of inbound traffic matches one of the server ports included in the list of server ports permitted by the firewall in the internal permitted port storage;
• either allow or block the one or more packets of inbound traffic based on the determination whether the destination port of the one or more packets of inbound traffic matches one of the server ports included in the list of server ports permitted by the firewall in the internal permitted port storage, and using the information about the server port and the protocol to determine whether registration exists in the internal permitted port storage;
• and
• in the case of a determination that the registration does not exist, blocking the corresponding packet, and in the case of a determination that the registration exists, transmitting the corresponding packet to a hooked original function.