Transparent security proxy for unreliable message exchange protocols

A network communication manager for a firewall which intercepts messages addressed to one or more servers coupled to the firewall, the network communication manager comprising:

• a port manager that receives messages from a requesting entity addressed to a server entity;
• a security monitor, operatively coupled to the port manager that monitors messages received from the requesting entity for conformance to supported protocol standards and adherence to a defined security policy;
• and
• a relay, operatively coupled to the security monitor, that relays messages from the requesting entity to the server entity using an address of the firewall, responsive to the security monitor and to addresses in the messages, Relays messages from the server entity addressed to the firewall to the requesting entity inserting the address of the server entity in such messages.

A method of ensuring secure message transfer between a requesting application on one host and a serving application on another host coupled by a network using an unreliable protocol by use of a proxy on a firewall between the hosts, comprising the steps of:

• receiving a message from the requesting application intended for the serving application;
• monitoring the message from the requesting application for conformance to a selected communication protocol;
• relaying the message from the requesting application to the serving application based on a server address in the message and responsive to the conformance of the message to the selected communication protocol while making the message appear as if it originated from the firewall;
• and
• relaying a reply message from the serving application to the requesting application having the address of the serving entity encapsulated in the message as an address of origin.

A storage medium having a computer program stored thereon for causing a suitably programmed system to ensure secure message transfer using a connectionless communication protocol between a requesting application entity and a serving application entity, by performing the following steps when such program is executed on the system:

• receiving a message from the requesting application intended for the serving application;
• monitoring the message from the requesting application for conformance to a selected communication protocol;
• relaying the message from the requesting application to the serving application based on a server address imbedded in the message and responsive to the conformance of the message to the selected communication protocol while making the message appear as if it originated from the system;
• and
• relaying a reply message from the serving application to the requesting application having the address of the serving entity imbedded in the message as an address of origin.

A network communication controller, comprising:

• a processor;
• a memory coupled to the processor;
• a communications device operatively coupled to the processor and to the memory wherein the communications device provides multiple ports that receive messages;
• and
• a firewall module operatively coupled to the processor that implements with the processor a communications protocol that controls connectionless message transfer between a requestor and a server via the communications device ports, wherein the firewall module further comprises:
• a port manager that receives messages from a requestor addressed to a server;
• a security monitor, operatively coupled to the port manager that monitors messages received from the requestor for conformance to supported protocol standards and adherence to a defined security policy;
• and
• a relay, operatively coupled to the security monitor, that relays messages from the requestor to the server based on a server address incorporated in each message and responsive to the security monitor while using an address of the communication controller and relays messages from the server which are addressed to the communication controller to the requesting entity imbedding the address of the server entity in such messages.