Handling related connections in a firewall

A method of handling in a firewall data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said method comprising

• allowing a parent connection,
• storing information about the parent connection in a first entry,
• monitoring contents of the parent connection,
• detecting within the parent connection negotiation of at least one attribute of a related connection,
• storing a second entry comprising at least one negotiated attribute of the related connection and at least one piece of information about the parent connection of the first stored entry,
• comparing said second entry to a set of rules for finding a matching rule,
• deciding on the basis of said matching rule, whether the related connection is allowable,
• allowing the related connection to pass through a firewall if the related connection is allowable, and
• preventing the related connection from passing through the firewall if the related connection is not allowable,
• wherein said information about the parent connection comprises at least one of the following:
• a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and
• wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

A computer program product comprising a computer readable medium which contains computer program code which, when executed in a computer device, provides a routine of handling data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said routine comprising

• allowing a parent connection,
• storing information about the parent connection,
• monitoring contents of the parent connection,
• detecting within the parent connection negotiation of at least one attribute of a related connection, and after said detecting
• i) comparing said at least one negotiated attribute of the related connection and at least one piece of said information about the parent connection to a set of rules for finding a matching rule, and deciding on the basis of said matching rule, whether the related connection is allowable,
• ii) allowing the related connection to pass through a firewall if the related connection is allowable, and
• iii) preventing the related connection from passing through the firewall if the related connection is not allowable, and
• wherein said information about the parent connection comprises at least one of the following:
• a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

A computer program product comprising a computer readable medium which contains computer program code which, when executed in a computer device, provides a routine of handling data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one attribute of the at least one related connection is negotiated within the at least one parent connection, said routine comprising

• allowing a parent connection,
• storing information about the parent connection in a first entry,
• monitoring contents of the parent connection,
• detecting within the parent connection negotiation of at least one attribute of a related connection,
• storing a second entry comprising said at least one negotiated attribute of the related connection
• comparing said second entry to a set of rules for finding a matching rule to determine whether the related connection is allowable
• allowing the related connection to pass through a firewall, if the related connection is allowable, and
• preventing the related connection from passing through the firewall, if the related connection is not allowable,
• wherein said information about the parent connection comprises at least one of the following:
• a source address, a destination address, a source port, a destination port, a user identifier, authentication information, a stream type-identifier, a program identifier, and information identifying a separate processing module used for handling parent connection, and
• wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.

A firewall device for handling data communication protocols comprising at least one parent connection and at least one related connection, wherein at least one of the addressing details of the at least one related connection is negotiated within the at least one parent connection, said firewall device comprising

• a computing unit,
• a computer readable medium containing computer program code executed in the computing unit,
• a mechanism for allowing a parent connection,
• a memory for storing a set of rules,
• a memory for storing information about the parent connection,
• a mechanism for monitoring contents of the parent connection,
• a mechanism for detecting within the parent connection negotiation of at least one attribute of a related connection,
• a mechanism, responsive to said detecting mechanism, for comparing said at least one negotiated attribute of the related connection and at least one piece of said information about the parent connection to said set of rules for finding a matching rule, and a mechanism for deciding on the basis of said matching rule, whether the related connection is allowable,
• a mechanism, responsive to said deciding, for allowing the related connection to pass through a firewall if the related connection is allowable, and
• a mechanism, responsive to said deciding, for preventing the related connection from passing through the firewall if the related connection is not allowable, and
• wherein said information about the parent connection comprises at least one of the following:
• a source address, a destination address, a source port, a destination port, used protocol, a user identifier, authentication information, a stream type identifier, a program identifier, and information identifying a separate processing module used for handling the parent connection, and wherein a rule of said set of rules comprises at least one attribute of a related connection, information about a parent connection and an action to be taken for a related connection.