Firewall device

A firewall apparatus comprising:

• a distribution management table for managing a user name, a user ID, a virtual firewall and a filtering ID associating them with each other;
• a filtering table, being specified by the virtual firewall ID and the filtering ID, including a dependent filtering policy;
• a part configured to receive authentication information, issued by a user terminal when starting a network connection, so as to hold the user name;
• a part configured to report the authentication information to an authentication server;
• a part configured to receive an authentication response from the authentication server so as to hold a user ID, included in the authentication response, to be provided to the user terminal, wherein,
• the firewall apparatus registers the user ID in the distribution management table associating the user ID with the user name,
• after a connection between the user terminal and a network is established, the firewall apparatus searches the distribution management table by using a source user ID of a packet sent from the user terminal as a search key, and retrieves the virtual firewall ID and the filtering ID associated with the source user ID so as to distribute the packet sent from the user terminal to a virtual firewall corresponding to the virtual firewall ID and provide the filtering ID to the packet sent from the user terminal,
• the firewall apparatus searches the distribution management table by using a destination user ID of a packet sent from a communication partner terminal of the user terminal as the search key, and retrieves the virtual firewall ID and the filtering ID associated with the destination user ID so as to distribute the packet sent from the communication partner terminal of the user terminal to a virtual firewall corresponding to the virtual firewall ID and provide the filtering ID to the packet sent from the communication partner terminal of the user terminal, and
• the firewall apparatus passes or discards a packet to which the filtering ID is provided according to a filtering policy included in the filtering table specified by the filtering ID in the virtual firewall specified by the virtual firewall ID.

A firewall apparatus comprising:

• a distribution management table for managing a user name, a user ID, a virtual firewall ID, and an individual filtering ID, and a common filtering ID associating them with each other;
• an individual filtering table associated with the individual filtering ID;
• a common filtering table associated with the common filtering ID;
• a part configured to receive authentication information, issued by a user terminal when starting a network connection, so as to hold the user name;
• a part configured to report the authentication information to an authentication server;
• a part configured to receive an authentication response from the authentication server so as to hold a user ID, included in the authentication response, to be provided to the user terminal, wherein,
• the firewall apparatus registers the user ID in the distribution management table associating the user ID with the user name,
• after a connection between the user terminal and a network is established, the firewall apparatus searches the distribution management table by using a source user ID of a packet sent from the user terminal as a search key, and retrieves the virtual firewall ID, the individual filtering ID and the common filtering ID associated with the source user ID so as to distribute the packet sent from the user terminal to a virtual firewall corresponding to the virtual firewall ID and provide the individual filtering ID and the common filtering ID to the packet sent from the user terminal,
• the firewall apparatus searches the distribution management table by using a destination user ID of a packet sent from a communication partner terminal of the user terminal as the search key, and retrieves the virtual firewall ID, the individual filtering ID and the common filtering ID associated with the destination user ID so as to distribute the packet sent from the communication partner terminal of the user terminal to a virtual firewall corresponding to the virtual firewall ID and provide the individual filtering ID and the common filtering ID to the packet sent from the communication partner terminal of the user terminal, and
• the firewall apparatus passes or discards a packet to which the individual filtering ID and the common filtering ID are provided according to a filtering policy included in the individual filtering table specified by the individual filtering ID and according to a filtering policy included in the common filtering table specified by the common filtering ID.

A firewall apparatus, comprising:

• a distribution management table for associating a user name, a user ID, a virtual firewall ID, and a filtering ID with each other;
• plural virtual firewalls, each being specified by the filtering ID, each including at least a filtering table being specified by the filtering ID;
• a part configured to receive authentication information, issued by a user terminal when starting a network connection, so as to hold the user name;
• a part configured to report the authentication information to an authentication server;
• a part configured to receive an authentication response from the authentication server so as to hold the user ID, included in the authentication response, to be provided to the user terminal, wherein,
• the firewall apparatus registers the user ID in the distribution management table by associating the user ID with the user name,
• after a connection between the user terminal and a network is established, the firewall apparatus searches the distribution management table by using a source user ID of a packet sent from the user terminal as a search key, and retrieves the virtual firewall ID and the filtering ID associated with the source user ID so as to distribute the packet sent from the user terminal to a virtual firewall specified by the virtual firewall ID and to provide the filtering ID to the packet sent from the user terminal,
• the firewall apparatus searches the distribution management table by using a destination user ID of a packet sent from a communication partner terminal of the user terminal as the search key, and retrieves the virtual firewall ID and the filtering ID associated with the destination user ID so as to distribute the packet sent from the communication partner terminal of the user terminal to the virtual firewall specified by the virtual firewall ID and to provide the filtering ID to the packet sent from the communication partner terminal of the user terminal, and
• the firewall apparatus passes or discards a packet to which the filtering ID is provided according to a filtering policy included in the filtering table specified by the filtering ID.

A firewall apparatus, comprising:

• a distribution management table for associating a user name, a user ID, a virtual firewall ID, an individual filtering ID, and a common filtering ID with each other;
• a virtual firewall including an individual filtering table corresponding to the individual filtering ID and a common filtering table corresponding to the common filtering ID;
• a part configured to receive authentication information, issued by a user terminal when starting a network connection, so as to hold the user name;
• a part configured to report the authentication information to an authentication server;
• and
• a part configured to receive an authentication response from the authentication server so as to hold the user ID, included in the authentication response, to be provided to the user terminal, wherein,
• the firewall apparatus registers the user ID in the distribution management table by associating the user ID with the user name,
• after a connection between the user terminal and a network is established, the firewall apparatus searches the distribution management table by using a source user ID of a packet sent from the user terminal as a search key, and retrieves the virtual firewall ID, the individual filtering ID and the common filtering ID associated with the source user ID so as to distribute the packet sent from the user terminal to the virtual firewall specified by the virtual firewall ID and to provide the individual filtering ID and the common filtering ID to the packet sent from the user terminal,
• the firewall apparatus searches the distribution management table by using a destination user ID of a packet sent from a communication partner terminal of the user terminal as the search key, and retrieves the virtual firewall ID, and the individual filtering ID, and the common filtering ID associated with the destination user ID so as to distribute the packet sent from the communication partner terminal of the user terminal to the virtual firewall specified by the virtual firewall ID and to provide the individual filtering ID and the common filtering ID to the packet sent from the communication partner terminal of the user terminal, and
• the firewall apparatus passes or discards, in the virtual firewall, a packet to which the individual filtering ID and the common filtering ID are provided according to a filtering policy included in the individual filtering table specified by the individual filtering ID and according to a filtering policy included in the common filtering table specified by the common filtering ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• an individual filtering table holding security policies for each user;
• a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a virtual firewall ID, a common filtering table ID, and an individual filtering table ID;
• a communication part configured to communicate with an authentication server determining whether the user terminal is connectable;
• a communication part configured to communicate with an identifier management server managing the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with a user;
• a communication part configured to communicate with a security policy management server managing correspondence between a user-specific security policy to be written into the individual filtering table and the user, wherein,
• the firewall apparatus receives a connection request with authentication information including a user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds user terminal information accompanied by an authentication response received from the authentication server, reports the user name to the identifier management server and to the security policy management server, writes the virtual firewall ID, the common filtering table ID, the individual filtering table ID and the user terminal information received from the identifier management server into the distribution management table, associated with each other, and writes policy information received from the security policy management server and the individual filtering table ID into the individual filtering table,
• after a connection between the user terminal that issues the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information, included in the packet, as a search key so as to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to a virtual firewall indicated by the virtual firewall ID and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• at least a virtual firewall performing packet filtering for plural users;
• at least an individual filtering table holding security policies for each user;
• at least a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a virtual firewall ID, a common filtering table ID, and an individual filtering table ID;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable;
• a communication part configured to communicate with an identifier management server managing the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with a user;
• a communication part configured to communicate with a security policy management server managing correspondence between a user-specific security policy to be written into the individual filtering tablet and the user, wherein,
• the firewall apparatus receives a connection request with authentication information including a user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, reports the user name to the identifier management server and to the security policy management server, writes the virtual firewall ID, the common filtering table ID, the individual filtering table ID and the user terminal information received from the identifier management server into the distribution management table, associated with each other, and writes policy information received from the security policy management server and the individual filtering table ID into the individual filtering table of the virtual firewall indicated by the virtual firewall ID,
• after a connection between the user terminal that issued the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information, included in the packet, as a search key so as to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to the virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• an individual filtering table holding security policies for each user;
• a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a common filtering table ID, and an individual filtering table ID;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable;
• a communication part configured to communicate with an identifier management server managing the common filtering table ID and the individual filtering table ID associated with a user, wherein,
• the firewall apparatus receives a connection request with authentication information including a user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, reports the user name to the identifier management server, writes the common filtering table ID, the individual filtering table ID and the user terminal information received from the identifier management server into the distribution management table, associated with each other, and searches a security policy table using the user name as a key to retrieve policy information associated with the user name, and writes the policy information and the individual filtering table ID into the individual filtering table,
• after a connection between the user terminal that issued the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information included in the packet as a search key so as to retrieve a virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to a virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• an individual filtering table holding security policies for each user;
• a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a common filtering table ID, and an individual filtering table ID;
• an identifier management table in which a user name, a common filtering table ID and an individual filtering table ID are associated with each other;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable;
• a communication part configured to communicate with a security policy management server managing correspondence between the security policy specific to a user to be written into the individual filtering table, and the user, wherein,
• the firewall apparatus receives a connection request with authentication information including a user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, reports the user name to the security policy management server, searches the identifier management table using the user name as a key to retrieve the common filtering table ID and the individual filtering table ID associated with the user name, and writes the common filtering table ID, the individual filtering table ID and the user terminal information into the distribution management associating table, associated with each other, and writes policy information received from the security policy management server and the individual filtering table ID into the individual filtering table,
• after a connection between the user terminal that issued the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information, included in the packet, as a search key so as to retrieve a virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to a virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• an individual filtering table holding security policies for each user;
• a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a common filtering table ID, and an individual filtering table ID;
• a security policy table in which a user name is associated with at least a security policy;
• an identifier management table in which the user name, the common filtering table ID and the individual filtering table ID are associated with each other;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable, wherein,
• the firewall apparatus receives a connection request with authentication information including the user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, searches the identifier management table using the user name as a key to retrieve the common filtering table ID and the individual filtering table ID associated with the user name, and writes the common filtering table ID, the individual filtering table ID and the user terminal information into the distribution management table, associated with each other, and searches the security policy table using the user name as a key to retrieve policy information associated with the user name, and writes the policy information and the individual filtering table ID into the individual filtering table,
• after a connection between the user terminal that issued the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information, included in the packet, as a search key so as to retrieve a virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to a virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• at least a virtual firewall performing packet filtering for plural users;
• at least an individual filtering table holding security policies for each user;
• at least a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a virtual firewall ID, a common filtering table ID, and an individual filtering table ID;
• a security policy table in which a user name is associated with at least a security policy;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable;
• and
• a communication part configured to communicate with an identifier management server managing the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with a user, wherein,
• the firewall apparatus receives a connection request with authentication information including the user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, reports the user name to the identifier management server, writes the virtual firewall ID, the common filtering table ID, the individual filtering table ID and the user terminal information received from the identifier management server into the distribution management table, associated with each other, and searches the security policy table using the user name as a key to retrieve policy information associated with the user name, and writes the policy information and the individual filtering table ID into the individual filtering table in the virtual firewall indicated by the virtual firewall ID,
• after a connection between the user terminal that issued the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information included in the packet as a search key so as to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to the virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• at least a virtual firewall performing packet filtering for plural users;
• at least an individual filtering table holding security policies for each user;
• at least a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a virtual firewall ID, a common filtering table ID, and an individual filtering table ID;
• an identifier management table in which a user name, the common filtering table ID and the individual filtering table ID are associated with each other;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable;
• and
• a communication part configured to communicate with a security policy server managing correspondence between a security policy specific to a user to be written into the individual filtering table, and the user, wherein,
• the firewall apparatus receives a connection request with authentication information including the user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, reports the user name to the security policy server, searches the identifier management table using the user name as a key to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user name, and writes the virtual firewall ID, the common filtering table ID, the individual filtering table ID and the user terminal information into the distribution management table, associated with each other, and writes policy information received from the security policy server and the individual filtering table ID into the individual filtering table in the virtual firewall indicated by the virtual firewall ID,
• after a connection between the user terminal that issued the connection request and
• the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information included in the packet as a search key so as to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to the virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.

A firewall apparatus provided between a plurality of user terminals and a network and performing filtering for the user terminals, the firewall apparatus comprising:

• at least a virtual firewall performing packet filtering for plural users;
• at least an individual filtering table holding security policies for each user;
• at least a common filtering table holding a security policy common to plural users;
• a distribution management table for managing user terminal information, a virtual firewall ID, a common filtering table ID, and an individual filtering table ID;
• a security policy table in which a user name is associated with at least a security policy;
• a communication part configured to communicate with an authentication server determining whether a user terminal is connectable, wherein,
• the firewall apparatus receives a connection request with authentication information including the user name from the user terminal when starting a network connection, holds the user name, reports the user name to the authentication server, holds the user terminal information accompanied by an authentication response received from the authentication server, searches an identifier management table using the user name as a key to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user name, and writes the virtual firewall ID, the retrieved common filtering table ID, the individual filtering table ID and the user terminal information into the distribution management table, associated with each other, and searches the security policy table using the user name as a key to retrieve policy information associated with the user name, and writes the policy information and the individual filtering table ID into the individual filtering table in the virtual firewall indicated by the virtual firewall ID,
• after a connection between the user terminal that issued the connection request and the network is established, the firewall apparatus receives a packet sent from the user terminal or sent to the user terminal,
• the firewall apparatus searches the distribution management table using the user terminal information, included in the packet, as a search key so as to retrieve the virtual firewall ID, the common filtering table ID and the individual filtering table ID associated with the user terminal information, and
• the firewall apparatus distributes the packet to the virtual firewall indicated by the virtual firewall ID, and filters the packet using the common filtering table corresponding to the common filtering table ID and the individual filtering table corresponding to the individual filtering table ID.