US 8,302,179 B2Granted

Embedded firewall at a telecommunications endpoint

AssigneeAvaya Inc.

InventorsAkshay Adhikari, Sachin Garg, Anjur Sundaresan Krishnakumar, Navjot Singh

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method is disclosed that enables the implementation of an embedded firewall at a telecommunications endpoint. In particular, the illustrative embodiment of the present invention addresses the relationship between the application, firewall engine, and packet-classification rules database that are all resident at the endpoint. In the variations of the illustrative embodiment that are described herein, the application: (i) directly communicates with the co-resident firewall engine such as through local message passing, (ii) shares memory with the firewall engine, and (iii) makes socket calls to the operating system that are intercepted by a middleware layer that subsequently modifies the rules database, depending on the socket call. The common thread to these techniques is that the application, firewall engine, and rules database are co-resident at the endpoint, which is advantageous in the implementation of the embedded firewall.

Claims21

Dependent claims

A method comprising:

receiving ingress packets at a telecommunications endpoint during execution by the endpoint of a firewall engine and an application, wherein the application is configured to make socket library calls to an operating system layer;
when a state change in the operational state of the application occurs during the execution of the application, notifying the firewall engine of the state change, wherein the application performs the notifying;
filtering, by the firewall engine at the endpoint, at least one of the ingress packets received, based on a first set of packet-classification rules that comprises a first rule, wherein the selection of the first set of packet-classification rules is based on the state change;
when the application, during its execution, exclusively anticipates that the ingress packets are to exhibit a predetermined characteristic, making a second rule available to the firewall engine as part of the first set of packet-classification rules, wherein the second rule is made available by the application;
when a first socket library call that is made by the application during its execution is detected, intercepting the first socket library call;
and
when the first socket library call has been intercepted, establishing a third rule that is based on the first socket library call;
wherein the third rule is part of the first set of packet-classification rules,
wherein the endpoint is capable, at least in part, of i) receiving a voice signal from a user of the endpoint, ii) digitizing the voice signal, and iii) transmitting a plurality of egress packets that comprise the digitized voice signal.

6 more elements

A method comprising:

receiving ingress packets at a telecommunications endpoint during execution by the endpoint of a firewall engine and an application, wherein the application is configured to make socket library calls to an operating system layer;
when the application, during its execution, exclusively anticipates that the ingress packets are to exhibit a predetermined characteristic, making a first rule available to the firewall engine, wherein the first rule is made available by the application;
filtering, by the firewall engine at the endpoint, at least one of the ingress packets received, based on a first set of packet-classification rules that comprises the first rule;
when the application, during its execution, exclusively anticipates that the ingress packets are to exhibit a predetermined characteristic, making a second rule available to the firewall engine as part of the first set of packet-classification rules, wherein the second rule is made available by the application;
when a first socket library call that is made by the application during its execution is detected, intercepting the first socket library call;
and
when the first socket library call has been intercepted, establishing a third rule that is based on the first socket library call;
wherein the third rule is part of the first set of packet-classification rules,
wherein the endpoint is capable, at least in part, of i) receiving a voice signal from a user of the endpoint, ii) digitizing the voice signal, and iii) transmitting a plurality of egress packets that comprise the digitized voice signal.

6 more elements

A method comprising:

receiving ingress packets at a telecommunications endpoint during execution by the endpoint of a firewall engine and an application, wherein the application is configured to make socket library calls to an operating system layer;
when a first socket library call that is made by the application during its execution is detected, intercepting the first socket library call;
when the first socket library call has been intercepted, establishing a first rule that is based on the first socket library call;
filtering, by the firewall engine at the endpoint, at least one of the ingress packets received, based on a first set of packet-classification rules that comprises the first rule;
when the application, during its execution, exclusively anticipates that the ingress packets are to exhibit a predetermined characteristic, making a second rule available to the firewall engine as part of the first set of packet-classification rules, wherein the second rule is made available by the application;
when a second socket library call that is made by the application during its execution is detected, intercepting the second socket library call;
and
when the second socket library call has been intercepted, establishing a third rule that is based on the second socket library call;
wherein the third rule is part of the first set of packet-classification rules,
wherein the endpoint is capable, at least in part, of i) receiving a voice signal from a user of the endpoint, ii) digitizing the voice signal, and iii) transmitting a plurality of egress packets that comprise the digitized voice signal.

7 more elements

Dependencies are inferred from the claim text.