Named sockets in a firewall
AssigneeMcAfee, Inc.
InventorsMichael W. Green, David Diehl, Michael J. Karels
Life of this patent
Estimating the term…
Abstract
A proxy device such as a firewall uses an internal socket namespace such as a text string such that connection requests must be explicitly redirected to a listening socket in the alternate namespace in order to connect to a service. Because external connections cannot directly address the listening socket or service, greater security is provided than with traditional firewall or proxy devices. To receive a redirected proxy connection, a service process creates a listening socket and binds a name in an alternate namespace to the socket before listening for connections.
Claims12
A computer network proxy device, comprising:
- a computerized firewall comprising a processor and a mapping module operable to map an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace by redirecting the incoming connection to the socket listening in the alternate namespace and from the socket listening in the alternate namespace to a first service external to the firewall to connect to the first service external to the firewall,
- wherein redirecting comprises forwarding an incoming connection to a second service via a socket the process of the second service creates by binding a name in an alternate namespace to the socket before listening for connections,
- wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service providers, such that the two or more service providers each have a socket associated with a name of the named listening socket in the alternate namespace and provide a service associated with the name of the named listening socket, and
- wherein connections provided through the named listening socket are load balanced across the two or more service providers associated with the named listening socket.
A method of operating a computer network proxy device, comprising:
- mapping in a firewall an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace by redirecting the incoming connection to the socket listening in the alternate namespace and from the socket listening in the alternate namespace to a first service external to the firewall to connect to the first service external to the firewall,
- wherein redirecting comprises forwarding an incoming connection to a second service via a socket the process of the second service creates by binding a name in an alternate namespace to the socket before listening for connections,
- wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service providers, such that the two or more service providers each have a socket associated with a name of the named listening socket in the alternate namespace and provide a service associated with the name of the named listening socket, and
- wherein connections provided through the named listening socket are load balanced across the two or more service providers associated with the named listening socket.
A machine-readable non-transitory medium with instructions stored thereon, the instructions when executed operable to cause a computerized firewall device to:
- map in a firewall an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace by redirecting the incoming connection to the socket listening in the alternate namespace and from the socket listening in the alternate namespace to a first service external to the firewall to connect to the first service external to the firewall,
- wherein redirecting comprises forwarding an incoming connection to a second service via a socket the process of the second service creates by binding a name in an alternate namespace to the socket before listening for connections,
- wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service providers, such that the two or more service providers each have a socket associated with a name of the named listening socket in the alternate namespace and provide a service associated with the name of the named listening socket, and
- wherein connections provided through the named listening socket are load balanced across the two or more service providers associated with the named listening socket.
Dependencies are inferred from the claim text.