Secure firewall rule formulation
AssigneeInternational Business Machines Corporation
InventorsRadhika Chirra, Nikhil Hegde, Richard J. Knight, Rashmi Narasimhan
Life of this patent
Estimating the term…
Abstract
A kernel extension is configured to intercept a call to associate a socket with a port of a node in a network. The call originates from a kernel of the node. The kernel extension is configured to determine the port from the call. The kernel extension is configured to determine that the port is one of a plurality of ports for which the node has authority to modify firewall rules of a firewall of the network. The kernel extension is configured to modify firewall rules maintained by the firewall to allow communications for the port to the node through the firewall.
Claims20
A method comprising:
- intercepting a call, by a kernel extension of a kernel of a node, for a firewall to associate a socket with a port of the node in a network, wherein the call originates from the kernel of the node;
- determining the port from the call;
- determining that the port is one of a plurality of ports for which the kernel extension has authority to modify firewall rules of the firewall of the network;
- and
- responsive to said determining that the port is one of the plurality of ports for which the kernel extension has authority to modify firewall rules, modifying, by the kernel extension, firewall rules maintained by the firewall to allow communications for the port to the node through the firewall.
A computer program product for secure firewall rule formulation, the computer program product comprising:
- a non-transitory computer readable storage medium having computer usable program code embodied therewith, the computer usable program code comprising a kernel extension code configured to:
- intercept a call to associate a socket with a port of a node in a network, wherein the call originates from a kernel of the node;
- determine the port from the call;
- determine whether the port is one of a plurality of open ports monitored by an instance of the kernel extension code;
- allow the kernel to associate the socket with the port if the port is one of the plurality of open ports;
- determine whether the port is one of a plurality of ports for which the kernel extension code has authority to modify firewall rules of a firewall of the network if the port is not one of the plurality of open ports;
- and
- modify the firewall rules maintained by the firewall to allow communications for the port to the node through the firewall if the port is one of the plurality of ports for which the kernel extension has authority to modify firewall rules.
An apparatus comprising:
- a processor;
- a network interface coupled with the processor;
- and
- a computer readable storage medium having computer usable program code embodied therewith, the computer usable program code comprising a kernel extension code configured to:
- intercept a call to associate a socket with a port of a node in a network, wherein the call originates from a kernel of the node;
- determine the port from the call;
- determine whether the port is one of a plurality of open ports monitored by an instance of the kernel extension code;
- allow the kernel to associate the socket with the port if the port is one of the plurality of open ports;
- determine whether the port is one of a plurality of ports for which the kernel extension code has authority to modify firewall rules of a firewall of the network if the port is not one of the plurality of open ports;
- and
- modify the firewall rules maintained by the firewall to allow communications for the port to the node through the firewall if the port is one of the plurality of ports for which the kernel extension has authority to modify firewall rules.
Dependencies are inferred from the claim text.