Integrated VPN/firewall system
View Patent ↗Systems, devices, and methods relating to network firewalls and VPN gateways for controlling and securing access to networks. An integrated VPN/firewall system comprises at least one policy engine module, a switch module, a cryptographic engine module, and at least one flow engine module. Each flow engine module receives DTUs from either side of the integrated VPN/firewall system. The DTUs are then compared to entries in a listening table and entries in a flow table. The entries in these tables consist of characteristics of DTUs expected to arrive for specific flows. Entries to both listening tables and flow tables are made by the policy engine with listening table entries generally denoting flows potentially allowed by policy to be established between computers on opposite sides of the system. Flow tables, on the other hand, correspond to flows already allowed to be established between computers on opposite sides of the firewall system.
1. A method of verifying data transmission units (DTUs) being received by a device, the method comprising the steps of:
a) receiving an incoming DTU;
b) determining if said incoming DTU has characteristics which match an entry in at least one flow table containing characteristics of DTUs associated with established network connections;
c) in the event said characteristics of said incoming DTU match said entry in said at least one flow table, forwarding said incoming DTU to a flow engine module of the device for forwarding to a destination of said incoming DTU without passing through a policy engine module of said device and without any further security policy processing;
d) in the event said characteristics of said incoming DTU does not match an entry in said at least one flow table, determining if said incoming DTU has characteristics which match an entry in at least one listening table containing characteristics of DTUs associated with network connections to be established;
e) in the event said characteristics of said incoming DTU match an entry in said at least one listening table, forwarding said incoming DTU to a policy engine module to establish a network connection;
f) in the event said characteristics of said incoming DTU does not match an entry in said at least one listening table, forwarding said incoming DTU to a policy engine module for checking against predetermined security policies;
g) in the event said incoming DTU passes said checking by said policy engine module against predetermined security policies, at least one flow table or at least one listening table is updated to list characteristics of DTUs associated with a network connection for said incoming DTU,
wherein said method is executed by a system comprising:
the policy engine module for enforcing security policies for said network and for inserting and deleting entries in at least one flow table and in at least one listening table;
at least one flow engine module for receiving data transmission units (DTUs) from sources external to said system and for forwarding said DTUs to destinations external to said system; and
a switch module for routing DTUs between different modules in said system wherein
said switch module is coupled to each one of the other modules in the system;
said flow engine module receives and forwards DTUs if said DTUs match an entry in either said flow table or said listening table.
2. A method according to claim 1 wherein said policy engine module provides a checking function on said incoming DTU, said checking function being at least one of content filtering, virus scanning, validation of new data flows, authentication of DTUs, authorization of DTUs, or Internet Key Exchange.
3. A method according to claim 1 wherein in step c), said incoming DTU passes through a cryptographic engine module for encrypting at least a portion of said incoming DTU.
4. A method according to claim 1 wherein in step c), said incoming DTU passes through a cryptographic engine module for decrypting at least a portion of said incoming DTU.
5. A method according to claim 1 wherein said incoming DTU contains an encrypted key for establishing a virtual private networking connection.
6. A method according to claim 1 wherein at least one of said characteristics is selected from a group consisting of:
a network interface;
a destination address;
a destination port;
a source address;
a source port;
a protocol identifier; and
a Security Parameter Index.
7. A method according to claim 1 wherein at least one of said established network connections is an existing virtual private networking (VPN) connection.
8. A method according to claim 4 further including forwarding a decrypted DTU to a destination external to the device, said destination being part of a virtual private network.
9. A method according to claim 1 wherein at least one of said established network connections is a TCP (transmission control protocol) connection.
10. A method according to claim 1 wherein said network connection to be established is a TCP connection.
11. A method according to claim 1 wherein at least one of said established connections is a UDP (User Datagram Protocol) connection.
12. A method according to claim 1 wherein said network connection to be established is a UDP connection.
13. A method according to claim 1 wherein said system further includes a cryptographic engine module for encrypting and decrypting DTUs.
14. A system for providing firewall and virtual private networking functions to a network, the system comprising:
a processor;
at least one flow table having entries which contain characteristics of DTUs associated with established network connections;
at least one listening table having entries which contain characteristics of DTUs associated with network connections to be established;
a policy engine module for enforcing security policies for said network and for inserting entries in said at least one flow table and in said at least one listening table;
at least one flow engine module for receiving data transmission units (DTUs) from sources external to said system and for forwarding said DTUs to destinations external to said system;
a switch module for routing DTUs between different modules in said system wherein
said switch module is coupled to each one of the other modules in the system;
said flow engine module receives and forwards DTUs to destinations external to said system if said DTUs match an entry in said flow table, said DTUs being forwarded not passing through said policy engine module and without any further security policy processing,
wherein said system with use of said processor executes a process for verifying DTUs being received by the system, the process comprising the steps of:
a) receiving an incoming DTU at the flow engine module;
b) determining if said incoming DTU has characteristics which match at least one set of criteria;
c) in the event said characteristics of said incoming DTU match said at least one set of criteria, forwarding said incoming DTU to a separate component of the device for further processing;
d) in the event said characteristics of said incoming DTU does not match said at least one set of criteria, forwarding said incoming DTU to a policy engine module for further checking,
e) in the event said incoming DTU passes said checking by said policy engine module against predetermined security policies, at least one flow table or at least one listening table is updated to list characteristics of DTUs associated with a network connection for said incoming DTU.
15. A system according to claim 14 wherein said separate component is the policy engine module for checking said incoming DTUs against at least one network access security policy.
16. A system according to claim 14 wherein said separate component is one of said at least one flow engine module for forwarding said incoming DTU to a location external to said device.
17. A system according to claim 14 wherein said separate component is a cryptographic engine module for encrypting at least a portion of said incoming DTU.
18. A system according to claim 14 wherein said separate component is a cryptographic engine module for decrypting at least a portion of said incoming DTU.
19. A system according to claim 14 wherein said system further comprises a cryptographic engine module for encrypting and decrypting DTUs.
20. A system according to claim 14 wherein at least one of said characteristics is selected from a group consisting of:
a network interface;
a destination address;
a destination port;
a source address;
a source port;
a protocol identifier; and
a Security Parameter Index.
21. A system according to claim 14 wherein said system is implemented on at least one integrated circuit (IC).
22. A system according to claim 14 wherein said system is implemented on a single IC.
23. A system according to claim 14 wherein said policy engine module provides a checking function on said incoming DTU, said checking function being at least one of content filtering, virus scanning, validation of new data flows, authentication of DTUs, authorization of DTUs, or Internet Key Exchange.
24. A device for interconnecting at least two networks, the device comprising:
a processor;
at least one policy engine module for enforcing security policies of a first network against data traffic coming from and going to at least one second network, said at least one policy engine module inserts and deletes entries in at least one flow table and at least one listening table and provides checking functions for incoming data transmission units (DTUs), said checking function being at least one of content filtering, virus scanning, validation of new data flows, authentication of DTUs, authorization of DTUs, or Internet Key Exchange;
at least one flow engine module for receiving and transmitting said data traffic between said first network and said at least one second network; and
a switch module for forwarding relevant data traffic between modules internal to said device;
wherein said switch module is coupled to each one of the other modules in the device and the or each of said flow engine modules receives and forwards said data traffic if said data traffic matches entries in said at least one flow table or in said at least one listening table,
and wherein each flow table has entries with characteristics of DTUs associated with established network connections and each listening table has entries with characteristics wherein DTUs which match an entry in a flow table is forwarded to their destination without passing through a policy engine module, and without any further security policy processing,
wherein said device with use of said processor executes a process for verifying DTUs being received by the device, the process comprising the steps of:
a) receiving an incoming DTU at the at least one flow engine module;
b) determining if said incoming DTU has characteristics which match at least one set of criteria;
c) in the event said characteristics of said incoming DTU match said at least one set of criteria, forwarding said incoming DTU to a separate component of the device for further processing;
d) in the event said characteristics of said incoming DTU does not match said at least one set of criteria, forwarding said incoming DTU to the at least one policy engine module for further checking;
e) in the event said incoming DTU passes said checking by said at least one policy engine module against predetermined security policies, at least one flow table or at least one listening table is updated to list characteristics of DTUs associated with a network connection for said incoming DTU.
25. A device according to claim 24 further comprising a cryptographic engine module for encrypting and decrypting at least a portion of said data traffic.