Firewall control with multiple profiles
View Patent ↗A networked computer with a software firewall that may be configured for any of a number of network contexts may be quickly configured with an appropriate set of rules for a current network context. The computer has multiple profiles, each containing rules applicable to a different network context. When a change in network context is detected, a difference between the profile for the current context and the profile with which the firewall was previously configured is determined. These differences are applied to quickly reconfigure the firewall without blocking, even temporarily, communications that are allowed in the previously configured and current profiles. Additionally, when the networked computer is connected to multiple networks simultaneously, an appropriate profile may be selected.
1. A method of operating a computing device connectable to a plurality of networks, the method comprising:
in response to an indication that a network configuration of the computing device has changed:
determining if the computing device has two or more active network connections;
selecting a set of firewall rules of a plurality of sets of firewall rules,
each set of the plurality of sets of firewall rules defined for use when the computing device is connected to a network having a type,
when the computing device has two or more active network connections, the selected set of firewall rules is a set of firewall rules defined for use when the computing device is connected to a least secure of the two or more active network connections; and
configuring a firewall with the selected set of firewall rules, the configuring the firewall comprising:
determining the firewall is already configured with one or more rules from a previously applied profile;
computing a delta between the selected set of firewall rules and the one or more rules from the previously applied profile, the delta excluding a rule when the rule is common to the selected set of firewall rules and the previously applied profile;
applying the computed delta to the firewall configuration for all connected networks regardless of the type of the connected network, the applying the computed delta comprising at least one of (a) deletion of a rule or (b) addition of a rule.
2. The method of claim 1 , wherein the selecting the set of firewall rules comprises automatically selecting the set of firewall rules.
3. The method of claim 2 , wherein automatically selecting a set of firewall rules comprises changing the firewall rules applicable to an application without executing the application with administrative privileges.
4. The method of claim 1 , further comprising:
obtaining a first list of current networks;
obtaining a second list of current networks, the obtaining the second list occurring after the obtaining the first list; and
identifying at least one connection change based on the first list of current network and the second list of current networks,
the indication that the network configuration of the computing device has changed based on the identified at least one connection change.
5. The method of claim 2 , further comprising:
determining if the indication that the network configuration has changed corresponds to a breakdown of a last active network connection for the computing device; and
when the indication that the network configuration has changed corresponds to the breakdown of the last active network connection for the computing device:
the selected set of firewall rules is a set of firewall rules having a type defined for use when the computing device is connected to a least secure network type.
6. The method of claim 2 , further comprising:
determining if there are zero active network connections having a recognized type; and
when there are zero active network connections having a recognized type:
the selected set of firewall rules is a set of firewall rules defined for use when the computing device is connected to an unknown network type.
7. One or more computer-readable storage medium, the one or more computer-readable storage medium not consisting of signals, the one or more computer-readable storage medium storing at least one program module, the at least one program module configured to, when executed, cause at least one processor to implement acts, the acts comprising:
in response to an indication that a network configuration of a computing device has changed:
determining if the computing device has two or more active network connections;
selecting a set of firewall rules of a plurality of sets of firewall rules,
each set of the plurality of sets of firewall rules defined for use when the computing device is connected to a network having a type,
when the computing device has two or more active network connections, the selected set of firewall rules is a set of firewall rules defined for use when the computing device is connected to a least secure of the two or more active network connections; and
configuring a firewall with the selected set of firewall rules, the configuring the firewall comprising:
determining the firewall is already configured with one or more rules from a previously applied profile;
identifying a delta between the selected set of firewall rules and the one or more rules from the previously applied profile, the delta excluding a rule when the rule is common to the selected set of firewall rules and the previously applied profile;
applying the computed delta to the firewall configuration for all connected networks regardless of the type of the connected network, the applying the computed delta comprising at least one of (a) deletion of a rule or (b) addition of a rule.
8. The one or more computer-readable storage medium of claim 7 , wherein the selecting the set of firewall rules comprises automatically selecting the set of firewall rules.
9. The one or more computer-readable storage medium of claim 8 , wherein automatically selecting a set of firewall rules comprises changing the firewall rules applicable to an application without executing the application with administrative privileges.
10. The one or more computer-readable storage medium of claim 7 , the acts further comprising:
obtaining a first list of current networks;
obtaining a second list of current networks, the obtaining the second list occurring after the obtaining the first list; and
identifying at least one connection change based on the first list of current network and the second list of current networks,
the indication that the network configuration of the computing device has changed based on the identified at least one connection change.
11. The one or more computer-readable storage medium of claim 7 , the acts further comprising:
determining if the indication that the network configuration has changed corresponds to a breakdown of a last active network connection for the computing device; and
when the indication that the network configuration has changed corresponds to the breakdown of the last active network connection for the computing device:
the selected set of firewall rules is a set of firewall rules having a type defined for use when the computing device is connected to a least secure network type.
12. The one or more computer-readable storage medium of claim 7 , the acts further comprising:
determining if there are zero active network connections having a recognized type; and
when there are zero active network connections having a recognized type:
the selected set of firewall rules is a set of firewall rules defined for use when the computing device is connected to an unknown network type.
13. A system comprising a computing device connectable to a plurality of networks, the computing device comprising:
at least one processor; and
at least one computer-readable storage medium communicatively coupled to the at least one processor, the at least one computer-readable storage medium comprising one or more programs that, when executed on the computing device, cause the computing device to perform steps, the steps comprising:
in response to an indication that a network configuration of the computing device has changed:
determining if the computing device has two or more active network connections;
selecting a set of firewall rules of a plurality of sets of firewall rules,
each set of the plurality of sets of firewall rules defined for use when the computing device is connected to a network having a type,
when the computing device has two or more active network connections, the selected set of firewall rules is a set of firewall rules defined for use when the computing device is connected to a least secure of the two or more active network connections; and
configuring a firewall with the selected set of firewall rules, the configuring the firewall comprising:
determining the firewall is already configured with one or more rules from a previously applied profile;
determining a delta between the selected set of firewall rules and the one or more rules from the previously applied profile, the delta excluding a rule when the rule is common to the selected set of firewall rules and the previously applied profile;
applying the computed delta to the firewall configuration for all connected networks regardless of the type of the connected network, the applying the computed delta comprising at least one of (a) deletion of a rule or (b) addition of a rule.
14. The system of claim 13 , wherein the selecting the set of firewall rules comprises automatically selecting the set of firewall rules.
15. The system of claim 14 , wherein automatically selecting a set of firewall rules comprises changing the firewall rules applicable to an application without executing the application with administrative privileges.
16. The system of claim 13 , the steps further comprising: obtaining a first list of current networks;
obtaining a second list of current networks, the obtaining the second list occurring after the obtaining the first list; and
identifying at least one connection change based on the first list of current network and the second list of current networks,
the indication that the network configuration of the computing device has changed based on the identified at least one connection change.
17. The system of claim 13 , the steps further comprising:
determining if the indication that the network configuration has changed corresponds to a breakdown of a last active network connection for the computing device; and
when the indication that the network configuration has changed corresponds to the breakdown of the last active network connection for the computing device:
the selected set of firewall rules is a set of firewall rules having a type defined for use when the computing device is connected to a least secure network type.
18. The system of claim 13 , the steps further comprising:
determining if there are zero active network connections having a recognized type; and
when there are zero active network connections having a recognized type:
the selected set of firewall rules is a set of firewall rules defined for use when the computing device is connected to an unknown network type.