Named sockets in a firewall
View Patent ↗A proxy device such as a firewall uses an internal socket namespace such as a text string such that connection requests must be explicitly redirected to a listening socket in the alternate namespace in order to connect to a service. Because external connections cannot directly address the listening socket or service, greater security is provided than with traditional firewall or proxy devices. To receive a redirected proxy connection, a service process creates a listening socket and binds a name in an alternate namespace to the socket before listening for connections.
1. A computer network proxy device, comprising:
a computerized firewall comprising a processor and a mapping module operable to map an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace by redirecting the incoming connection to the socket listening in the alternate namespace and from the socket listening in the alternate namespace to a first service external to the firewall to connect to the first service external to the firewall,
wherein redirecting comprises forwarding an incoming connection to a second service via a socket the process of the second service creates by binding a name in an alternate namespace to the socket before listening for connections,
wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service providers, such that the two or more service providers each have a socket associated with a name of the named listening socket in the alternate namespace and provide a service associated with the name of the named listening socket, and
wherein connections provided through the named listening socket are load balanced across the two or more service providers associated with the named listening socket.
2. The computer network proxy device of claim 1 , wherein names in the alternate socket namespace are associated with one or more types of services associated with the incoming connections.
3. The computer network proxy device of claim 1 , wherein the mapping module prevents incoming connections from directly addressing a service or socket via port or socket number.
4. The computer network proxy device of claim 1 , wherein the alternate socket namespace comprises user-readable text strings.
5. A method of operating a computer network proxy device, comprising:
mapping in a firewall an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace by redirecting the incoming connection to the socket listening in the alternate namespace and from the socket listening in the alternate namespace to a first service external to the firewall to connect to the first service external to the firewall,
wherein redirecting comprises forwarding an incoming connection to a second service via a socket the process of the second service creates by binding a name in an alternate namespace to the socket before listening for connections,
wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service providers, such that the two or more service providers each have a socket associated with a name of the named listening socket in the alternate namespace and provide a service associated with the name of the named listening socket, and
wherein connections provided through the named listening socket are load balanced across the two or more service providers associated with the named listening socket.
6. The method of operating a computer network proxy device of claim 5 , wherein names in the alternate socket namespace are associated with one or more types of services associated with the incoming connections.
7. The method of operating a computer network proxy device of claim 5 , further comprising preventing incoming connections from directly addressing a service or socket via port or socket number.
8. The method of operating a computer network proxy device of claim 5 , wherein the alternate socket namespace comprises user-readable text strings.
9. A machine-readable non-transitory medium with instructions stored thereon, the instructions when executed operable to cause a computerized firewall device to:
map in a firewall an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace by redirecting the incoming connection to the socket listening in the alternate namespace and from the socket listening in the alternate namespace to a first service external to the firewall to connect to the first service external to the firewall,
wherein redirecting comprises forwarding an incoming connection to a second service via a socket the process of the second service creates by binding a name in an alternate namespace to the socket before listening for connections,
wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service providers, such that the two or more service providers each have a socket associated with a name of the named listening socket in the alternate namespace and provide a service associated with the name of the named listening socket, and
wherein connections provided through the named listening socket are load balanced across the two or more service providers associated with the named listening socket.
10. The machine-readable non-transitory medium of claim 9 , wherein the instructions when executed are further operable to prevent incoming connections from directly addressing a service or socket via port or socket number.
11. The machine-readable non-transitory medium of claim 9 , wherein names in the alternate socket namespace are associated with one or more types of services associated with the incoming connections.
12. The machine-readable non-transitory medium of claim 9 , wherein the alternate socket namespace comprises user-readable text strings.