Named sockets in a firewall
View Patent ↗A proxy device such as a firewall uses an internal socket namespace such as a text string such that connection requests must be explicitly redirected to a listening socket in the alternate namespace in order to connect to a service. Because external connections cannot directly address the listening socket or service, greater security is provided than with traditional firewall or proxy devices. To receive a redirected proxy connection, a service process creates a listening socket and binds a name in an alternate namespace to the socket before listening for connections.
1. A computer network proxy device, comprising:
a firewall comprising
a hardware processor; and
a mapping module operable to map one or more incoming connections on a set of first ports or sockets in a first namespace to a listening socket within the firewall identified in an alternate socket namespace,
wherein the computer network proxy device is operable to connect the incoming connections to one or more servers providing one or more services, and
wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service processes operating in the firewall, such that the two or more service processes each have a socket associated with the listening socket's name in the alternate namespace and provide the service associated with the listening socket's name.
2. The computer network proxy device of claim 1 , wherein names in the alternate socket namespace are associated with one or more types of services associated with the one or more incoming connections.
3. The computer network proxy device of claim 1 , wherein the mapping module prevents incoming connections from directly addressing a given service.
4. The computer network proxy device of claim 1 , wherein the alternate socket namespace comprises user-readable text strings.
5. The computer network proxy device of claim 1 , wherein the mapping module is further operable to forward an incoming connection of the one or more incoming connections to a server providing a service via a socket that a service process operating in the firewall creates by binding a name in the alternate namespace to the socket before listening for connections, the server selected from the one or more servers and the service selected from the one or more services.
6. The computer network proxy device of claim 1 , wherein the device is further operable to load balance connections provided through the named listening socket across the two or more service processes operating in the firewall associated with the named listening socket.
7. A method of operating a computer network proxy device, comprising:
mapping in a firewall by a hardware processor an incoming connection on a first port or socket in a first namespace to a listening socket within the firewall identified in an alternate socket namespace; and
connecting the incoming connection to a server providing a service,
wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service processes, such that the two or more service processes each have a socket associated with the listening socket's name in the alternate namespace and provide the service associated with the listening socket's name.
8. The method of operating a computer network proxy device of claim 7 , wherein names in the alternate socket namespace are associated with one or more types of services associated with the incoming connection.
9. The method of operating a computer network proxy device of claim 7 , further comprising preventing the incoming connection from directly addressing the server providing the service.
10. The method of operating a computer network proxy device of claim 7 , wherein the alternate socket namespace comprises user-readable text strings.
11. The method of operating a computer network proxy device of claim 7 , further comprising forwarding the incoming connection to the server providing the service via a socket that a service process creates by binding a name in the alternate namespace to the socket before listening for connections.
12. The method of operating a computer network proxy device of claim 7 , further comprising load balancing connections provided through the named listening socket across the two or more service processes associated with the named listening socket.
13. A non-transitory computer readable medium comprising instructions stored thereon to cause one or more processors of a computing device to:
configure a mapping module operable to map one or more incoming connections on a set of one or more first ports or sockets in a first namespace to a listening socket identified in an alternate socket namespace, wherein the one or more processors are further configured to connect the one or more incoming connections to one or more servers providing one or more services,
wherein the listening socket identified in the alternate namespace comprises a named listening socket associated with two or more service processes, such that the two or more service processes each have a socket associated with the listening socket's name in the alternate namespace and provide the service associated with the listening socket's name.
14. The computer readable medium of claim 13 , wherein names in the alternate socket namespace are associated with one or more types of services associated with the one or more incoming connections.
15. The computer readable medium of claim 13 , wherein the mapping module prevents at least one of the one or more incoming connections from directly addressing a given service.
16. The computer readable medium of claim 13 , wherein the alternate socket namespace comprises user-readable text strings.
17. The computer readable medium of claim 13 , wherein the mapping module is further operable to forward one of the one or more incoming connections to the server providing the service via a socket that a service process creates by binding a name in the alternate namespace to the socket before listening for connections.
18. The computer readable medium of claim 13 , wherein the instructions to cause the one or more processors to configure a mapping module further comprise instructions to cause the one or more processors to load balance connections provided through the named listening socket across the two or more service processes associated with the named listening socket.