Security appliance
A security appliance may incorporate a touch screen or similar input/output interface, providing command and control over network functionality and configuration, without requiring log in via a network from another computing device. During denial of service attacks, commands from the local interface may be given priority access to processing resources and memory, allowing mitigating actions to be taken, such as shutting down ports, blacklisting packet sources, or modifying filter rules. This may allow the security device to address attacks without having to be manually rebooted or disconnected from the network.
1. An appliance, comprising:
a housing;
a network security device deployed within the housing, coupled to a first network and a second network; and
an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device;
wherein the network security device is configured to, responsive to receipt of a network packet matching a predetermined filter:
block transmission of the network packet, and
decrease a priority of execution of one or more packet processing threads to reduce processor utilization of processing related to network packets matching the predetermined filter.
2. The appliance of claim 1 , wherein the network security device is configured, responsive to receipt of a network packet from an unrecognized device, to store the network packet in a memory of the network security device; and wherein the input/output device is configured to display, via the user interface, a notification of the received network packet.
3. The appliance of claim 2 , wherein the input/output device is configured to detect an interaction with the user interface indicating to authorize the unrecognized device.
4. The appliance of claim 3 , wherein the network security device is configured, responsive to detection of the interaction, to retrieve the network packet from the memory of the network security device, and forward the network packet to a destination identified in the network packet.
5. The appliance of claim 2 , wherein the network security device is configured, responsive to an absence of a detection of an interaction with the user interface, to discard the network packet.
6. The appliance of claim 1 , wherein the input/output device is a multi-touch screen display.
7. The appliance of claim 1 , further comprising a first network interface coupled to the first network and a second network interface coupled to the second network.
8. The appliance of claim 1 , wherein the network security device is configured to, responsive to receipt of the network packet matching the predetermined filter:
reserve a predetermined amount of memory of the network security device for the user interface provided by the input/output device.
9. The appliance of claim 8 , wherein the network security device is further configured to transmit a notification to a second device, responsive to receipt of the network packet matching the predetermined filter.
10. The appliance of claim 8 , wherein the predetermined filter comprises one or more of a source address, destination address, protocol, payload size, or frequency of packet reception.
11. The appliance of claim 1 , further comprising:
a processor;
a memory device; and
a network interface.
12. An appliance, comprising:
a housing;
a network security device deployed within the housing, coupled to a first network and a second network; and
an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device;
wherein the network security device is configured to increase a priority of execution of the user interface to increase responsiveness of the user interface, responsive to receipt of a network packet matching a predetermined filter.
13. An appliance, comprising:
a housing;
a network security device deployed within the housing, coupled to a first network and a second network; and
an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device;
wherein the network security device is configured to, responsive to receipt of a network packet matching a predetermined filter:
detect an interaction with the user interface indicating to increase a priority of a second filter matching the network packet, and
increase the priority of the second filter in a rule set of the network security device.
14. The appliance of claim 13 , wherein the network security device is further configured to apply the second filter ahead of one or more lower-priority filters to a second received network packet; and discard the second received network packet prior to applying the one or more lower-priority filters, responsive to the second received network packet matching the second filter.
15. A method, comprising:
receiving, by a network security device deployed within a housing of an appliance, a first packet;
displaying a notification of receipt of the first packet, by an input/output device deployed on a surface of the housing, the input/output device providing a user interface of the network security device, responsive to the first packet matching a predetermined filter;
blocking transmission of the first packet, by the network security device, responsive to the first packet matching the predetermined filter;
storing the first packet in a memory of the appliance, by the network security device, responsive to the first packet matching the predetermined filter; and
decreasing a priority of execution of one or more packet processing threads to reduce processor utilization of processing related to network packets matching the predetermined filter.
16. The method of claim 15 , further comprising reserving a predetermined amount of memory of the network security device for the user interface provided by the input/output device, responsive to the first packet matching a predetermined filter.
17. The method of claim 15 , further comprising detecting an interaction with the user interface indicating a source of the first packet is an authorized device.
18. The method of claim 17 , further comprising retrieving the first packet from the memory of the appliance, and forwarding the first packet to a destination identified in the first packet, responsive to the detected interaction with the user interface.